Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have StrongSwan VPN server set up on a Debian host, and would like to run a custom script when a client connects to it. The only thing I have come up with is periodically checking the contents of the log file, but that seems clunky.

Is there any way to specify a script to execute upon connection, preferably with some way to infer the originating IP and login information used for that connection?

share|improve this question
up vote 1 down vote accepted

You could use leftupdown or rightupdown parameter(s) in connection section. These will run a script specified as a parameter every time a connection changes state:

left|rightupdown = <path>

  what updown script to run to adjust routing and/or firewalling when the status
  of the connection changes (default ipsec _updown).

There are some environment variables which give you at least the login information for the connection changing state, for example $PLUTO_PEER gives you peer IP. For more about available environment variables, see man 8 pluto (or man 8 ipsec_pluto).

share|improve this answer
It's worth noting that the script specified will run instead of the default one, not in addition to it. So if you'd like to add something to the default script, make a copy of it, change it to your liking, and point leftupdown parameter to it :) – SaltyNuts May 16 '14 at 19:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.