One small core does what a kernel does for a network path. Tunnels, proxies and rules run on it, and so does everything you build. The OS is VPN Works; its kernel is vpnw.
17 of 17
Ways out of the sealed sandbox tried, and all blocked, IPv6 included
155 of 155
Test functions passed, with end-to-end runs of the real binary through a real WireGuard tunnel
18 of 18
Faults thrown at the WireGuard tunnel and handled: a silent peer, lost handshakes, an impostor, a DNS server that lies
0.13 ms
For a Guard plugin to decide on a connection, inside its WebAssembly sandbox
Measured on VPN Works 0.6.0 by tools/record-results.sh in the code repository: the sandbox on a GitHub Actions Linux runner, the rest on one Linux machine with 2 CPUs.
releases
VPN Works 0.5.0 brings Ledger back, as plugins. One seals every event of a run into a file as it happens. The other checks that file and names the line anyone changed. …
releases
VPN Works 0.6.0 brings Lab back as the fault kit every tunnel must pass before it ships. It broke the WireGuard path 18 ways. The path now handles all 18, and four fixes …
testing
Every number on vpnw.com comes from one script in the code repository, run on one Linux machine with 2 CPUs. Its output is committed next to the code, so anyone can check …
releases
VPN Works 0.4.0 sends one program through a WireGuard tunnel and leaves the rest of the machine alone. vpnw runs the tunnel itself, inside its own process, so it needs no …
releases
VPN Works 0.4.1 adds no features. It closes the one gap the 0.4.0 tests left open, and it fixes a bug those same tests turned up along the way. The gap was IPv6. A sealed …
releases
VPN Works started as five separate engines that each worked and didn’t add up to one thing. Version 0.3.0 rebuilt it from scratch as one small core, vpnw, with …
about
VPN Works is the name of an operating system for network paths: the VPN, rebuilt as an OS. It isn’t a VPN app. There’s no server list, no country picker and …
case studies
A stand-in VPN client sent 81 DNS queries to the home router while it reconnected, every one outside the tunnel. Lab caught it in VPN Works 0.2.0. VPN Works now runs …
case studies
An attacker steals an agent’s token and sends requests straight to the exit, skipping the agent’s machine. Exit checked each one against the agent’s own …
Teams running AI agents, scrapers or build jobs that need narrow, recorded network access, and anyone who'd like to write a plugin for VPN Works, are welcome to write.