VPN Management

VPN Management

Pentest Copilot manages OpenVPN on the workspace's selected local or SSH work host. Open VPN from a session sidebar.

Requirements

• The workspace Connection test must pass.
• The work host needs OpenVPN and /dev/net/tun.
• Local Docker VPN use needs NET_ADMIN; the bundled Compose configuration provides it. Rootless Docker cannot provide the built-in Kali VPN path.

Uploading a profile bundle

1. Click Add VPN Profile.
2. Select one .ovpn or .conf file.
3. Select every file it references, such as .crt, .key, .pem, .p12, or an auth-user-pass credentials file. Up to 15 supporting files are accepted.
4. Save the bundle.

The primary profile and its assets are stored with restrictive permissions and copied together when connecting. Duplicate filenames and unsafe upload names are rejected.

An auth-user-pass directive without a credentials filename requires an interactive prompt and is rejected. Add the credentials file to the bundle or connect manually on the work host.

Connecting

Click Connect beside a saved profile. Pentest Copilot:

1. Resolves and verifies the workspace work host.
2. Creates an isolated /tmp/vpn-<profile>/ directory.
3. Transfers the profile and every supporting asset.
4. Starts OpenVPN with that directory as its working directory.
5. Writes a profile-specific log and PID file and waits for a tunnel interface.

Relative certificate and key paths therefore continue to resolve as they do in the original bundle.

Status and disconnect safety

An active connection shows its profile, PID, tunnel interface, and assigned IP. You can disconnect one profile or all profiles started by Pentest Copilot.

Disconnect does not use a broad pkill openvpn. It verifies both the managed PID file and process command before sending a signal. Unrelated OpenVPN processes on the same work host are left alone. Stale PID files are cleaned without killing an unrelated process.

Network placement

The VPN affects the network namespace of the selected work host. Commands run on that host use the tunnel. The browser agent is different: it runs beside the backend. A VPN connected on an external SSH host does not automatically route browser-agent traffic. Connect the VPN beside the backend or configure a proxy that the backend can reach.

Troubleshooting

• OpenVPN or TUN missing: install OpenVPN and ensure /dev/net/tun exists.
• Permission denied: use a work host with root or passwordless sudo access appropriate for OpenVPN.
• Referenced file not found: upload the complete bundle with the exact filenames used by the profile.
• Interactive credentials error: change auth-user-pass to reference a bundled credentials file.
• Connect succeeds but targets do not resolve: verify routes and DNS from the workspace terminal; tool-specific IPv6 support still varies.