Three protocols
WireGuard, OpenVPN and IPsec/IKEv2: keys, certificates, collision-free addresses and configuration files generated by the console.
VPN (modulo)
An optional module to manage VPN access to the machine ToutWAF runs on: WireGuard, OpenVPN and IPsec servers, their clients, ready-to-use files. Off by default and experimental: not yet proven in production.
Where to find it in the console : Administration menu: Settings, Modules tab; the VPN section appears in the menu only when the module is on.
Read this first
This module is experimental, not yet proven in production. We prefer to say so before describing anything.
- Off by default: an installation that never switches it on behaves exactly as before. Nothing is changed on the machine, no section appears in the menu.
- Not yet proven on a real server: generating and storing the configuration is covered by tests, but putting it on the machine (writing the files, starting the tunnel) is covered only by tests that use a memory file system and a fake command runner. The module has never started a tunnel on a real server.
- Keep a second way into the machine during your tests (console on another path, SSH, your host's console) and start with a test machine.
What it is for
Ready-to-use client files
One file per client, returned once when it is created; for WireGuard, also the QR code text for the mobile app.
Do not cut yourself off
Before applying, a plan lists what would be written and started, with checks. A tunnel network that contains the address you are connected from is refused.
Nothing switches on by surprise
One switch in Settings > Modules, reserved to platform administrators, recorded in the audit log.
What the module can do
Each point is described in the product documentation; none has been tried on a real server.
Servers and clients
Create a server (protocol, public host name, port, network), add clients, pause them, rotate their key or revoke them.
Outgoing connections
Link this machine, as a client, to an existing VPN (WireGuard, OpenVPN). It never replaces the default route unless explicitly asked, so the console stays reachable.
Putting it on the machine
A plan you read, then “Apply” writes the files and starts the unit, through a dedicated root helper that validates the request again. A risky change stays on trial for 60 seconds and rolls back without your confirmation.
An allow-list for root
The helper accepts only directives it knows: a configuration that contains anything else is refused, whoever generated it.
State of the tunnels
A read-only page shows the peers, the last handshake and the traffic; if the helper is not available, it says so instead of failing silently.
Sealed secrets
Keys, certificates and passwords are sealed with the master key and never appear in a list or in the audit log.
What exists
Generating and keeping the configuration, and guided deployment on a Linux machine.
- WireGuard, OpenVPN and IPsec/IKEv2: servers, clients and files.
- Outgoing WireGuard and OpenVPN connections.
- Plan, apply, stop and confirm, with guards against cutting the console.
- The Operator role cannot write: only Owner and Administrator change the module.
What does not exist
Said plainly.
- L2TP/IPsec and SSL VPN are in the list, marked “coming soon”: they are not implemented.
- The VPN neither adds nor checks any firewall rule, nor forwarding or address translation for the clients: open the server's port yourself and, if the Firewall module is on, allow it there too.
- No IPsec client mode, no outgoing tunnel for a machine with no reachable address, no download of the server files from the console.
What remains to be proven
We prefer to say it plainly.
- No tunnel has been started on a real server; the real behaviour of the deployment, of the automatic return and of the revocation-list renewal has not been checked outside tests.
- On Windows nothing is deployed: putting it on the machine is for Linux with systemd only.
- The revocation list of an OpenVPN server is valid for one year; ToutWAF renews it before it expires, but that renewal has not been seen on a real server either.
- The module does not promise to replace your current VPN. Try it first on a test machine.
Use cases
Prepare a team's access
You create a WireGuard server and each person's files, then read the plan before applying it on a test machine.
Link the machine to an existing VPN
An outgoing connection, without changing the default route, so the console stays reachable.
Try it safely
You apply a visible change, confirm or let the automatic return act, then decide.
What is included, by edition
In this version the module is not tied to a licence; that may change.
EdizioneGratuito Incluso in tutte le offerte, comprese le due gratuite (Free e Free +)Pro e superiori Offerte a pagamento: visibile nella console, bloccata senza licenza. Da Pro, salvo indicazione Agency o Enterprise
- VPN: WireGuard, OpenVPN and IPsec/IKEv2 servers with their clients; the configuration is generated and kept, then put on the machine on request with a plan, a guard and a 60-second trial (not yet proven in production: no tunnel has been started on a real server)Gratuito
- Outgoing connections from this machine to an existing VPN (WireGuard, OpenVPN), without replacing the default route unless explicitly asked (not yet proven in production)Gratuito
- One switch per module in Settings > Modules, reserved to platform administrators; switching a module off hides it and deletes nothingGratuito
Every function in this list carries the note “not yet proven in production”. The data plane, for its part, never consults the licence.
Metti oggi stesso uno scudo davanti alle tue applicazioni
Installalo sul tuo server, oppure scrivici per parlare di licenze.