VPN profiles

Every VPN profile runs in its own container when started. Your computer's routing and DNS don't change; only the connections you open through quickssh enter the VPN.

Supported types

Type	`--kind`	What you need
FortiGate	`fortigate`	Gateway address, user, password; optionally a realm and a certificate fingerprint
Cisco AnyConnect	`anyconnect`	Gateway address, user, password
GlobalProtect	`globalprotect`	Gateway address, user, password
Pulse / Ivanti	`pulse`	Gateway address, user, password
OpenVPN	`openvpn`	An `.ovpn` file; user and password if the file asks for them
WireGuard	`wireguard`	A `.conf` file

The content of the configuration file is copied into the profile and stored encrypted together with the other records.

Starting and stopping

quickssh up acme            # start
quickssh up acme --otp 123456
quickssh down acme          # stop
quickssh restart acme
quickssh logs acme -f       # container log

The Start / Stop and Logs buttons at the top of the VPN page do the same. The logs open in a separate window.

Stopping when idle and waking up

A VPN that carries no connection for a while stops by itself. The default is 5 minutes; change it in the profile's Stop when idle field or on the command line:

quickssh edit acme --idle-minutes 15   # 15 minutes
quickssh edit acme --idle-minutes 0    # never stop
quickssh edit acme --default-idle      # the server's default

A stopped VPN sleeps: it starts again the moment a new connection reaches its jump host or proxy port. An open terminal or a connected tool counts as use.

Note: VPNs that ask for a password or a 2FA code on every start are not stopped automatically and cannot be woken up; you start them by hand.

External access: SSH tunnel and proxy

The External access card on the VPN page gives you two ways to reach the VPN from your own tools:

SSH tunnel: entered as an "SSH tunnel" in tools like DataGrip. Host, port, user and password are ready to copy on the card.
SOCKS5 proxy: for tools like browsers. The address looks like socks5h://127.0.0.1:<port>; the h makes names resolve inside the VPN too.

quickssh tunnel acme          # prints the details
quickssh tunnel acme --close  # closes the access opened for you on a central server

On a central server these ports are opened for you alone and only accept connections from your current IP address.

Fixed forwards

You can define fixed forwards in the profile as LOCAL_PORT:HOST:PORT; when the VPN starts, the local port connects to the target.

quickssh edit acme -L 15001:10.20.0.9:8080

Parent VPN

If a VPN's gateway can only be reached through another VPN, choose a parent VPN in the profile (--via). The chain is built in order when starting.

Editing and deleting

quickssh show acme
quickssh edit acme --host new.acme.com --rename acme-new
quickssh rm acme-new

The VPN must be stopped to rename it. You can't delete a VPN while sessions connect through it; the command tells you which ones use it.