fennec ships the programs for every kind of connection itself and needs neither Homebrew nor packages of the system. This page describes how fennec runs each kind on macOS, Windows and Linux.
Tunnels of different kinds run side by side. Every kind has a form of its own in the app, with all the fields its program knows.
Import from .conf files and QR codes. fennec creates new key pairs itself; the private key stays with the service.
Import from .ovpn files, with user name and password, one-time codes and the static challenge of OpenVPN.
For Cisco AnyConnect, Palo Alto GlobalProtect, Juniper/Pulse and Fortinet. fennec opens a sign-in through SAML or SSO in the browser.
With EAP through user name and password, or with a certificate. fennec hands the password to strongSwan only for the sign-in and never writes it to a file.
In this release IKEv2 is available on Linux.
fennec changes DNS and routes only as far as an active tunnel needs, and removes everything again when it disconnects.
Names under the domains of a tunnel are resolved by its own DNS server. macOS uses /etc/resolver for this, Windows NRPT rules and Linux systemd-resolved.
Configurations with 0.0.0.0/0, for example from Mullvad or Proton, work. While a full tunnel runs, the system uses its DNS; if the tunnel has no IPv6, fennec blocks IPv6 for that time.
Switched on per tunnel. When the tunnel fails, no traffic for its ranges goes around it until it is connected again or you disconnect it.
In this release the kill switch is available on Windows and Linux.
fennec does not rebuild these overlay networks. It detects their installed clients, offers to add them, and then switches and shows them like a tunnel. Their address ranges, such as 100.64.0.0/10 for Tailscale, are part of the overlap check.
All programs are part of the app package. They are built from the official sources, checked against a signature or a published checksum. fennec starts them as processes of their own and does not link them.
fennec