IPSEC-ADDCONN(8) Executable programs IPSEC-ADDCONN(8)

.SH "NAME" ipsec-addconn - load a given policy into the pluto IKE daemon

.SH "SYNOPSIS"

.HP 336u

**ipsec addconn**  
\[--config */etc/ipsec.conf*]  
\[--ctlsocket */run/pluto/pluto.ctl*]  
\[--verbose]  
\[--debug]  
\[--quiet]  
\--options...

.HP 336u

**ipsec addconn**  
*connection*...

.HP 336u

**ipsec addconn**  
\--configsetup \[*=option*]  
\[--noexport]

.HP 336u

**ipsec addconn**  
\--liststack  
\[--noexport]

.HP 336u

**ipsec addconn**  
\--checkconfig

.HP 336u

**ipsec addconn**  
\--autoall

.HP 336u

**ipsec addconn**

| --listadd | --listall | --listignore | --listroute | --liststart

.HP 336u

**ipsec addconn**  
\--name *connection-name*  
\[left=*address*]  
\[right=*address*]  
*option*=*value*...

.HP 336u

**ipsec addconn**  
\--help

.SH "DESCRIPTION"

.PP **ipsec addconn** takes a config file (or stdin) containing the format of ipsec.conf, or the format of individual "conn" sections, and uses that information to load named or all connections defined in that configuration file into the running libreswan pluto IKE daemon. If no configuration file is specified, the default configuration file is used. If no pluto socket is specified, the default socket location will be used.

.PP When **--autoall** is specified, all connections that include the **auto=** configuration option are processed as follows:

.PP **auto=add**  
**auto=keep**

the *connection* is loaded

.RE  
.PP **auto=route**  
**auto=ondemand**

the *connection* is loaded and routed

.RE  
.PP **auto=up**  
**auto=start**

the *connection* is loaded, routed, marked as needing to stay up, and initiated

.RE

.PP If the *connection* is already loaded then it is first removed.

.PP When one or more *connections* are specified, those connections are loaded. Any **auto=** in the configuration is ignored.

.PP When **--configsetup** is specified, the configuration file is parsed for the *config setup* section and printed to the terminal in a form usable as a shell script. These are prefaced with *export* unless **--noexport** is specified. When an *option* is specified, just the value of that option is printed.

.PP When **--checkconfig** is specified, the configuration file is parsed and all sections are checked for correct syntax. If an error is found, information about it is printed to the terminal.

.PP When **--listroute** or **--liststart** is specified, no connections are added or replaced, only shown. This command can be used to verify which connections the **addcon** command would act upon, without actually performing any action.

.PP When **--name connection** is specified, **addconn** constructs a connection description by parsing the remainder of the command line as [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) conn section key-values. The resulting connection is then loaded into **pluto**.

.PP When **--quiet** is specified, log messages from **pluto** are not copied to standard output. To avoid connection messages being duplicated in the logs, **pluto**, during startup, invokes **addconn** with this option.

.SH "SEE ALSO"

.PP [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5), [**ipsec**(8)](/man/enterprise-packages/libreswan/ipsec.8), [**libreswan**(7)](/man/enterprise-packages/libreswan/libreswan.7)

.SH "HISTORY"

.PP Man page written for the Libreswan project <**https://libreswan.org/**> by Paul Wouters

.SH "AUTHOR"

Andrew Cagney, Daniel Kahn Gillmor, Harald Jenny, Jose Quaresma, Michael Richardson, Paul Wouters, Tuomo Soini

10/06/2026 Libreswan v5.4.1-HEAD

---

Document: ipsec-addconn(8) from libreswan 5.4.1-r0 (Chainguard OS)
Source: https://github.com/libreswan/libreswan