vopono is a tool to run applications through VPN tunnels via temporary network namespaces. This allows you to run only a handful of applications through different VPNs simultaneously, whilst keeping your main connection as normal.
vopono includes built-in killswitches for both Wireguard and OpenVPN.
This is alpha software, currently only Mullvad, TigerVPN and
PrivateInternetAccess are supported, with custom configuration files
also supported with the --custom argument.
Mullvad users can use am.i.mullvad.net to check the security of their browser's connection. This was used with the Mullvad configuration to verify that there is no DNS leaking or BitTorrent leaking for both the OpenVPN and Wireguard configurations.
Mullvad port forwarding works for both Wireguard and OpenVPN. You will need to enable the ports in your Mullvad account.
At the moment, both iptables and nftables are required.
Screenshot showing an example with firefox, google-chrome-stable and lynx all running through different VPN connections:
| Provider | OpenVPN support | Wireguard support | |-----------------------|-----------------|-------------------| | Mullvad | ✅ | ✅ | | PrivateInternetAccess | ✅ | ❌ | | TigerVPN | ✅ | ❌ |
Applications will be run as the current user by default (you can use
vopono exec sudo -u USERNAME program as the command to run as another user).
vopono will call sudo if required, it is recommended to run as the current user and let vopono call sudo so that the configuration directories are correctly inferred and the final command is not run as root.
Note that child processes of the application will also be spawned inside the network namespace and so use the same VPN connection, so you can run entire shell sessions inside vopono.
Install vopono and use vopono sync to
create the Wireguard configuration files (and generate a keypair if
necessary):
bash
$ yay -S vopono-git
$ vopono sync
Run vopono:
bash
$ vopono exec --provider mullvad --server se --protocol wireguard "transmission-gtk"
The server prefix will be searched against available servers (and country names) and a random one will be chosen (and reported in the terminal).
Note you can set a custom port in the Wireguard configuration by running
vopono sync with the --port argument:
bash
$ vopono sync --protocol wireguard --port 31337
Valid ports for Mullvad Wireguard are: 53, 4000-33433, 33565-51820 and 52000-60000.
Install vopono and use vopono sync to
create the OpenVPN configuration files and server lists.
bash
$ yay -S vopono-git
$ vopono sync
Run vopono:
bash
$ vopono exec --provider privateinternetaccess --server poland "curl ifconfig.co/country"
Poland
You can also launch graphical applications like firefox,
transmission-gtk, etc. - the network namespace will be cleaned up when
the application is terminated. Note you may need to run them as your own
user:
bash
$ vopono exec --provider privateinternetaccess --server mexico "firefox"
The server prefix will be searched against available servers (both
server names and aliases in the provider's serverlist.csv) and a
random one will be chosen (and reported in the terminal).
Place your username and password in
~/.config/vopono/pia/openvpn/auth.txt - the username on the first
line, and the password on the second (with a newline). Otherwise you
will be prompted for your credentials.
For PrivateInternetAccess these should be the same as your account credentials.
For TigerVPN you can view your OpenVPN credentials online on the "geeks" dashboard. The OpenVPN credentials are not the same as your TigerVPN account credentials.
For Mullvad your OpenVPN credentials are your account code as your username, and m as the password.
By default vopono uses the UDP configuration of the VPN providers.
You can use the TCP configurations by running vopono sync with the
--port argument where the port is a valid TCP port for this provider:
bash
$ vopono sync --protocol openvpn --port 443 mullvad
For Mullvad, valid ports are: 1300, 1301, 1302, 1194, 1195, 1196, 1197, or 53 for UDP, and 80 or 443 for TCP,
For PrivateInternetAccess valid ports are 1198 for UDP and 502 for TCP.
For TigerVPN valid ports are 1194 for UDP or 443 for TCP.
If you use another commercial VPN provider, please open a Pull Request here with the necessary configuration and serverlist.
For private VPN connections, you can use a custom provider, by passing the complete configuration file to vopono (i.e. an OpenVPN .ovpn config file or a Wireguard wg-quick .conf file).
bash
$ vopono -v exec --custom ~/custom_wireguard.conf --protocol wireguard "firefox"
bash
$ vopono -v exec --custom ./custom_openvpn.ovpn --protocol openvpn "firefox"
Note that in the OpenVPN case the command must be executed in the same directory as any accompanying files (CA certificates, authentication files, etc.) and the user authentication must be by file (OpenVPN will fail to request user and password otherwise, due to being launched in the background).
The vopono list command lists running applications and namespaces, as
a tab separated table:
```bash $ vopono list namespaces namespace provider protocol numapplications uptime voponotiguslosangeles TigerVpn OpenVpn 2 28s
$ vopono list applications namespace provider protocol application uptime voponotiguslosangeles TigerVpn OpenVpn firefox 36s voponotiguslosangeles TigerVpn OpenVpn lynx 15s ```
Note if running multiple Firefox sessions, they need to run separate profiles in order to force Firefox to run them as separate processes.
Trying to run Firefox normally when there is already an instance running will result in a silent error.
You should also disable DNS over HTTPS as this will send all DNS
requests to Cloudflare by default. Firefox Options > General >
Network settings > Settings, then deselect Enable DNS over HTTPS.
You may also wish to disable WebRTC - see Mullvad's guide for more details.
Similar issues apply to Chromium and Google Chrome.
Install the vopono-git package with your favourite AUR helper.
This will install the default configuration files to /usr/share/doc/vopono,
copy them to ~/.config/vopono manually if you want to configure vopono
prior to your first execution (i.e. to add Wireguard configuration files),
or run vopono init to have vopono copy them automatically.
bash
$ yay -S vopono-git
$ vopono init
Run the install script provided: install.sh - this will cargo
install the repository and copy over the configuration files to
~/.config/vopono/
Note the minimum supported Rust version is 1.43. You can check your version with:
bash
$ rustc --version
vopono is licensed under the GPL Version 3.0 (or above), see the LICENSE file or https://www.gnu.org/licenses/gpl-3.0.en.html
vopono is the pronunciation of the letters VPN in Esperanto.
Se vi ankaŭ parolas Esperanton, bonvolu serĉi min en la kanalo de Discord de Rust Programming Language Community.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, will be licensed under the GPLv3 (or above), without any additional terms or conditions.