STRONGSWAN(8)

📦
version 6.0.7 · 4 versions
, in fedora 43, fedora 44

✨ STRONGSWAN(8) ✨

okay so bestie, welcome to strongswan 💖 the manual page. yes the whole page is literally named after the command. we're doing this. grab a boba, we're getting into IPsec. 🧋

🌸 NAME 🌸

strongswan — invoke IPsec utilities. that's it. that's the vibe. she's the front door to a whole squad of little utility besties 💅

🎀 SYNOPSIS 🎀

strongswan command [arguments] [options]

💖 DESCRIPTION 💖

so the strongswan utility is like, the group chat admin of the IPsec world. she invokes any of several utilities involved in controlling and monitoring the IPsec encryption/authentication system, running the command you specify with the arguments and options you specify, as if it had been invoked directly. iconique behaviour honestly.

why does this matter? two reasons, and both slay:

  • it largely eliminates possible name collisions with other software (no more drama with some random start binary from a different package 💀)
  • it also permits some centralized services

every command described on this page is built-in and is used to control and monitor IPsec connections as well as the IKE daemon. she's not calling out to random stuff for these — she got it.

for other commands, strongswan supplies the invoked command with a suitable PATH environment variable, and also provides the environment variables listed under ENVIRONMENT. so the command she launches isn't lost in the woods, she's got a whole care package. 🫶

👑 CONTROL COMMANDS 👑

  • start [starter options] — calls starter, which in turn parses ipsec.conf and starts the IKE daemon charon. the classic "wake up babe, we're going online" move ✨
  • update — sends a HUP signal to starter, which in turn determines any changes in ipsec.conf and updates the configuration on the running IKE daemon charon. lowkey the chillest refresh.
  • reload — sends a USR1 signal to starter, which in turn reloads the whole configuration of the running IKE daemon charon based on the actual ipsec.conf. this is the full wardrobe change, not just a new lip gloss.
  • restart — is equivalent to stop followed by start after a guard of 2 seconds. she takes a lil nap before getting back up, it's called self care 😌
  • stop — terminates all IPsec connections and stops the IKE daemon charon by sending a TERM signal to starter. bye bestie 💅
  • up name — tells the IKE daemon to start up connection name.
  • down name — tells the IKE daemon to terminate connection name.
  • down name{n} — terminates IKEv1 Quick Mode and IKEv2 CHILD SA instance n of connection name. surgical. precise. we love a targeted takedown.
  • down name{*} — terminates all IKEv1 Quick Mode and IKEv2 CHILD SA instances of connection name. the group version.
  • down name[n] — terminates IKE SA instance n of connection name.
  • down name[*] — terminates all IKE SA instances of connection name. full send. 🔥
  • down-srcip <start> [<end>] — terminates all IKE SA instances with clients having virtual IPs in the range start-end. if your IP is in the range, you're getting got. no cap.
  • route name — tells the IKE daemon to insert an IPsec policy in the kernel for connection name. the first payload packet matching the IPsec policy will automatically trigger an IKE connection setup. so she just... leaves the trap set and walks away. main character energy 🎀
  • unroute name — remove the IPsec policy in the kernel for connection name. trap disarmed.
  • status [name] — returns concise status information either on connection name or, if the argument is lacking, on all connections. she's giving you the summary. the tl;dr.
  • statusall [name] — returns detailed status information either on connection name or, if the argument is lacking, on all connections. she's giving you the whole essay, with citations.

🦋 LIST COMMANDS 🦋

these ones are all about receipts and inventory. she keeps track of everything, fr fr.

  • leases [<poolname> [<address>]] — returns the status of all or the selected IP address pool (or even a single virtual IP address). who's holding which IP, we see you 👀
  • listalgs — returns a list of supported cryptographic algorithms usable for IKE, and their corresponding plugin. the algorithm menu, and which plugin is cooking each one.
  • listpubkeys [--utc] — returns a list of RSA public keys that were either loaded in raw key format or extracted from X.509 and|or OpenPGP certificates.
  • listcerts [--utc] — returns a list of X.509 and|or OpenPGP certificates that were either loaded locally by the IKE daemon or received via the IKE protocol.
  • listcacerts [--utc] — returns a list of X.509 Certification Authority (CA) certificates that were loaded locally by the IKE daemon from the /etc/strongswan/ipsec.d/cacerts/ directory or received via the IKE protocol.
  • listaacerts [--utc] — returns a list of X.509 Authorization Authority (AA) certificates that were loaded locally by the IKE daemon from the /etc/strongswan/ipsec.d/aacerts/ directory.
  • listocspcerts [--utc] — returns a list of X.509 OCSP Signer certificates that were either loaded locally by the IKE daemon from the /etc/strongswan/ipsec.d/ocspcerts/ directory or were sent by an OCSP server.
  • listacerts [--utc] — returns a list of X.509 Attribute certificates that were loaded locally by the IKE daemon from the /etc/strongswan/ipsec.d/acerts/ directory.
  • listgroups [--utc] — returns a list of groups that are used to define user authorization profiles. yes bestie, groups. like a friend group but for permissions.
  • listcainfos [--utc] — returns certification authority information (CRL distribution points, OCSP URIs, LDAP servers) that were defined by ca sections in ipsec.conf.
  • listcrls [--utc] — returns a list of Certificate Revocation Lists (CRLs) that were either loaded by the IKE daemon from the /etc/strongswan/ipsec.d/crls directory or fetched from an HTTP- or LDAP-based CRL distribution point.
  • listocsp [--utc] — returns revocation information fetched from OCSP servers.
  • listplugins — returns a list of all loaded plugin features. the whole plugin roster, all of them clocked in 🫡
  • listcounters [name] — returns a list of global or connection specific IKE counter values collected since daemon startup. numbers! going! up!
  • listall [--utc] — returns all information generated by the list commands above.
✨ little note bestie: each list command can be called with the --utc option, which displays all dates in UTC instead of local time. pick your timezone king 💜

🌈 REREAD COMMANDS 🌈

when you've changed files on disk and you need the daemon to actually notice. re-reading is self care.

  • rereadsecrets — flushes and rereads all secrets defined in ipsec.secrets. out with the old, in with the new 🤫
  • rereadcacerts — removes previously loaded CA certificates, reads all certificate files contained in the /etc/strongswan/ipsec.d/cacerts directory and adds them to the list of Certification Authority (CA) certificates.
heads up: this does not affect certificates explicitly defined in a ipsec.conf(5) ca section, which may be separately updated using the update command. different lane, different command, iykyk.
  • rereadaacerts — removes previously loaded AA certificates, reads all certificate files contained in the /etc/strongswan/ipsec.d/aacerts directory and adds them to the list of Authorization Authority (AA) certificates.
  • rereadocspcerts — reads all certificate files contained in the /etc/strongswan/ipsec.d/ocspcerts/ directory and adds them to the list of OCSP signer certificates.
  • rereadacerts — reads all certificate files contained in the /etc/strongswan/ipsec.d/acerts/ directory and adds them to the list of attribute certificates.
  • rereadcrls — reads all Certificate Revocation Lists (CRLs) contained in the /etc/strongswan/ipsec.d/crls/ directory and adds them to the list of CRLs.
  • rereadall — executes all reread commands listed above. the "do everything" button. she ate. 🔥

💅 RESET COMMANDS 💅

  • resetcounters [name] — resets global or connection specific counters. fresh start, clean slate, new semester ✨

🧚 PURGE COMMANDS 🧚

the "we're not keeping this" collection. be careful, she's decisive.

  • purgecerts — purges all cached certificates.
  • purgecrls — purges all cached CRLs.
  • purgeike — purges IKE SAs that don't have a Quick Mode or CHILD SA.
  • purgeocsp — purges all cached OCSP information records.

⭐ INFO COMMANDS ⭐

  • --help — returns the usage information for the strongswan command. when you're lost, ask her, she'll point.
  • --version — returns the version in the form of strongSwan U<strongSwan userland version>/K<kernel version>.
  • --versioncode — returns the version number in the form of U<strongSwan userland version>/K<kernel version>.
  • --copyright — returns the copyright information.
  • --directory — returns the LIBEXECDIR directory as defined by the configure options.
  • --confdir — returns the SYSCONFDIR directory as defined by the configure options.
  • --piddir — returns the PIDDIR directory as defined by the configure options.

🍓 FILES 🍓

  • /usr/libexec/strongswan — utilities directory. this is where the utility besties live 🏠

💜 ENVIRONMENT 💜

when calling other commands, the strongswan command supplies the following environment variables. she's packing your bag for you, you're welcome 🫶

  • IPSEC_DIR — directory containing ipsec programs and utilities
  • IPSEC_BINDIR — directory containing pki command
  • IPSEC_SBINDIR — directory containing ipsec command
  • IPSEC_CONFDIR — directory containing configuration files
  • IPSEC_PIDDIR — directory containing PID/socket files
  • IPSEC_SCRIPT — name of the ipsec script
  • IPSEC_NAME — name of ipsec distribution
  • IPSEC_VERSION — version number of ipsec userland and kernel
  • IPSEC_STARTER_PID — PID file for ipsec starter
  • IPSEC_CHARON_PID — PID file for IKE keying daemon

🌈 SEE ALSO 🌈

ipsec.conf(5), ipsec.secrets(5) — go read these too bestie, they're the supporting cast 💖

🎀 HISTORY 🎀

originally written for the FreeS/WAN project by Henry Spencer. then updated and extended for the strongSwan project <http://www.strongswan.org> by Tobias Brunner and Andreas Steffen. a whole glow-up arc, we love to see it 👑

and that's the page!! this was strongSwan version 6.0.7, dated 2013-10-29 🦋 go forth and tunnel responsibly, bestie. mwah 💋✨

📦 where this page comes from