VPN Up for OpenConnect — Secure CLI VPN Manager for macOS & Linux
VPN Up for OpenConnect
VPN Up is a secure, scriptable command-line VPN manager built on OpenConnect. It connects macOS and Linux machines to Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure, Juniper Network Connect, and ocserv gateways straight from the terminal — with named profiles, Duo 2FA, browser-based SSO, certificate pinning, secure secret storage, auto-reconnect, and shell completion.
It’s built for developers, consultants, DevOps engineers, and remote workers who would rather drive their VPN from the command line than a vendor GUI.
$ vpn-up start "Frankfurt VPN"
Starting the Frankfurt VPN on frankfurt.example.com using Cisco AnyConnect ...
Connecting with Two-Factor Authentication (2FA) from Duo (PUSH) ...
Connected to Frankfurt VPN
Install in one step
brew tap sorinipate/vpn-up
brew install vpn-up
See the installation guide for manual setup on macOS and Linux.
Why VPN Up?
- Connect to Cisco AnyConnect-compatible VPNs without the vendor GUI client
- Manage multiple VPN profiles, connect by name, and run compatible tunnels side by side (
vpn-up start "Work") - Duo 2FA from the command line — push, phone, SMS, or one-time passcode
- Browser-based SSO (Okta, Azure AD, Ping Identity) for gateways that force an external browser login
- Secrets in the macOS Keychain, Linux Secret Service, or an encrypted vault — never plaintext
- Auto-reconnect at login via launchd (macOS) or systemd (Linux)
- Scriptable: drop VPN startup into your dev, automation, and remote-support workflows
Documentation
- Installation — Homebrew and manual setup on macOS & Linux
- Usage — commands, profiles, status/stop/logs, login service, hooks
- SSO & Duo 2FA — browser-based SAML/SSO login with Okta, Azure AD, Ping
- Protocols — AnyConnect, GlobalProtect, Pulse Secure, Juniper
- Troubleshooting — common connection problems and fixes
Guides
- Cisco AnyConnect command-line alternative — connect to AnyConnect VPNs without the GUI client
- Connect to GlobalProtect from the command line — Palo Alto GlobalProtect via OpenConnect
- Auto-connect a VPN at login — launchd (macOS) & systemd (Linux) with auto-reconnect
- Client-certificate authentication — X.509 file or PKCS#11 smartcard / YubiKey PIV
- Split-tunnel routing — route only chosen subnets through the VPN with vpn-slice
- VPN Up vs. raw OpenConnect — what the wrapper adds, and when to use each
- VPN Up vs. openconnect-sso — two AnyConnect SSO clients compared, fairly
- VPN Up vs. GlobalProtect-openconnect — two GlobalProtect CLI clients compared
- VPN Up vs. NetworkManager-openconnect — desktop NetworkManager plugin vs. standalone CLI
Related articles
Background and design notes:
- A Safer OpenConnect Workflow for Cisco AnyConnect VPNs on macOS and Linux — Architegrity
- A Safer OpenConnect Workflow for Cisco AnyConnect VPNs on macOS and Linux — Dev.to
- A Safer OpenConnect Workflow for Cisco AnyConnect VPNs on macOS and Linux — Medium
Open source
VPN Up is MIT-licensed and developed on GitHub. Issues and pull requests are welcome — and if it saves you time, you can buy me a coffee ☕.