A VPN per host

Many servers are only reachable through a VPN. In MorphGate you attach a VPN profile to a host, and the VPN comes up when you connect to that host. It runs inside the app, only for the hosts that use it.

Nothing on your system changes

Each VPN runs inside MorphGate with its own network stack. There is no network interface, no change to your routes and nothing that needs administrator rights. The rest of your computer keeps using your normal network.

Because each VPN is separate, several can be up at the same time, even when two clients use the same private address range (for example two networks that are both 10.0.0.0/24).

Supported VPNs

WireGuard
Built in. Import a WireGuard configuration in wg-quick format (a .conf file, or paste it). PostUp and PostDown scripts are ignored. The private key is stored only in your encrypted vault. The VPN's page shows Your key, the public key to give the VPN's admin.
OpenVPN
Built in. Import the .ovpn profile your VPN admin gave you, or paste it. Files the profile refers to (ca, cert, key, tls-auth and so on) are read from its folder and embedded in the vault. Scripts and route settings are ignored. For profiles that sign in with a username and password (auth-user-pass), you can save both, or be asked when connecting. One-time codes are always asked when connecting.
OpenConnect
For Cisco AnyConnect and ocserv, Palo Alto GlobalProtect, Fortinet FortiGate, Pulse and Ivanti Connect Secure, F5 BIG-IP, Juniper Network Connect and Array Networks servers. MorphGate uses the openconnect program for the VPN protocol and keeps the traffic inside the app. Install openconnect first (see Install and update). Not available on Windows yet.

Add a VPN

  1. Choose New VPN next to VPNs in the sidebar.
  2. Pick WireGuard, OpenVPN or OpenConnect, and give it a Name.
  3. For WireGuard and OpenVPN, choose From .conf file or From .ovpn file and enter the path, or paste the configuration.
  4. For OpenConnect, enter the Server, pick the Protocol, and optionally a Group. Leave the group empty to be asked when connecting.
  5. For OpenVPN and OpenConnect, enter a Username and Password, or leave them empty to type them, and any one-time code, when connecting.
  6. Choose Save.

Then open a host's editor and pick the VPN under VPN. A group can set a VPN for all its hosts.

Connecting

  • The VPN comes up when a session, file browser or tunnel needs it, and stops when the last connection using it closes. Hosts that share a VPN share one tunnel.
  • If the VPN needs a password, a one-time code or a group, MorphGate asks in a dialog.
  • For OpenConnect, if the server's certificate isn't trusted by your computer, MorphGate shows Untrusted VPN server with its fingerprint. Compare it with the one your VPN admin gave you, then choose Trust and connect. MorphGate remembers it for this VPN. To forget it, open the VPN and choose Forget next to the pinned certificate.
  • Test on a saved VPN's page connects once and shows the address you got and how long it took.

The VPN's page shows its status (Idle: starts when a host needs it, or Connected as an address) and which hosts use it. The sidebar shows a VPN as connected while it is up.

VPNs and jump hosts

A VPN carries the first hop of a connection. If a host uses a jump host, it uses the jump host's VPN, not its own. See Jump hosts.

Locking

Locking the vault, by hand or when idle, closes every VPN along with terminals, file browsers and tunnels.

Not supported yet

  • OpenVPN tls-crypt-v2, PKCS#12 files and encrypted private keys.
  • Web (SAML) sign-in for OpenVPN and OpenConnect.
  • WireGuard configurations with more than one peer.
  • OpenConnect on Windows.