// in development

vpnow.

$ vpnow up office.conf --kill-switch --dns=tunnel

One VPN client for every protocol in use today: WireGuard, OpenVPN, IPsec/IKEv2, corporate SSL-VPN gateways, SSTP, SSH tunnels — and, for old devices if need be, PPTP. Import a profile, connect, done. Kill switch and DNS protection are always included. No account, no telemetry, no VPN service of our own. Native for macOS and Windows.

In development — first beta coming

vpnow is being built right now: first WireGuard, OpenVPN and IKEv2 with profile import, kill switch and DNS protection — right behind them the SSL-VPN gateways, company logins with SSO and MFA, and several tunnels at once. The first beta for macOS and Windows ships with signed in-app updates.

We’ll unlock downloads as soon as the first beta passes our own testing.

One client. Every protocol.

// your server, your gateway — vpnow connects

An SSL VPN at the office, WireGuard on the router at home, IPsec at a client’s site and an SSH tunnel for the old NAS: anyone who needs to reach several networks usually ends up with one client per protocol. vpnow brings them together in one interface — with the same protection for every tunnel, whatever protocol runs underneath.

// client

A tool, not a service

vpnow sells no servers and no locations. You connect to your own server, your router at home or your company’s gateway — vpnow is the client for that, nothing more.

// import

Drop in a profile, connect

WireGuard .conf, OpenVPN .ovpn, IKEv2 and mobile-config profiles, QR codes from the screen or the camera: vpnow reads what your admin or your router hands out, detects from the content which protocol the file describes and sets up the tunnel to match. Before the first connection you see what the profile contains.

// protection

Sealed, even when it stalls

The kill switch blocks traffic outside the tunnel while it is being set up or when it drops. DNS queries go through the tunnel, IPv6 is protected instead of forgotten — the same for every protocol.

// as usual at LAN-SOLO

Local & honest

No account, no telemetry, no connection data on our side. Profiles and keys are stored encrypted on your machine, credentials in the system keychain. Whatever vpnow logs ends up in a file on your disk.

// And to keep it honest: all protocols, kill switch, DNS protection, import and company logins stay free — for good. Several tunnels at once, split tunneling, rules and the command line are the tunneled plan: €12 a year.

Several tunnels

// tunneled plan: office, homelab and client at once, each with its own routes

// tunnels

$ vpnow status
TUNNEL    PROTOCOL   ROUTES
office    wireguard  10.20.0.0/16
homelab   wireguard  192.168.50.0/24
client-a  ikev2      172.16.8.0/22
rest      direct     0.0.0.0/0

// dns

$ vpnow dns
*.corp.internal   → office
*.home.arpa       → homelab
*.client-a.local  → client-a
*                 → system

kill-switch: on · leaks: none

// Each tunnel only gets its own networks and its own DNS zones, everything else goes out directly. No more switching between office and client — both stay open, cleanly separated. Free keeps exactly one tunnel with one route set open; several at once are the tunneled plan.

Protocols

// everything that connects today — and a little of yesterday

vpnow speaks the protocols itself instead of just passing profiles along. What’s listed here is planned for the target release: WireGuard, OpenVPN and IKEv2 ship with the first beta, the rest arrive as updates.

// modern

WireGuard

  • WireGuard (UDP)
  • Import of the WireGuard configuration file (.conf)
  • Pre-shared keys
  • Multiple peers per tunnel

// classic

OpenVPN

  • OpenVPN over UDP
  • OpenVPN over TCP
  • Data channel offload (DCO)
  • TLS auth / TLS crypt
  • Certificates and username/password

// ssl-vpn gateways

Company gateways (SSL VPN)

  • OpenConnect protocol (open SSL VPN standard)
  • TLS control channel with DTLS or ESP data channel over UDP
  • Automatic fallback to TCP/443
  • Browser sign-in: SAML/SSO at the gateway
  • Certificates, smartcards and one-time codes
  • Routes and DNS taken from the gateway

// standards & tunnels

IPsec, SSTP and more

  • IPsec / IKEv2
  • L2TP/IPsec
  • SSTP
  • SoftEther (SSL VPN)
  • SSH tunnels
  • SOCKS5 proxy over SSH

// legacy

For old devices

  • PPTP

PPTP has been considered broken for years: its encryption can be cracked with modest effort. vpnow only offers it so that old routers and devices that support nothing else can still be reached — hidden by default and with a warning before every connection. For everything else, please use WireGuard or IKEv2.

// With company gateways, vpnow speaks the respective protocol, not the vendor’s software. Anything extra the gateway demands, such as its own device checks, may therefore differ — more on that below.

Features

// planned for version 1.0

Import with protocol detection

Take over profiles by double-click, drag & drop or QR code: WireGuard .conf, OpenVPN .ovpn, IKEv2 and mobile-config profiles, certificates as PEM or PKCS#12. vpnow detects the protocol from the file’s content, not its extension — a WireGuard configuration saved as .txt still becomes a WireGuard tunnel. Before the first connection, vpnow checks the profile and shows what’s missing.

Kill switch & DNS protection

Not a single packet leaves the machine around the tunnel while it is being set up, reconnecting or dropping. DNS goes through the tunnel, IPv6 is protected too, and a leak test shows at the push of a button whether everything is sealed.

Company logins

Sign in to the company gateway as usual: SAML/SSO in the browser, MFA with one-time codes (TOTP) or push, client certificates from a file, the keychain or a smartcard (PKCS#11). Credentials stay in the system keychain.

Several tunnels at oncetunneled

Keep several WireGuard tunnels open in parallel — office, homelab and client at the same time. Mixed across protocols, too: WireGuard next to IKEv2 next to an SSL VPN, each with its own routes and its own DNS zones. vpnow detects overlapping networks and asks before routes get in each other’s way.

Split tunnelingtunneled

Decide for yourself what goes through the tunnel: per app, per domain or per subnet, as an include or exclude list. The video call goes direct, accounting goes through the office — without maintaining routes by hand.

Rules & auto-connecttunneled

Connect automatically on untrusted Wi-Fi, on specific SSIDs or on demand as soon as a company domain is requested. On your trusted network at home the tunnel stays off, at the café it comes on by itself.

Command line & headlesstunneled

Every tunnel controllable from the command line, with JSON output for scripts. Headless as a service on servers and build machines without a desktop, using the same profile format as the app.

Profile sync via filetunneled

All profiles, rules and settings in one encrypted file — for your second machine, your backup or the folder you sync anyway. No cloud account, no server on our side.

Statistics & logstunneled

Throughput, latency, handshakes and dropouts per tunnel, as a history rather than a snapshot. Detailed logs to export when your admin wants to know what’s stuck — Free shows the current status.

Pricing

// Free connects — tunneled connects everything at once

Free

For anyone who wants to connect securely to one network

€0/ year
  • All protocols, exactly one active tunnel with one route set
  • Kill switch and DNS protection including IPv6
  • Import of WireGuard .conf, OpenVPN .ovpn and profile files, QR codes — protocol detected automatically
  • Company logins: SAML/SSO, MFA/OTP, certificates and smartcards
  • Current connection status with throughput
  • Native for macOS and Windows — no account, no telemetry

tunneled

For everyone who needs several networks at once

€12/ year
= €1 per month
available at launch
  • Everything in Free
  • Several WireGuard tunnels at once, also mixed across protocols — each with its own routes and DNS
  • Split tunneling per app, domain or subnet
  • Rules: auto-connect on untrusted Wi-Fi, per SSID or on demand
  • Command line with JSON output and headless operation
  • Profile sync via encrypted file, statistics and logs to export

Free stays free — for good, no strings attached. vpnow tunneled: €12 a year, that’s €1 a month. Incl. VAT, billed yearly, cancel anytime.

// Honest as always: vpnow is a client, not a VPN service — you bring your own server or company gateway, and vpnow only changes your IP address as far as your own server does. Some protocols need system components or a helper service with administrator rights, which vpnow sets up once during installation and which you can remove at any time. And with company gateways, vpnow speaks the open protocol: proprietary vendor features such as device checks or special sign-in methods may differ or be missing. If in doubt, ask your IT before relying on vpnow.