VPNW.com

VPN Works 0.7.0 Adds Exit With Fixed Addresses and a Second Policy Check at the Far End

Wed, 14 Oct 2026 00:00:00 +0000

VPN Works 0.7.0 brings Exit back, inside vpnw itself. vpnw exit runs on a server with fixed addresses, takes each client’s requests over TLS, decides every one again with that client’s own policy, and connects from the client’s own address.

Partners and internal systems often let traffic in by address, so agents and CI jobs need fixed addresses to leave from. The usual answer is a proxy with a fixed address, and a plain proxy trusts whatever reaches it with the right password. A hijacked client, or anyone who copied its token, can send anything through it.

VPN Works 0.8.0 Adds Tunnel Plugins and Rotates Through a Folder of WireGuard Configs

Wed, 14 Oct 2026 00:00:00 +0000

VPN Works 0.8.0 opens a new kind of plugin, the Tunnel. A Tunnel plugin hands the kernel WireGuard configs and says how long to keep each, and vpnw runs every tunnel itself. The built-in rotate takes the configs in a folder and moves to the next one every so often, or when a tunnel stops answering.

A scraper or a crawler often has to change where it leaves from, every few minutes or as soon as a server goes quiet. VPN providers hand out one WireGuard config per server, and switching between them by hand means stopping the program, or running a VPN for the whole machine.

VPN Works 0.5.0: Ledger Seals Each Run's Record and Names the Line Anyone Changed

Tue, 13 Oct 2026 00:00:00 +0000

VPN Works 0.5.0 brings Ledger back, as plugins. One seals every event of a run into a file as it happens. The other checks that file and names the line anyone changed.

After an incident, the record of where a program connected is the evidence. A plain log file can be edited by anyone who reaches it, and a careful edit leaves no mark. Ledger makes every edit leave one:

VPN Works 0.6.0: Lab Breaks the Tunnel on Purpose, and Four Fixes Come Out of It

Tue, 13 Oct 2026 00:00:00 +0000

VPN Works 0.6.0 brings Lab back as the fault kit every tunnel must pass before it ships. It broke the WireGuard path 18 ways. The path now handles all 18, and four fixes came out of the cases it didn’t handle at first.

A tunnel that works on a good network proves little. The cases that matter are the bad ones: a VPN server that stops answering, a handshake lost on the way, a network that sends your packets somewhere else, a DNS server that lies. When one of those happens, the program has to find out and nothing may slip around the tunnel. Afterwards, the record has to say what happened.

How VPN Works 0.4.0 Was Tested: 121 Tests, a Real WireGuard Peer and 14 Ways Out Blocked

Fri, 09 Oct 2026 00:00:00 +0000

Every number on vpnw.com comes from one script in the code repository, run on one Linux machine with 2 CPUs. Its output is committed next to the code, so anyone can check a figure against the run that produced it.

The script is tools/record-results.sh, and it writes to test/results. It builds the plugins and the binaries, runs every test, runs them again under Go’s race detector, measures coverage, runs nine fuzz targets, times the plugins and the WireGuard path, and tries every known way out of the sealed sandbox.

VPN Works 0.4.0: WireGuard Tunnels for One Program at a Time, Without Root

Fri, 09 Oct 2026 00:00:00 +0000

VPN Works 0.4.0 sends one program through a WireGuard tunnel and leaves the rest of the machine alone. vpnw runs the tunnel itself, inside its own process, so it needs no root, no kernel module and no network interface.

Give vpnw the WireGuard config your VPN provider or your own server hands out, and the program you name goes through it:

vpnw guard --wireguard office.conf --policy agent.toml -- ./my-agent

Everything else on the machine keeps its usual network. The program is sealed in, so it can’t go around the tunnel, and every connection it makes is still checked against the policy and written down.

VPN Works 0.4.1: All 17 Ways Out of the Sealed Sandbox Blocked, IPv6 Included

Fri, 09 Oct 2026 00:00:00 +0000

VPN Works 0.4.1 adds no features. It closes the one gap the 0.4.0 tests left open, and it fixes a bug those same tests turned up along the way.

The gap was IPv6. A sealed program tries every known way around vpnw, and two of those ways go over IPv6. The machine that records the project’s figures has no IPv6 in its kernel at all, so those two tests never ran. 0.4.0 said so: 14 of 14 blocked, 2 not run.

VPN Works Rebuilt as One Core With Plugins: What Moved Where in 0.3.0

Fri, 09 Oct 2026 00:00:00 +0000

VPN Works started as five separate engines that each worked and didn’t add up to one thing. Version 0.3.0 rebuilt it from scratch as one small core, vpnw, with plugins for everything else.

The five engines of September were the Agent, Scope, Lab, Ledger and Exit. Each had its own binary, its own command line and its own browser demo. Underneath, the Agent’s code was already shaped like a core: a broker that takes every connection, a policy, paths, and one event model that everything spoke. What was missing was a way for everything else to plug into it.

Why the Project Is Called VPN Works When It Isn't Another VPN App

Fri, 09 Oct 2026 00:00:00 +0000

VPN Works is the name of an operating system for network paths: the VPN, rebuilt as an OS. It isn’t a VPN app. There’s no server list, no country picker and no monthly plan. The name is about what a VPN is supposed to do, and doing it at the level where it’s needed now.

A VPN, at its core, decides which way your traffic leaves and who gets to see it. For twenty years that decision was made for a whole machine. You turn the VPN on, and everything goes through it. You turn it off, and nothing does.

DNS Leak Case Study: A Stand-In VPN Client Sends 81 Queries to the Home Router While It Reconnects

Tue, 06 Oct 2026 00:00:00 +0000

A stand-in VPN client sent 81 DNS queries to the home router while it reconnected, every one outside the tunnel. Lab caught it in VPN Works 0.2.0. VPN Works now runs tunnels of its own, and the lessons went straight into its WireGuard path.

Lab was a test bench for VPN apps: run one in a private network, keep a probe sending traffic, and break things on a timetable. In this case the VPN server fell silent for five seconds, and two stand-in clients went through the same outage. One had a fault planted on purpose: while it reconnected, it pointed its DNS at the home router. Lab’s observers counted 81 queries arriving at the router’s resolver, every name the probe looked up while the client reconnected. Its kill switch held everything else, and the correct client leaked nothing.

Fixed Exit Case Study: A Stolen Agent Token Reaches Nothing Its Policy Refuses, Even Sent Straight to the Exit

Tue, 06 Oct 2026 00:00:00 +0000

An attacker steals an agent’s token and sends requests straight to the exit, skipping the agent’s machine. Exit checked each one against the agent’s own policy again, and nothing it refused got through. That was VPN Works 0.2.0. It’s back in 0.7.0, as vpnw exit, inside vpnw itself.

Partners and internal systems often let traffic in by IP address, so agents and CI jobs need fixed addresses to leave from. The usual answer is a proxy with a fixed address. A plain proxy trusts whatever reaches it with the right token, so a stolen token is a key to everything the address can reach.

Tampered Log Case Study: 12 of 12 Edits to an AI Agent's Sealed Record Caught at the Exact Line

Tue, 06 Oct 2026 00:00:00 +0000

Someone edits an AI agent’s connection record to hide where it sent data. Ledger caught 12 of 12 such edits at the exact line, in VPN Works 0.2.0. It’s back in 0.5.0, as a plugin that seals a run’s record while the run goes.

After an incident, the record of where an agent connected is the evidence. An ordinary log file can be edited by anyone who can reach it, and a careful edit leaves no mark. Ledger sealed a log as it was: a hash for every line, chained to the lines before it, and at intervals a checkpoint signed with Ed25519.

Stolen VPN Login Case Study: Rules Learned From Two Weeks of Traffic Stop 136 of 144 Attempts

Thu, 01 Oct 2026 00:00:00 +0000

Someone logs in to a company VPN as Alice from finance, with her stolen password, and tries 12 internal systems on 12 common ports. On a flat VPN all 144 attempts get through. Under rules Scope learned from two weeks of the company’s own traffic, 136 were stopped.

This was Scope, VPN Works’ engine for company VPNs, in version 0.2.0. Its demo office had 30 people in five teams using 12 internal systems, generated from a fixed seed so the same numbers come out every time. Scope read 20,232 connections from two weeks, kept no content, and drafted 39 team rules, 11 personal rules and 3 destinations for a person to review. Before anything was enforced, it replayed the following week against the draft: 12 of 10,387 connections would have been blocked, and both causes were worth a look.

The Next VPN Works Prototypes: A 14-Week Beta for AI Agents and a Real Gateway Pilot for Scope

Thu, 01 Oct 2026 00:00:00 +0000

On October 1, 2026, the plan was a 14-week Beta for AI agents and a gateway pilot for Scope. A week later the project took a different turn: it rebuilt VPN Works as one core with plugins first. Here’s what became of each part of the plan.

The Beta plan was a list of additions to the Agent: a WireGuard route, limits on files, walls that report, macOS, one-step installs, recipes for real agents, and four weeks of real agents running under vpnw every working day. Scope’s part was a pilot on a real company gateway.

VPN Works Explained: How vpnw Gives Each AI Agent Its Own Network, and How Scope Narrows the Company VPN

Thu, 01 Oct 2026 00:00:00 +0000

vpnw gives a program a sealed room with one door. The door checks a short list of where the program may go, sends it out the way you picked, and writes everything down. That’s the kernel of VPN Works, the VPN rebuilt as an operating system. For a whole company VPN, the same idea is called Scope, and it’s on the way.

Think of a program, an AI agent say, as a guest who’ll do whatever the last note they read told them. You can’t check every note. You can decide which doors they can open.

Where the Money Is in VPN Works: One Policy for Every AI Agent, and Least-Privilege Access on the Company VPN

Thu, 01 Oct 2026 00:00:00 +0000

AI agents need network rules per program, and every agent vendor now ships its own fence that works only for its own agent. One policy and one record across all of them is the gap, and it’s where the money could be.

A company running AI agents in 2026 runs several: a coding agent from one vendor, another in CI, browser agents, home-grown scripts. Each vendor that offers network limits offers them for its own agent, with its own settings and its own logs, if any. Security teams end up with a fence per vendor and no single answer to “what can our agents reach, and what did they reach?”

Cloud Metadata Case Study: Request for Instance Credentials Blocked Before Any Connection Is Made

Tue, 29 Sep 2026 00:00:00 +0000

A program asks the cloud’s metadata address for the machine’s credentials, the classic first move after a server-side request forgery. vpnw refuses it before any connection is made.

On most clouds, 169.254.169.254 answers any program on the machine with the instance’s credentials. An agent talked into fetching that address, by a crafted link or an instruction hidden in a page, can hand over the keys to the cloud account. The case was recorded with VPN Works 0.2.0’s demo kit; the screenshot is from that recording, and the behavior is the same in 0.4.0.

Coding Agent Case Study: Deploy Token Blocked by a Policy Drafted From One Traced Run

Tue, 29 Sep 2026 00:00:00 +0000

A coding agent gets a task file with a hidden instruction to send its deploy token to an attacker. One traced run, a policy drafted from it and read by a person, and the token goes nowhere.

This was the first case study, recorded with VPN Works 0.2.0’s demo kit: a stand-in coding agent on Linux, a task whose file hides the instruction, and stand-in servers in a private network. The screenshot below is from that recording. The same steps work the same way in 0.4.0, where tracing and learning are done by the Trace and Learn plugins.

How It Works

Tue, 29 Sep 2026 00:00:00 +0000

vpnw, the kernel of VPN Works, runs a program in a sealed sandbox, takes every connection it makes, decides it with a policy, sends it down a path and writes it down. Four commands cover the cycle: trace, learn, guard and run.

Each of the four is the same machinery with a different setting. trace lets everything through and prints it. learn reads a trace and drafts a policy. guard enforces a policy. run just sends the program down a path, quietly.

Introduction

Tue, 29 Sep 2026 00:00:00 +0000

VPN Works is the VPN, rebuilt as an operating system. Its kernel, vpnw, gives each program its own network: one way out, a policy you can read, a path you choose, and a record of every connection. Plugins are its apps.

AI agents, scrapers and build jobs run on their own now, usually with all the network access the machine has. That’s a lot of trust for a program that follows instructions it finds in text. A README or an issue only has to carry the right sentence, and an agent holding a token can be talked into sending it out. Models can’t reliably tell data from instructions, so the practical defense has to sit outside the model.

Next Uses: Seven Places Where a Network per Program Could Fit

Tue, 29 Sep 2026 00:00:00 +0000

AI coding agents were the first use for a network per program. Seven more could use the same core and plugins, and none of them has been tried yet.

Each of these needs the same few things: one program sealed in, a path chosen for it, a policy, a record. What differs is which plugin would carry the use-specific part, and that’s the point of the platform: the core stays the same.

Office Route Case Study: Ticket Filed Through the Office Exit, With the Deploy Token Still Blocked

Tue, 29 Sep 2026 00:00:00 +0000

An agent needs the office’s internal ticket tracker, so its traffic has to go through the office. vpnw sends that one program through the office route, and the policy still holds: the deploy token stays blocked.

The case was recorded with VPN Works 0.2.0’s demo kit, where the office route was a SOCKS5 proxy inside the office network that knew internal names like tracker.office.internal. The screenshot is from that recording. In 0.4.0 the office route can also be the office’s WireGuard server, which vpnw runs a tunnel to by itself.

Sealed Sandbox Case Study: A Script That Ignores Proxy Settings Tries Three Ways Out and Finds None

Tue, 29 Sep 2026 00:00:00 +0000

A script that ignores proxy settings tries three ways out with a stolen deploy token: HTTPS by name with the proxy switched off, a direct connection to the attacker’s address, and a local service on a Unix socket that connects for whoever asks. Inside vpnw’s sealed sandbox none of them works.

The case was recorded with VPN Works 0.2.0’s demo kit; the screenshot is from that recording. The sandbox is the same code in 0.4.0, and its tests now try 16 ways out, not three.

About

Mon, 01 Jan 0001 00:00:00 +0000

VPN Works is the VPN, rebuilt as an operating system. Its kernel, vpnw, gives each program its own network: its own way out, its own rules and its own record. Plugins are its apps. All of it is open source.

Why It Exists

Programs that act on their own are everywhere now. AI coding agents run commands and call APIs. Scrapers, build jobs and CI steps pull code and data from all over. Most of them get all the network access the machine has, which is a lot of trust for a program that follows instructions it finds in text. A README or an issue only has to carry the right sentence, and an agent holding a token can be talked into sending it out.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

The project would like to hear from:

Teams running AI agents, scrapers or build jobs that need narrow, recorded network access, on laptops, in CI or on servers.
People who’d like to write a plugin, or have one in mind that the SDK can’t support yet.
Anyone using WireGuard with vpnw whose provider’s config doesn’t load, or whose tunnel misbehaves.
Anyone with a question about the core, the plugins or the figures on this site.

Write to info@vpnw.com.

Download

Mon, 01 Jan 0001 00:00:00 +0000

VPN Works comes ready-built for Linux and macOS: one program, vpnw, with its built-in plugins inside it. The license files and the README come with it.

System	Download
Linux, x86-64	vpnw_linux_amd64.tar.gz
Linux, ARM64	vpnw_linux_arm64.tar.gz
macOS, Apple silicon	vpnw_darwin_arm64.tar.gz
macOS, Intel	vpnw_darwin_amd64.tar.gz
Checksums	SHA256SUMS

These links always point to the newest release, now 0.4.0. Past releases and their notes are on the releases page.

Install

On Linux:

curl -LO https://github.com/VPNWorks/vpnw/releases/latest/download/vpnw_linux_amd64.tar.gz
curl -LO https://github.com/VPNWorks/vpnw/releases/latest/download/SHA256SUMS
sha256sum --ignore-missing -c SHA256SUMS
tar -xzf vpnw_linux_amd64.tar.gz ./vpnw
./vpnw doctor

The Linux binaries are static, so they run on any distribution with nothing else installed. vpnw doctor checks whether this machine can run sealed programs and starts the plugin host to make sure it works.

Exit

Mon, 01 Jan 0001 00:00:00 +0000

Exit is the server end of a path: vpnw exit, on a machine with fixed addresses. Each client leaves from an address of its own, and every request is decided again at the exit with that client’s own policy, by the same code that decided it on the client’s machine.

Partners and internal systems often let traffic in by address, so agents and CI jobs need fixed addresses to leave from. A plain proxy with a fixed address trusts whatever reaches it with the right password, so a hijacked client, or anyone holding its token, can push anything through it. An exit checks every request again, with that client’s own policy.

Lab

Mon, 01 Jan 0001 00:00:00 +0000

Lab is the fault kit every tunnel in VPN Works must pass before it ships. It breaks the path on purpose, in the project’s tests, and checks four things each time: the program hears about the fault, nothing goes around the tunnel, every connection ends up in the record with an outcome, and vpnw never hangs.

Lab came back in 0.6.0, for the WireGuard path. It isn’t a feature you run. It lives in the test suite, runs on every push, and its results are recorded with the rest of the figures on this site.

Ledger

Mon, 01 Jan 0001 00:00:00 +0000

Ledger keeps a record of a run that can’t be changed without it showing. It’s a built-in plugin in VPN Works since 0.5.0: an Observer that seals every event as it happens, and an Advisor that checks the record and names the line anyone changed.

After an incident or in an audit, “where did this program send data?” needs an answer people believe. An ordinary log can be edited by anyone who can reach it, and a careful edit leaves no mark. Ledger makes every edit leave one.

Plugins

Mon, 01 Jan 0001 00:00:00 +0000

Plugins are the apps of VPN Works. The kernel, vpnw, seals, decides, carries and records. Everything else comes as a plugin: a small WebAssembly module that vpnw runs in a sandbox, with no files, no network and no environment, reaching the kernel only through the calls its manifest asks for.

That holds for the plugins that ship with vpnw too. The console is a plugin. Policy drafting is a plugin. They run in the same sandbox and use the same interface as a plugin you write yourself, with no extra calls.

Quick Start

Mon, 01 Jan 0001 00:00:00 +0000

Five minutes from download to a program running on VPN Works under its own policy. This uses Linux, where vpnw can seal a program in. On a Mac the same commands work for programs that honor proxy settings.

1. Install

curl -LO https://github.com/VPNWorks/vpnw/releases/latest/download/vpnw_linux_amd64.tar.gz
tar -xzf vpnw_linux_amd64.tar.gz ./vpnw
sudo mv vpnw /usr/local/bin/
vpnw doctor

vpnw doctor says whether this machine can run sealed programs. Most distributions can. On Ubuntu 23.10 and later, AppArmor stops unprivileged user namespaces; doctor says so, and you can run vpnw with sudo or allow them. Other systems and checksums are on the download page.

Reference

Mon, 01 Jan 0001 00:00:00 +0000

Every command, option, file, rule and event in vpnw 0.8.0. The same reference ships with the code as docs/reference.md; plugin authors want docs/plugins.md.

Commands

Command	What it does
`vpnw run [options] -- CMD [ARGS]`	runs a program through a chosen path
`vpnw trace [options] -- CMD [ARGS]`	the same, printing every connection
`vpnw guard [options] -- CMD [ARGS]`	the same, under a policy, enforced
`vpnw learn [--from last\|FILE] [--name NAME] [--ports] [--wildcards] [-o FILE]`	drafts a policy from traces, with the built-in Learn plugin
`vpnw advise PLUGIN [--from FILE] [--set KEY=VALUE] [-o FILE]`	runs an Advisor plugin on traces
`vpnw verify LEDGER [TRACE]... [--head HASH]`	checks a ledger written by the Ledger plugin; with no trace given it also reads `last`. Exit 0 intact, 1 changed or cut short
`vpnw exit serve\|check\|token\|cert`	runs an exit, the server end of a path, and makes what it needs; see Exit below
`vpnw plugin list\|info\|add\|remove\|keygen\|sign\|trust\|keys`	manages plugins
`vpnw doctor`	checks what this machine supports
`vpnw version`

Options for run, trace and guard

Option	Meaning
`--policy FILE`	a file with a `[policy]` table, and optionally paths
`--config FILE`	a file with `[network]` and `[paths.NAME]` tables
`--via NAME`	a named path from `--config` or `--policy`
`--direct`	connect from this machine (the default)
`--wireguard FILE`	through a WireGuard tunnel, from a wg-quick file; vpnw runs the tunnel itself
`--tunnel NAME`	through WireGuard tunnels whose configs come from Tunnel plugin NAME, as the built-in `rotate`; see Tunnel Plugins below
`--proxy URL`	`socks5://`, `socks5h://`, `http://`, `https://` or `socks5+tls://`; given more than once, a list of exits with failover
`--ca FILE`, `--token-file FILE`	for proxies over TLS
`--dns MODE`	`local` or `remote` for `--proxy`; `tunnel` or `local` for `--wireguard` and `--tunnel`
`--allow RULE`, `--deny RULE`	rules on the command line
`--deny-private`	deny loopback, private and link-local addresses, cloud metadata included
`--default allow\|deny`	when no rule matches
`--plugin NAME`	an Observer or Guard plugin alongside the run
`--set NAME.KEY=VALUE`	a setting for a plugin, as `--set ledger.every=50`
`--plugin-file NAME=PATH`	the file vpnw creates for a plugin that asks for one (`file.write`); it must not exist yet
`--plugin-folder NAME=PATH`	the folder a plugin that asks for one reads (`folder.read`); by default `~/.config/vpnw/NAME`
`--out FILE`, `--json`	events to a file, or JSON on the console
`-v`, `-q`, `--no-save`	more, less, and don’t keep this trace as `last`
`--backend sealed\|env`	sealed (Linux, enforced) or env (proxy settings only)
`--allow-unix-sockets`	let a sealed program use Unix sockets
`--no-deny-exit`	keep the program’s exit code when something was denied

A policy or a Guard plugin needs the sealed backend: the env backend only sets proxy variables, so it can’t stop a program that ignores them.

Roadmap

Mon, 01 Jan 0001 00:00:00 +0000

VPN Works is the VPN, rebuilt as an operating system: a kernel, drivers for each way out, and plugins as apps. Seven releases are out. What comes next is in the order it’s planned, without dates: each release ships when its tests pass, and not before.

Scope

Mon, 01 Jan 0001 00:00:00 +0000

Scope learns least-privilege rules for a company VPN from its own traffic. In the platform it becomes an Advisor plugin for gateway mode, which is on the roadmap but not in 0.4.0.

Many company VPNs are still flat. Once a login is accepted, its owner can reach every internal system on every port, and so can anyone who stole that login. Scope reads the connections through the VPN gateway, learns who uses which systems, and drafts rules that give each person and each team just that. Before anything is enforced it replays recent traffic against the draft and shows what would have been blocked.

See It Run

Mon, 01 Jan 0001 00:00:00 +0000

Two minutes on your own Linux machine shows more than a replay in a browser could. The browser demos that used to live here replayed recordings from the old separate engines. When VPN Works became one core with plugins, they went, and this is what replaced them: a few commands you can run yourself.

The Platform

Mon, 01 Jan 0001 00:00:00 +0000

VPN Works is the VPN, rebuilt as an operating system. A VPN decides how traffic leaves a machine. VPN Works makes that decision per program, and builds it the way an OS is built: a small kernel that does the work no plugin may do, drivers for each way out, a system-call interface, and apps that add everything else without touching the kernel.

It’s an OS for network paths, and you don’t boot it. It’s one program, vpnw, that runs on Linux or macOS without root. The current release is 0.8.0, out on October 14, 2026, open source under Apache 2.0 at github.com/VPNWorks/vpnw.