Scope

Scope is the second engine of VPN Works. It works on the company VPN, which in many companies is still flat: once a login is accepted, its owner can reach every internal system on every port, and so can anyone who has stolen that login. Scope reads the connections that pass through the VPN gateway, learns who uses which systems, and drafts rules that give each person and each team just that. Before anything is enforced, it replays recent traffic against the draft and shows what would have been blocked. Then it writes the rules for the gateway’s own firewall.

VPN Works keeps network access narrow and on the record. The Agent gives each AI agent a network of its own. Scope gives each person on a company VPN only the systems they use.

Scope 0.1.0 is an Alpha: a working engine, tested on one Linux machine against made-up offices in private test networks. No real company VPN has run it yet.

Scope’s five steps. Record: every new connection through the VPN gateway, who to which address and port, with no content. Learn: a team rule for what every active member used on two days or more, personal rules for the rest, and single days go under review. Review: a person reads the draft, a plain text file, and decides what stays blocked. Replay: the week after, decided as if the draft had been in force. Enforce: nftables rules for the gateway, with a watch mode first that only counts what they would refuse.

Try It

The demo below is a made-up office of 30 people in five teams, with 12 internal systems and three weeks of generated traffic. Scope learns from the first two weeks, a person reviews the draft, the third week is replayed, and then someone logs in as Alice with a stolen password. The page runs Scope’s own Go code, compiled to WebAssembly, and nothing you do in it leaves your browser.

The demo has more room on its own: open it full screen.

What the Demo Shows

Step What happens
A flat VPN Every login reaches every system: 360 pairs of person and system, all open
Learn 20,232 connections in two weeks become 39 team rules, 11 personal rules and 3 destinations under review. The draft opens 168 of the 360 pairs, on the ports people used
Review Three one-off visits wait for a person’s decision: Jonas to the CRM, Quinn to the ERP and Zoe to payroll
Replay The week after: 10,387 connections, 10,375 allowed and 12 blocked. Farid started on the staging database, and Quinn went back to the ERP. Hana, new in sales, is covered by her team’s rules
A stolen login 144 attempts on every system. On the flat VPN all 144 get through, to all 12 systems. Under the draft, 8 get through, to the 6 systems Alice uses
The rules The nftables script for the gateway, its watch mode, and AllowedIPs lines for WireGuard clients

The stolen login case study walks through it step by step.

How It Works

  • Record. vpnw-scope record adds a small table to the gateway’s firewall that logs the first packet of every new connection from the VPN range, and writes one line per connection: the time, the protocol, who, and the address and port. It keeps no content. Connection-tracking logs work as input too.
  • Know who is who. A short people file maps VPN addresses, or WireGuard keys, to people and teams.
  • Learn. A destination becomes a team rule when every active member of the team used it on two days or more. What only some people used becomes a personal rule for each of them. Anything used on a single day goes under review and stays blocked until a person decides. Each rule carries its evidence: how many people, days and connections.
  • Replay. Scope decides another week’s connections as the gateway would under the draft, and lists what would have been blocked, by person and destination.
  • Enforce. Scope writes the draft as an nftables script for the gateway’s own Linux firewall, in a table of its own. Watch mode comes first: it counts what the rules would refuse and refuses nothing. WireGuard clients can also get AllowedIPs lines, which tidy their routes but enforce nothing; the gateway does that.

What Was Measured

Figure What it means
8 of 144 Attempts by the demo’s stolen login that still get through under the learned rules, reaching the 6 systems its owner uses
0 Disagreements between Scope’s replay and the real Linux kernel, over 45,809 connections in three tests on two offices, the larger with 2,000 people
28 of 28 Deliberately planted bugs caught by the tests
About 1 million Connections learned per second for a 2,000-person office, in 21 MB of memory
95.6% Share of statements the tests run, the browser build not counted

All figures come from one machine with two CPUs, Linux 6.18 on x86-64. Scope is written in Go with the standard library only, and its Linux program is 2.7 MB.

Limits

  • Real VPNs. No WireGuard or OpenVPN server has run with Scope yet. The rules sit on the gateway’s forwarding path, where both kinds of VPN send their traffic once it leaves the tunnel.
  • Knowing who is who. Someone has to keep the people file current. Readers for a VPN’s own user records come later.
  • Rare access. A job that runs once a quarter can be missing from two weeks of traffic. Watch mode, the review list and a longer window reduce that risk without removing it.
  • IPv4, TCP and UDP only in this version, and one gateway at a time.

What Comes Next

A pilot on a real company VPN gateway, then IPv6, readers for the VPN’s own records of who is who, an easier review of large drafts, learning again on a schedule, packages and an outside review. The roadmap has the plan for Scope and for the engines that come after it. Teams who run a VPN and would like to try Scope on a copy of their traffic are welcome to write.