FreeS/WAN man pages
Keywords: Linux, IPsec, VPN, security, FreeSWAN, manpage, manual, page

# FreeS/WAN manual pages

The various components of Linux FreeS/WAN are of course documented in standard Unix manual pages, accessible via the man(1) command.

Links here take you to an HTML version of the man pages.

## Files

ipsec.conf(5)
  IPsec configuration and connections
ipsec.secrets(5)
  secrets for IKE authentication, either pre-shared keys or RSA private keys

These files are also discussed in the configuration section.

## Commands

Many users will never give most of the FreeS/WAN commands directly. Configure the files listed above correctly and everything should be automatic.

The exceptions are commands for mainpulating the RSA keys used in Pluto authentication:

ipsec_rsasigkey(8)
  generate keys
ipsec_newhostkey(8)
  generate keys in a convenient format
ipsec_showhostkey(8)
  extract RSA keys from ipsec.secrets(5) (or optionally, another file) and format them for insertion in ipsec.conf(5) or in DNS records

Note that:

- These keys are for authentication only. They are not secure for encryption.
- The utility uses random(4) as a source of random numbers. This may block for some time if there is not enough activity on the machine to provide the required entropy. You may want to give it some bogus activity such as random mouse movements or some command such as `du /usr > /dev/null &`.

The following commands are fairly likely to be used, if only for testing and status checks:

ipsec(8)
  invoke IPsec utilities
ipsec_setup(8)
  control IPsec subsystem
ipsec_auto(8)
  control automatically-keyed IPsec connections
ipsec_manual(8)
  take manually-keyed IPsec connections up and down
ipsec_ranbits(8)
  generate random bits in ASCII form
ipsec_look(8)
  show minimal debugging information
ipsec_barf(8)
  spew out collected IPsec debugging information

The lower-level utilities listed below are normally invoked via scripts listed above, but they can also be used directly when required.

ipsec_eroute(8)
  manipulate IPsec extended routing tables
ipsec_klipsdebug(8)
  set Klips (kernel IPsec support) debug features and level
ipsec_pluto(8)
  IPsec IKE keying daemon
ipsec_spi(8)
  manage IPsec Security Associations
ipsec_spigrp(8)
  group/ungroup IPsec Security Associations
ipsec_tncfg(8)
  associate IPsec virtual interface with real interface
ipsec_whack(8)
  control interface for IPsec keying daemon

## Library routines

ipsec_atoaddr(3)
ipsec_addrtoa(3)
  convert Internet addresses to and from ASCII
ipsec_atosubnet(3)
ipsec_subnettoa(3)
  convert subnet/mask ASCII form to and from addresses
ipsec_atoasr(3)
  convert ASCII to Internet address, subnet, or range
ipsec_rangetoa(3)
  convert Internet address range to ASCII
ipsec_atodata(3)
ipsec_datatoa(3)
  convert binary data from and to ASCII formats
ipsec_atosa(3)
ipsec_satoa(3)
  convert IPsec Security Association IDs to and from ASCII
ipsec_atoul(3)
ipsec_ultoa(3)
  convert unsigned-long numbers to and from ASCII
ipsec_goodmask(3)
  is this Internet subnet mask a valid one?
ipsec_masktobits(3)
  convert Internet subnet mask to bit count
ipsec_bitstomask(3)
  convert bit count to Internet subnet mask
ipsec_optionsfrom(3)
  read additional ``command-line'' options from file
ipsec_subnetof(3)
  given Internet address and subnet mask, return subnet number
ipsec_hostof(3)
  given Internet address and subnet mask, return host part
ipsec_broadcastof(3)
  given Internet address and subnet mask, return broadcast address