diff --git a/Makefile b/Makefile
index 8446720..6b0b46e 100755
--- a/Makefile
+++ b/Makefile
@@ -121,6 +121,7 @@ docker-compose: ## create a compose files
 linux: env ## build linux binary
 	go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan ./cmd/main.go
 	go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-proxy ./cmd/proxy
+	go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-ceci ./cmd/ceci
 	go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-point ./cmd/point
 	go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-switch ./cmd/switch
 
@@ -152,6 +153,7 @@ install: env linux ## install packages
 ## cross build for windows
 windows: ## build windows binary
 	GOOS=windows GOARCH=amd64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-proxy.exe ./cmd/proxy
+	GOOS=windows GOARCH=amd64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-ceci.exe ./cmd/ceci
 
 windows-gzip: env windows ## build windows packages
 	@rm -rf $(WIN_DIR) && mkdir -p $(WIN_DIR)
@@ -166,6 +168,8 @@ osx: darwin
 darwin: env ## build darwin binary
 	GOOS=darwin GOARCH=amd64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-proxy.dar ./cmd/proxy
 	GOOS=darwin GOARCH=arm64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-proxy.arm64.dar ./cmd/proxy
+	GOOS=darwin GOARCH=amd64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-ceci.dar ./cmd/ceci
+	GOOS=darwin GOARCH=arm64 go build -mod=vendor -ldflags "$(LDFLAGS)" -o $(BD)/openlan-ceci.arm64.dar ./cmd/ceci
 
 darwin-gzip: env darwin ## build darwin packages
 	@rm -rf $(MAC_DIR) && mkdir -p $(MAC_DIR)
diff --git a/cmd/api/v5/ipsec.go b/cmd/api/v5/ipsec.go
index fc16b20..1938684 100644
--- a/cmd/api/v5/ipsec.go
+++ b/cmd/api/v5/ipsec.go
@@ -79,9 +79,9 @@ func (o IPSecTunnel) Restart(c *cli.Context) error {
 
 func (o IPSecTunnel) Tmpl() string {
 	return `# total {{ len . }}
-{{ps -15 "Remote"}} {{ps -15 "Protocol"}} {{ps -15 "Secret"}} {{ps -15 "Connection"}}
+{{ps -15 "Remote"}} {{ps -15 "Protocol"}} {{ps -15 "Secret"}} {{ps -15 "Connection"}} {{ps -8 "state"}}
 {{- range . }}
-{{ps -15 .Right}} {{ps -15 .Transport }} {{ps -15 .Secret}} [{{.LeftId}}]{{.LeftPort}} -> [{{.RightId}}]{{.RightPort}}
+{{ps -15 .Right}} {{ps -15 .Transport }} {{ps -15 .Secret}} [{{.LeftId}}]{{.LeftPort}} -> [{{.RightId}}]{{.RightPort}} {{ps -8 .State}}
 {{- end }}
 `
 }
diff --git a/cmd/api/v5/output.go b/cmd/api/v5/output.go
index 1a970c4..f2c252e 100644
--- a/cmd/api/v5/output.go
+++ b/cmd/api/v5/output.go
@@ -69,7 +69,7 @@ func (o Output) Tmpl() string {
 	return `# total {{ len . }}
 {{ps -24 "network"}} {{ps -15 "protocol"}} {{ps -15 "Remote"}} {{ps -15 "segment"}} {{ps -15 "device"}}
 {{- range . }}
-{{ps -24 .Network}} {{ps -15 .Protocol}} {{ps -15 .Remote}} {{ if .Segment }} {{pi -15 .Segment }} {{ else }} {{ps -15 .Secret}}  {{ end }} {{ps -15 .Device}}
+{{ps -24 .Network}} {{ps -15 .Protocol}} {{ps -15 .Remote}} {{ if .Segment }}{{pi -15 .Segment }}{{ else }}{{ps -15 .Secret}}{{ end }} {{ps -15 .Device}} {{.Crypt}}
 {{- end }}
 `
 }
diff --git a/cmd/ceci/main.go b/cmd/ceci/main.go
new file mode 100644
index 0000000..30966fd
--- /dev/null
+++ b/cmd/ceci/main.go
@@ -0,0 +1,18 @@
+package main
+
+import (
+	"github.com/luscis/openlan/pkg/config"
+	"github.com/luscis/openlan/pkg/libol"
+	"github.com/luscis/openlan/pkg/proxy"
+)
+
+func main() {
+	c := config.NewHttpProxy()
+	if c != nil {
+		libol.PreNotify()
+		h := proxy.NewHttpProxy(c, nil)
+		libol.SdNotify()
+		libol.Go(h.Start)
+		libol.Wait()
+	}
+}
diff --git a/pkg/config/proxy.go b/pkg/config/proxy.go
index df602ef..436fbb6 100755
--- a/pkg/config/proxy.go
+++ b/pkg/config/proxy.go
@@ -33,6 +33,7 @@ type HttpForward struct {
 }
 
 type HttpProxy struct {
+	Conf     string         `json:"-" yaml:"-"`
 	ConfDir  string         `json:"-" yaml:"-"`
 	Listen   string         `json:"listen,omitempty"`
 	Auth     *Password      `json:"auth,omitempty" yaml:"auth,omitempty"`
@@ -42,6 +43,37 @@ type HttpProxy struct {
 	Backends []*HttpForward `json:"backends,omitempty" yaml:"backend,omitempty"`
 }
 
+func NewHttpProxy() *HttpProxy {
+	h := &HttpProxy{}
+	h.Parse()
+	err := h.Initialize()
+	if err != nil {
+		return nil
+	}
+	return h
+}
+
+func (h *HttpProxy) Parse() {
+	flag.StringVar(&h.Conf, "conf", "", "The configure file")
+	flag.Parse()
+}
+
+func (h *HttpProxy) Initialize() error {
+	if err := h.Load(); err != nil {
+		libol.Error("Proxy.Initialize %s", err)
+		return err
+	}
+	h.Correct()
+	return nil
+}
+
+func (h *HttpProxy) Load() error {
+	if h.Conf == "" {
+		return libol.NewErr("invalid configure file")
+	}
+	return libol.UnmarshalLoad(h, h.Conf)
+}
+
 func (h *HttpProxy) Correct() {
 	if h.Cert != nil {
 		h.Cert.Correct()
@@ -96,6 +128,15 @@ func (h *HttpProxy) DelMatch(domain, remote string) int {
 	return index
 }
 
+func (h *HttpProxy) Save() {
+	if h.Conf == "" {
+		return
+	}
+	if err := libol.MarshalSave(&h, h.Conf, true); err != nil {
+		libol.Error("Proxy.Save %s %s", h.Conf, err)
+	}
+}
+
 type TcpProxy struct {
 	Listen string   `json:"listen,omitempty"`
 	Target []string `json:"target,omitempty"`
@@ -151,8 +192,8 @@ func (p *Proxy) Load() error {
 	return libol.UnmarshalLoad(p, p.Conf)
 }
 
-func (h *Proxy) Save() {
-	if err := libol.MarshalSave(&h, h.Conf, true); err != nil {
-		libol.Error("Proxy.Save %s %s", h.Conf, err)
+func (p *Proxy) Save() {
+	if err := libol.MarshalSave(&p, p.Conf, true); err != nil {
+		libol.Error("Proxy.Save %s %s", p.Conf, err)
 	}
 }
diff --git a/pkg/proxy/http.go b/pkg/proxy/http.go
index 6a7091f..09ed14b 100755
--- a/pkg/proxy/http.go
+++ b/pkg/proxy/http.go
@@ -555,7 +555,15 @@ func (t *HttpProxy) AddMatch(w http.ResponseWriter, r *http.Request) {
 	} else {
 		encodeYaml(w, "failed")
 	}
-	t.proxer.Save()
+	t.Save()
+}
+
+func (t *HttpProxy) Save() {
+	if t.proxer == nil {
+		t.cfg.Save()
+	} else {
+		t.proxer.Save()
+	}
 }
 
 func (t *HttpProxy) DelMatch(w http.ResponseWriter, r *http.Request) {
@@ -572,7 +580,7 @@ func (t *HttpProxy) DelMatch(w http.ResponseWriter, r *http.Request) {
 	} else {
 		encodeYaml(w, "failed")
 	}
-	t.proxer.Save()
+	t.Save()
 }
 
 func (t *HttpProxy) GetPac(w http.ResponseWriter, r *http.Request) {