diff --git a/net/strongswan/Makefile b/net/strongswan/Makefile
index 9ce093bf2..b770648d5 100644
--- a/net/strongswan/Makefile
+++ b/net/strongswan/Makefile
@@ -561,7 +561,9 @@ define Plugin/updown/install
 	$(INSTALL_DIR) $(1)/usr/lib/ipsec/plugins
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/_updown $(1)/usr/lib/ipsec/
 	$(CP) $(PKG_INSTALL_DIR)/usr/lib/ipsec/plugins/libstrongswan-updown.so $(1)/usr/lib/ipsec/plugins/
-	$(INSTALL_DIR) $(1)/etc
+	$(INSTALL_DIR) $(1)/etc/hotplug.d/ipsec
+	$(CP) ./files/etc/hotplug.d/ipsec/01-user \
+		$(1)/etc/hotplug.d/ipsec/01-user
 endef
 
 define Plugin/vici/install
diff --git a/net/strongswan/files/etc/hotplug.d/ipsec/01-user b/net/strongswan/files/etc/hotplug.d/ipsec/01-user
new file mode 100644
index 000000000..3d485c8b7
--- /dev/null
+++ b/net/strongswan/files/etc/hotplug.d/ipsec/01-user
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+[ -e "/etc/ipsec.user" ] && {
+	. /etc/ipsec.user "$2"
+}
+
+exit 0
diff --git a/net/strongswan/patches/300-include-ipsec-hotplug.patch b/net/strongswan/patches/300-include-ipsec-hotplug.patch
new file mode 100644
index 000000000..8e54050de
--- /dev/null
+++ b/net/strongswan/patches/300-include-ipsec-hotplug.patch
@@ -0,0 +1,16 @@
+--- a/src/_updown/_updown.in
++++ b/src/_updown/_updown.in
+@@ -22,6 +22,13 @@
+ # that, and use the (left/right)updown parameters in ipsec.conf to make
+ # strongSwan use yours instead of this default one.
+ 
++# Add your custom commands to the file "/etc/ipsec.user". Other packages could
++# also install their scripts in the directory "/etc/hotplug.d/ipsec".
++# This files/scripts are executed by the openwrt hotplug functionality on
++# ipsec events.
++
++exec /sbin/hotplug-call ipsec "$1"
++
+ #      PLUTO_VERSION
+ #              indicates  what  version of this interface is being
+ #              used.  This document describes version  1.1.   This
diff --git a/net/strongswan/patches/300-include-ipsec-user-script.patch b/net/strongswan/patches/300-include-ipsec-user-script.patch
deleted file mode 100644
index 6835e02fe..000000000
--- a/net/strongswan/patches/300-include-ipsec-user-script.patch
+++ /dev/null
@@ -1,17 +0,0 @@
---- a/src/_updown/_updown.in
-+++ b/src/_updown/_updown.in
-@@ -16,11 +16,9 @@
- # or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- # for more details.
- 
--# CAUTION:  Installing a new version of strongSwan will install a new
--# copy of this script, wiping out any custom changes you make.  If
--# you need changes, make a copy of this under another name, and customize
--# that, and use the (left/right)updown parameters in ipsec.conf to make
--# strongSwan use yours instead of this default one.
-+# Add your custom ip rules to the /etc/ipsec.user file if you need that functionality.
-+
-+[ -e /etc/ipsec.user ] && . /etc/ipsec.user "$1"
- 
- #      PLUTO_VERSION
- #              indicates  what  version of this interface is being