VPN Manager

VPN is its own destination in the left rail. Saved profiles, one-click connect, live status, credentials from the vault — the Shimo / Tunnelblick shape, inside the app where you already keep the hosts on the other side of the tunnel. Pro tier and above.

Two engines

OpenConnect / AnyConnect

Cisco AnyConnect-compatible SSL VPN. Also speaks GlobalProtect, Juniper, Pulse, and Fortinet.

• Password auth or browser SAML/SSO — see SSO and SAML for the Okta / Azure / Duo flow
• Trust-on-first-use server-cert pinning — the first connect shows you the certificate; a later change is refused rather than silently accepted
• Auth-group auto-discovery — query the gateway for its tunnel groups and pick the right one from a list instead of typing a group name you half-remember
• Real-AnyConnect user agent — SSO-gated servers only offer the browser auth method to clients they recognize, so ShellYard presents as AnyConnect does

OpenVPN

Classic .ovpn. Paste the whole config into the profile; credentials for auth-user-pass come from a vault credential rather than a plaintext file next to the config.

The config is sanitized per-OS on connect — Linux-only user / group directives are stripped on macOS and Windows, which is the single most common reason a working Linux .ovpn fails everywhere else.

Connecting

Profiles list with live state. Connect prompts for OS admin rights — osascript on macOS, pkexec on Linux, UAC on Windows. Only the tunnel needs elevation; ShellYard itself does not run privileged.

Passwords and SSO cookies are fed to the client on stdin or through a 0600 temp file — never on the command line, where any other process on the machine could read them out of the process table.

Disconnecting

Disconnect kills every client instance for that profile and escalates SIGINT → SIGKILL.

This is deliberate. A hung teardown that leaves a zombie tunnel process behind keeps hijacking your routes and DNS while the UI cheerfully reports “disconnected” — you notice twenty minutes later when nothing internal resolves. Connect also clears any orphan from a previous session before dialing.

Shared profiles

A VPN profile in a Shared Space carries a default Space credential, so an admin can publish “Acme corporate VPN” once and every member gets it.

Each member can then attach their own Personal-vault credential as a per-user override — same profile, same gateway, their own login. SSO profiles need no credential at all, since browser auth is inherently per-user.

Logs

Per-profile logs land in ~/.shellyard/vpn/. Failures surface in the UI with the relevant lines, but the full openconnect / openvpn output is on disk when you need to send something to a network team.

What it isn’t

Not a VPN server, and not a mesh/overlay product — no WireGuard, no Tailscale, no ZeroTier. It connects to corporate gateways that already exist. If your organization runs WireGuard, use its client; ShellYard’s saved connections work over any tunnel your OS has up, regardless of who brought it up.