Skip to main content
VPN configuration lets Neo reach targets on private networks, internal environments, and isolated infrastructure. Once configured, agents connect to the VPN automatically when a task requires access to internal hosts. Go to Settings → VPN to configure your provider. Providers marked “Configured” have credentials stored and are ready to use. You can store credentials for multiple providers and switch between them as needed. If your provider is not listed, you can still configure it by adding the required environment variables directly in Secrets.
A VPN extends your Neo-managed cloud sandbox into a private network. If Neo should run from a specific workstation, server, VPC, or network segment and use its local files or tools, install a self-hosted sandbox there instead. See VPN, SSH, or BYOS for a full comparison.

​
Supported providers

​
WireGuard

Upload your WireGuard .conf file.

​
OpenVPN

Upload your OpenVPN .ovpn file and provide credentials if your server requires authentication.

​
OpenConnect

Used for Cisco AnyConnect-compatible servers and other OpenConnect-supported gateways.

​
GlobalProtect

Connects to Palo Alto GlobalProtect portals, including Okta SAML/SSO with TOTP MFA. Provide the portal plus either credentials (with an optional TOTP secret to automate MFA) or a pre-obtained portal cookie. Only the portal is required.

​
Tailscale

Connects Neo as a node on your Tailnet. Get your auth key from the Tailscale Admin Console.

​
IPsec/IKEv2

Upload your IPsec configuration and secrets files.

​
Cisco Meraki

Connects via Meraki Client VPN. Find your PSK in the Meraki Dashboard under Security & SD-WAN > Client VPN.

​
Twingate

Connects Neo as a service account on your Twingate network. Get your service key from Twingate Admin Console under Service Accounts.

​
Cloudflare WARP

Supports site-to-site tunnel mode, headless Zero Trust enrollment via a service token, and consumer mode. For headless Zero Trust enrollment, provide WARP_ORGANIZATION, WARP_AUTH_CLIENT_ID, and WARP_AUTH_CLIENT_SECRET together. Headless enrollment also needs two settings in the Cloudflare Zero Trust dashboard. Allow service tokens to enroll. Under Settings > WARP Client > Device enrollment permissions, add a rule using the Service Auth selector and select your service token. Without it, enrollment fails with Access JWT redirect did not include 'token'. Keep the sandbox’s own network out of the tunnel. Neo’s cloud sandbox reaches Neo over a private address range. If your Split Tunnel sends that range through the tunnel — which happens whenever you tunnel a broad private range such as 10.0.0.0/8 to reach internal targets — the sandbox loses its connection to Neo and the task fails even though WARP reports connected. To find the range, open a terminal on your sandbox and run:
Take the first two octets of the address and exclude that /16 under Settings > WARP Client > Split Tunnels (Exclude mode). For an address of 10.x.y.z, exclude 10.x.0.0/16.
Excluding the sandbox’s range does not affect your own networks. Everything else, including the rest of the range you are tunneling, keeps routing through WARP.