Important
Disclosure: this project was created with the help of AI. I use this for myself in production and it might help you as well. I needed an alternative to a big OpnSense box because all I want to do is to inter-connect Wireguard and IPSec tunnels.
vpnplane is a simple, file-based VPN manager for Ubuntu servers.
You define tunnels and routes in YAML, then run one command to apply everything.
It is intended to run on a small virtual server with Ubuntu 24.04 or newer hence it (currently) needs root-permissions to work. Migrating to Docker is on my road map. Do not run anything else on the VM to avoid potential network conflicts. It's okay to have ufw allowing SSH.
My home and lab setup grew over time: multiple FritzBox locations, a few OPNsense firewalls, and roadwarrior clients (smartphone, laptop, tablet) that need secure access while traveling.
I wanted one repeatable workflow instead of hand-editing firewall and tunnel configs on each box. vpnplane is that workflow: keep everything in config files, validate, apply, and re-apply safely whenever something changes.
- Manages WireGuard and IPSec tunnels
- Manages explicit route/firewall rules between networks
- Supports roadwarrior internet egress through the host with automatic NAT (IPv4 and IPv6)
- Keeps setup idempotent (safe to run apply again)
- Supports interactive commands for tunnels and routes
- Ubuntu 22.04 or 24.04
- Python 3.11+
sudo apt install -y wireguard wireguard-tools iptables nftables iproute2 python3 python3-pip
# Optional for IPSec:
sudo apt install -y strongswan strongswan-swanctlQuick install:
curl -fsSL https://raw.githubusercontent.com/Kandru/vpnplane/main/install.sh | sudo bashManual install:
git clone https://github.com/Kandru/vpnplane.git
cd vpnplane
sudo bash install.sh- Initialize settings:
sudo vpnplane init- Add tunnels:
sudo vpnplane tunnel add- Add routes:
sudo vpnplane route add- Validate config:
vpnplane check- Apply config:
sudo vpnplane apply- Check status:
sudo vpnplane statussudo bash /opt/vpnplane/install.shAfter updating, validate and apply again:
vpnplane check
sudo vpnplane applysudo bash /opt/vpnplane/uninstall.shThis removes the installed vpnplane files from the target system.
I've encountered unexpected behavior with the Fritz!Box WireGuard implementation that differs from OPNsense. To establish a site to site VPN you need to set the WireGuard tunnel interface to the same IP address as the Fritz!Box's primary interface. For example, if your Fritz!Box uses 192.168.178.1/24, the WireGuard tunnel must use this address as well. Without this configuration, the Fritz!Box will apply Network Address Translation (NAT) behavior.
GPL-3.0 - see LICENSE