resolve Plugin


The resolve plugin for libcharon writes name servers to resolv.conf. It is enabled by default but may be disabled with the ./configure option



Name servers received via CP configuration payloads (IKEv2) or via Mode Config (IKEv1) are added to /etc/resolv.conf or installed via resolvconf(8). When the connection goes down name servers are automatically removed again.


The resolve plugin is configured using the following options in the charon.plugins.resolve section of strongswan.conf:

Key Default Description



File where name servers are written to. [/etc/resolv.conf]



Prefix to be used for interface names provided to resolvconf(8). [lo.inet.ipsec.]

Support for resolvconf(8)

strongSwan provides support for installing name servers via the resolvconf framework. If resolvconf is installed the plugin automatically invokes it appropriately instead of modifying resolv.conf directly.

The interface names provided to resolvconf are built by adding the IP address of the name server to the prefix configured in strongswan.conf (or the default). The result must be a valid interface name according to the rules specified by resolvconf(8). Additionally, the resulting interface name should have a high priority when the order defined in interface-order(5) is applied.