> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neo.projectdiscovery.io/llms.txt
> Use this file to discover all available pages before exploring further.

# VPN

> Connect Neo to your internal network for testing private targets

VPN configuration lets Neo reach targets on private networks, internal environments, and isolated infrastructure. Once configured, agents connect to the VPN automatically when a task requires access to internal hosts.

Go to **Settings → VPN** to configure your provider. Providers marked "Configured" have credentials stored and are ready to use. You can store credentials for multiple providers and switch between them as needed.

If your provider is not listed, you can still configure it by adding the required environment variables directly in [Secrets](/platform/settings/secrets).

## Supported providers

### WireGuard

Upload your WireGuard `.conf` file.

| Variable           | Description                               |
| ------------------ | ----------------------------------------- |
| `WIREGUARD_CONFIG` | Your WireGuard `.conf` configuration file |

### OpenVPN

Upload your OpenVPN `.ovpn` file and provide credentials if your server requires authentication.

| Variable           | Description                             |
| ------------------ | --------------------------------------- |
| `OPENVPN_CONFIG`   | Your OpenVPN `.ovpn` configuration file |
| `OPENVPN_USER`     | VPN username                            |
| `OPENVPN_PASSWORD` | VPN password                            |

### OpenConnect

Used for Cisco AnyConnect-compatible servers and other OpenConnect-supported gateways.

| Variable               | Description                                                                                       |
| ---------------------- | ------------------------------------------------------------------------------------------------- |
| `OPENCONNECT_SERVER`   | VPN server hostname (e.g. `vpn.company.com`)                                                      |
| `OPENCONNECT_USER`     | VPN username                                                                                      |
| `OPENCONNECT_PASSWORD` | VPN password                                                                                      |
| `OPENCONNECT_PROTOCOL` | Protocol: `anyconnect` (default), `gp` (GlobalProtect), `pulse` (Pulse Secure), or `nc` (Juniper) |

### GlobalProtect

Connects to Palo Alto GlobalProtect portals, including Okta SAML/SSO with TOTP MFA. Provide the portal plus either credentials (with an optional TOTP secret to automate MFA) or a pre-obtained portal cookie. Only the portal is required.

| Variable                    | Description                                                            |
| --------------------------- | ---------------------------------------------------------------------- |
| `GLOBALPROTECT_PORTAL`      | GlobalProtect portal hostname (e.g. `vpn.company.com`)                 |
| `GLOBALPROTECT_USERNAME`    | Portal username                                                        |
| `GLOBALPROTECT_PASSWORD`    | Portal password                                                        |
| `GLOBALPROTECT_TOTP_SECRET` | Base32 authenticator setup key for automated Okta MFA                  |
| `GLOBALPROTECT_COOKIE`      | Pre-obtained portal prelogin-cookie (alternative to username/password) |

### Tailscale

Connects Neo as a node on your Tailnet. Get your auth key from the Tailscale Admin Console.

| Variable            | Description                                                      |
| ------------------- | ---------------------------------------------------------------- |
| `TAILSCALE_AUTHKEY` | Auth key from Tailscale Admin Console (format: `tskey-auth-...`) |

### IPsec/IKEv2

Upload your IPsec configuration and secrets files.

| Variable        | Description                           |
| --------------- | ------------------------------------- |
| `IPSEC_CONFIG`  | Your IPsec `.conf` configuration file |
| `IPSEC_SECRETS` | Your IPsec secrets file               |

### Cisco Meraki

Connects via Meraki Client VPN. Find your PSK in the Meraki Dashboard under Security & SD-WAN > Client VPN.

| Variable          | Description                                                |
| ----------------- | ---------------------------------------------------------- |
| `MERAKI_SERVER`   | Meraki VPN server hostname (e.g. `vpn.meraki.example.com`) |
| `MERAKI_USER`     | VPN username                                               |
| `MERAKI_PASSWORD` | VPN password                                               |
| `MERAKI_PSK`      | Pre-shared key from Meraki Dashboard                       |

### Twingate

Connects Neo as a service account on your Twingate network. Get your service key from Twingate Admin Console under Service Accounts.

| Variable               | Description                                                |
| ---------------------- | ---------------------------------------------------------- |
| `TWINGATE_SERVICE_KEY` | Service key from Twingate Admin Console > Service Accounts |

### Cloudflare WARP

Supports site-to-site tunnel mode, headless Zero Trust enrollment via a service token, and consumer mode. For headless Zero Trust enrollment, provide `WARP_ORGANIZATION`, `WARP_AUTH_CLIENT_ID`, and `WARP_AUTH_CLIENT_SECRET` together.

| Variable                  | Description                                                             |
| ------------------------- | ----------------------------------------------------------------------- |
| `WARP_CONNECTOR_TOKEN`    | Connector token for site-to-site tunnel. Leave empty for consumer mode. |
| `WARP_ORGANIZATION`       | Cloudflare Zero Trust team name (e.g. `mycompany`)                      |
| `WARP_AUTH_CLIENT_ID`     | Zero Trust service token Client ID for headless enrollment              |
| `WARP_AUTH_CLIENT_SECRET` | Zero Trust service token Client Secret for headless enrollment          |