Where Does Libreswan Store VPN Config?
Libreswan keeps IPsec connection files in ipsec.d under etc, with secrets in a root only file. Per tunnel files beat one giant config.
Last updated
Libreswan follows the classic Unix split: a small main config file plus a directory of per connection files. The main file sets global behavior, and each tunnel gets its own file in the ipsec.d directory. Logs go to the system journal under the ipsec service.
Secrets stay in a separate root only file, which matters on shared boxes. Back up the connection directory and the secrets file together. One without the other restores nothing usable.
Where Libreswan stores this, by platform
/etc/ipsec.d
Per connection tunnel files live here with one file per tunnel. Secrets stay in the root only secrets file beside the main config. Reload the ipsec service after edits.
Frequently asked questions
How do I add a new VPN tunnel?
Add a new connection file in the ipsec.d directory and reload the service. Keeping one file per tunnel makes debugging and version control far easier than editing a shared config.
Where do connection failures get logged?
The system journal for the ipsec service. Pluto logs each phase of negotiation there, which is where mismatched proposals and dead peer detection show up first.
Does this apply to NetworkManager VPN profiles?
No. NetworkManager with the libreswan plugin stores its tunnels in NetworkManager keyfiles instead, and manages secrets through its own store. These paths are for system managed tunnels.
Notice an outdated path? Let us know.