How to set up fennec, how several tunnels run side by side, how to enter your licence and how to remove fennec again.
At the first start the setup opens. It sets up the service, for which the system asks for your password once, takes over existing WireGuard and OpenVPN configurations and asks for permission to send notifications.
You add further tunnels under Import / New: from files you drag onto the window, from a WireGuard QR code or through the form of the kind of connection.
The way Apple intends for VPN apps, the Network Extension, allows only one tunnel at a time; when a second one starts, the first one stops. fennec therefore uses a service of its own that creates a utun interface of its own for every tunnel.
VPN apps that use the Network Extension, such as company clients, keep running next to it. fennec shows their address ranges in the route view.
Yes. The service holds the tunnels independently of the window, also when the app crashes. Through the menu bar on macOS or the tray on Windows and Linux you switch tunnels without opening the window.
Reconnecting after a drop and restoring tunnels after a restart or on wake belong to the automation of Pro. In Free, tunnels stay disconnected after a restart until you switch them on again.
When a tunnel takes addresses that an active tunnel already takes, fennec starts it only after you confirm and names the tunnels concerned. You can set the confirmation permanently per tunnel.
This protection also applies in Free. The route view with “Check address” belongs to Pro.
fennec supports user name and password, one-time codes and the static challenge of OpenVPN. Sign-ins through SAML or SSO, for example with GlobalProtect, AnyConnect or Pulse, open in the browser, and fennec passes the result to the service.
When a tunnel needs input while you are away, for example after a restart, the service does not retry blindly. The tunnel then shows “Sign-in needed”, and a click on the notification opens the sign-in.
The fennec command talks to the service and needs no sudo: fennec list, fennec status, fennec up and fennec down, fennec stats, fennec logs, fennec route with an address and fennec import with a file.
fennec mcp starts an MCP server over stdio. AI tools use it to query and switch the tunnels, with the same functions as the command line. In Free the command line only shows the status.
Besides your remote sites and the probe targets of the health check, fennec only talks to the licence service of m8werk digital solutions UG. It asks there for updates and loads the list of revoked licences once a day.
When it asks for updates, fennec sends its version, the system, the processor and the kind of installation. Nothing about your tunnels leaves the computer that way.
You find the key in the email of your purchase and in your customer account at the licence service. You enter it in the settings under Licence; fennec checks it on the computer itself.
On a computer you no longer use, you remove the key at the same place with “Remove licence”. fennec switches back to Free there.
Your version keeps running with all Pro features, without expiry. Newer versions come with a renewal of the updates, which you reach in the app under Settings › Licence with “Renew updates”.
For every release there is a source package per platform next to the download, with the complete source code of the bundled programs in the shipped version and the build scripts. The links are on the Connections page. The app shows the licence texts in the settings under Component licences.
In the settings under Service, choose “Remove service”. fennec disconnects all tunnels and removes interfaces, routes and DNS entries; the keys stay unless you remove them as well. The system asks for your password for this. Afterwards you delete the app.
On Windows, uninstalling in the system settings also removes the service, the adapters and the DNS rules.
fennec