Cohesive VNS3 Controller

No entries match these filters. Clear filters

1. updated seen Oct 6, 2026 · issue 096

   VNS3 7.2.2 adds ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Plugin Catalog support, enriches tunnel alerts with endpoint IDs, and enables IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. role auth for SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure. alerts.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Tunnel down/up alerts now include the endpoint ID, enabling direct use in follow-up API calls without additional lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • SNS Alert type can now authenticate via AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. role, in addition to the existing Access Key/Secret Key credential method.
   • Plugin Catalog now supports ARM plugins when the VNS3 instance is ARM-based.
   • Tunnel down/up alerts now include the endpoint ID, enabling direct use in follow-up API calls without additional lookups.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !OpenVPN Server upgraded to 2.6+ (since 7.0.2): OpenVPN clientpacks on hosts may require manual configuration changes — test connectivity before any production upgrade; clients running OpenVPN earlier than 2.5 may not reconnect after upgrade.
2. docs update Sep 7, 2026 · issue 067

   VNS3 Controller adds OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. integration for managing user accounts via directory services.

3. updated seen Sep 7, 2026 · issue 067

   VNS3 snapshot-20260907 adds idempotent tunnel bounces, strict CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. parsing, licensed EdgeGRE/VXLANVXLANA network encapsulation protocol that wraps Layer 2 Ethernet frames inside UDP packets, extending virtual LANs across Layer 3 networks. Cyber tools use it to simulate or inspect traffic across large-scale virtualized and cloud environments./GeneveGeneveA network tunneling protocol that encapsulates Ethernet frames in UDP, designed to be extensible via metadata headers. Cyber tools use it to build flexible overlay networks across physical infrastructure. and firewall objects, and optional plugin recovery on snapshot restore.

   • Adds recover_plugins argument to the snapshot-restore API, defaulting to true, with a corresponding UI tick box (defaulting to false) to make plugin recovery from configuration snapshots optional.
   • Adds EdgeGRE, VXLAN, and Geneve connection types to the VNS3 licensing system.
   • Adds firewall object count to the licensing system, covering rules in main and sub-tables, sub-tables themselves, and firewall sets (fwsets).
   • Enables strict CIDR parsing when entering routes — any route whose CIDR notation resolves to a different network than intended is now rejected outright.
   • Makes tunnel bounce (IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. reset) calls idempotent: if a bounce command for a tunnel is already queued, no additional bounce commands for that tunnel are enqueued until the existing one is processed.

   +5 more show less

   • Adds a UI edit panel for user-managed route entries, replacing the previous delete-and-re-enter workflow.
   • Adds a fixed-size logging partition so log overflow cannot impede Web UI or API operation.
   • Uploads of HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. certificates via the UI are now allowed before the controller is licensed.
   • Sets the Status Dashboard as the default status view (replacing the Status Table) on systems with 2 vCPUs and 1 GB or more of memory.
   • Improves Wireguard background-process efficiency so CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage scales more efficiently beyond 1,000 clientpacks.

   10 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Upgrading to VNS3 7.0.1 upgrades the OpenVPN server to version 2.6+; significant configuration differences between OpenVPN 2.5 and 2.6 may require manual modifications to existing OpenVPN clientpack hosts for proper reconnection — testing before production upgrade is recommended. Wireguard clientpacks are unaffected.
4. updated seen Aug 8, 2026 · issue 039

   VNS3 7.2.1 upgrades to Linux 7.0 kernel; Plugin Catalog gains ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./Intel differentiation and multi-version management.

   • Plugin Catalog now differentiates between ARM and Intel capable plugins, reflecting potential release timeline differences between platforms.
   • Plugin Catalog supports more intelligent version management, with listings enhanced to provide multiple versions and platform compatibility information.
   • Upgraded from Linux 6.17.x kernel line to 7.0.0 in response to reported local privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. findings against the 6.17 line.

   3 details in Everything

5. 7.1.2 Jul 27, 2026 · release notes

   VNS3 7.1.2 introduces OpenVPN Server 2.6+ support, ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. platform differentiation, and NGINX/Rails security updates.

   └──▷ HOW TO FIND IT
   Verify your existing OpenVPN clientpacks are compatible with the new server version before upgrading production.
   📍Navigate to the Controller UI, select a Clientpack from the configuration list, and inspect its details for the OpenVPN static key entry.
   Identify which plugins are compatible with your new ARM-based VNS3 hardware using the updated Plugin Catalog.
   📍Open the Plugin Catalog and filter or view listing details to see ARM or Intel platform indicators next to plugin versions.
   • Upgrades the bundled OpenVPN server to version 2.6+ for clientpack connectivity
   • Adds Platform compatibility indicators (ARM vs Intel) to the Plugin Catalog

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !OpenVPN Server upgraded to version 2.6+, requiring potential manual configuration adjustments on host clientpacks for proper reconnection; testing is recommended before production upgrade.
   • !Configurations based on releases before 3.5.0.5 (Nov 2012) cannot be imported if the OpenVPN keyset was not generated in a full new deployment.
6. updated seen Jul 13, 2026 · issue 014

   VNS3 7.1.1 adds AI-assisted IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. diagnostics and live plugin instance upgrades without disrupting running configurations.

   └──▷ HOW TO FIND IT
   Reach the AI Diagnostics advisor to troubleshoot a failing site-to-site IPsec tunnel without opening a support ticket.
   📍In the VNS3 Controller UI, navigate to the target IPsec connection, select the Advice option, enter your Cohesive auth token when prompted, and submit your IPsec configuration question to receive AI-generated diagnostics.
   • Introduces Connection Advisor with AI Diagnostics (Beta): an Advice option on VNS3 Controllers lets administrators ask for help configuring the controller or troubleshooting site-to-site IPsec connections (requires Cohesive auth token and active support contract).
   • Enables in-place plugin instance upgrades: a running plugin's full configuration can now be migrated to a new instance/version on the same VNS3 controller, starting at the same network address once the old instance is stopped.

   2 details in Everything

7. 7.1.1 Jun 21, 2026 · release notes

   VNS3 7.1.1 adds AI-powered Connection Advisor beta and supports in-place plugin upgrades.

   └──▷ HOW TO FIND IT
   Use the beta feature to troubleshoot a failing site-to-site IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. connection by getting AI diagnostics from the controller UI.
   📍In the VNS3 Controller UI, navigate to the Connection Advisor tab and click the Advice option for the target clientpack.
   Upgrade a running plugin instance in-place without changing its network address or interrupting service traffic.
   📍Migrate the running plugin configuration to a new plugin instance/version on the same VNS3 controller, then start the new instance at the existing network address after stopping the old one.
   • Adds an Advice option to VNS3 Controllers for AI-assisted configuration and IPsec troubleshooting
   • Enables in-place upgrades by allowing plugin instances to be migrated and upgraded on the same controller

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Cannot import configurations based on releases before 3.5.0.5; OpenVPN server will fail to start if the snapshot contains an OpenVPN static key entry without a full new deployment.
8. 7.0.1 Feb 11, 2026 · release notes

   VNS3 7.0.1 adds in-place route editing, pre-license HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. cert upload via UI, and container address binding

   └──▷ HOW TO FIND IT
   Use the new UI panel to modify an existing static route without deleting and recreating it.
   📍In the VNS3 Controller UI, navigate to Routes › User-Managed, select the target route, and click Edit to update its parameters.
   Upload server certificates to the controller before activating the license key.
   📍In the VNS3 Controller UI, go to Settings › HTTPS Certificates and use the Upload button to import your .crt and .key files.
   Configure a plugin or container instance to bind to an IP address that hasn't been assigned to any physical interface yet.
   📍When creating a new plugin/container instance in the VNS3 UI, specify bind_address: <target_ip> in the network settings, even if <target_ip> is not currently up on any interface.
   • Adds ability to edit user-managed route entries directly via a new UI panel without requiring delete-and-recreate
   • Allows uploading HTTPS certificates through the controller's UI before the product is licensed
   • Enables plugins or containers to bind to a network address even when no corresponding interface exists on the host

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !OpenVPN clientpack connectivity may break after upgrading to OpenVPN Server 2.6+; some host modifications might be needed for proper reconnection
9. 6.7.8 Nov 21, 2025 · release notes

   VNS3 6.7.8 adds optional plugin recovery control via new recover_plugins API argument and UI toggle

   └──▷ USE IT
   Restore a config snapshot without rebuilding plugin instances to speed up the operation when plugins are managed externally or do not need state preservation.
   shell copy

   curl -X PUT https://<controller-ip>/api/v1/snapshots/<snapshot_id>/restore -H 'Content-Type: application/json' -d '{"recover_plugins": false}'

   Restore a config snapshot without rebuilding plugin instances to speed up the operation when plugins are managed externally or do not need state preservation.
   📍In the VNS3 UI, navigate to Snapshots › Restore [Snapshot Name] and uncheck the recover_plugins checkbox before clicking Restore.
10. 6.7.7 Sep 9, 2025 · release notes

    Cohesive VNS3 6.7.7 adds Host Header Poisoning protection, API plugin network editing, and expanded firewall/overlay warnings

    • Adds a section in the Settings page to restrict control plane (port 8000) access to specific internal interface addresses, preventing Host Header Poisoning attacks.
    • Enables editing plugin network configuration via API, mirroring the existing UI capability.
    • Increases overlay certificate authority expiration warning from six months to twelve months, displaying a banner on every UI page when near expiry.
    • Extends GET firewall rules API response to include packet count information for each rule.
    • Restores support for IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. %any peer setting in the 6.x line after an IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. migration regression.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Host Header Poisoning Protection is DISABLED by default in version 6.7.7+; enabling it requires manual configuration and may irrecoverably block control plane access if misconfigured.
11. 6.7.4 May 15, 2025 · release notes

    VNS3 6.7.4 adds API for clientpack Extra Config, system variables in firewall rules, and session auth for downloads

    • Adds clientpack_extra_config to the Cohesive API and terraform provider to get/edit clientpack Extra Config data
    • Adds new system variables for the controller's overlay IP and the topology's VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. address in Firewall Sets and Firewall Rules
    • Supports abbreviated format -j TTL and -j TCPMSS firewall rule targets without requiring -m module information
    • Allows snapshot and Plugin Image downloads to use current session credentials via API and Web UI

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The word custom is now a reserved word and cannot be used in the name of custom variables
12. 6.7.2 Jan 1, 2025 · release notes

    VNS3 6.7.2 adds custom branding framework for partners and new route update notifications for clientpacks.

    • ENHANCEMENT Custom branding framework for reseller partners and ISPs allows standardized builds with partner logo, CSS, and color scheme.
    • ENHANCEMENT New route update process for clientpack notification sends multicast (openvpn) or unicast (wireguard) packets to connected clients upon routing changes.

    2 details in Everything

13. 6.6.11 Nov 26, 2024 · release notes

    New verbose parameter for get cloud data API; APIv1 plugin network and firewall rule fixes

    • get cloud data API endpoint gains verbose parameter (default false) to return full metadata tree excluding IAMs

    1 detail in Everything

14. 6.6.10 Oct 10, 2024 · release notes

    Adds Settings UI/API for Topology, NTP, CORSCORSA browser mechanism that lets a server declare which foreign origins may read its HTTP responses, enforced by the browser to block unauthorized cross-site requests from JavaScript., and syslog hostname configuration.

    • The Settings menu replaces Topology Name and adds controls for NTP hosts, CORS embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. allowed hosts, and the syslog hostname.
    • Tagging API now supports generalized queries to find object types by tag, enabling the new Clientpack capability.
    • Self-tuning on boot or reboot adjusts concurrency based on available cores to improve performance on small instances such as AWS t3.nano.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Topology Name menu item is removed; Topology and Controller name are now accessed via the new Settings section.
15. 6.2.6 Jun 28, 2024 · release notes

    VNS3 6.2.6 adds unauthenticated plugin webhooks and internal hosts file POST endpoint

    • Additions/deletions from the VNS3 internal hosts file via POST operation with total replacement of host entries
    • New plugin alert type for plugins to make unauthenticated webhook calls

    2 details in Everything

16. 6.6.4 Jun 28, 2024 · release notes

    Adds unauthenticated webhook alerts for plugins and allows VNS3 hosts file edits via POST.

    • Adds plugin alert type enabling unauthenticated webhook calls from inside a VNS3 host plugin
    • Allows additions/deletions to the VNS3 internal hosts file via a total-replacement POST operation

    2 details in Everything

17. 6.6.2 Jun 6, 2024 · release notes

    VNS3 Controller 6.6.2 expands IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support across IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications., firewall, routing, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes., and mesh traffic.

    • Configures VNS3 as an IPv6 NAT Gateway

    1 detail in Everything

18. 6.1.8 Dec 20, 2023 · release notes

    VNS3 6.1.8 adds initial AWS Metadata v2 support via optional flag and improves BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. config management

19. 6.2.8 Aug 24, 2023 · release notes

    VNS3 6.2.8 adds dynamic DNS and tag-based Firewall Sets, mesh sync for vars/FWsets, AWS Metadata v2, and Telegram/Google Chat webhook templates.

    • Adds DNS type to Firewall Sets for dynamic population via domain resolution every 30 seconds
    • Adds Clientpack Tag type to Firewall Sets to auto-populate based on team member tags like department:itoperations
    • Enables mesh synchronization for both Firewall Sets and Custom Variables across the overlay network
    • Supports AWS Metadata Service Version 2 (metadata_v2) in clientpack configurations
    • Adds support for recovering VNS3 plugin instances via Import Snapshot using statedir stanzas

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Network address range of the plugin network backbone can no longer be changed while plugins are running; plugin instances must be stopped first
20. 6.0.14 Jun 1, 2023 · release notes

    Cohesive VNS3 Controller 6.0.14 adds Azure password/reset via user data and firewall rule deletion warnings

    • Extends the reset command set for API password, UI password, UI admin username, and disabling all firewall rules to Azure VNS3 instances via cloud user data
    • Adds a UI warning when attempting to delete a firewall rule, as it was previously too easy to select delete instead of disable
    • Returns a 503 API Not Available error during configuration snapshot import to signal the controller is rebooting and not yet available for further configuration

    3 details in Everything

21. 6.0.12 May 25, 2023 · release notes

    VNS3ms plugin recovery during upgrades

22. 6.0.11 Apr 28, 2023 · release notes

    VNS3 6.0.11 allows BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. advertisement of default routes (0.0.0.0/0) with UI warnings.

    • Allows VNS3 to advertise 0.0.0.0/0 and receive 0.0.0.0/0 with BGP Peers via the UI
    • UI displays a warning when configuring default route advertisement (0.0.0.0/0) in BGP peers

    2 details in Everything

23. 6.0.5 Dec 5, 2022 · release notes

    VNS3 6.0.5 adds HTTP redirect for port confusion, improves LNKe default firewall rules and snapshot import reliability

    • Adds UI redirect page for users accessing http:// or https:// without specifying port 8000 to guide them to the correct URL.
    • Updates default internal firewall rules for LNKe enterprise offering to allow outbound TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. port 8000 traffic for Wireguard VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. clients.
    • Improves configuration snapshot import reliability by reducing database busy failures for clientpacks, firewall rules, and fwsets.

    3 details in Everything

24. 6.0.4 Nov 17, 2022 · release notes

    Adds Wireguard support for LNKe client side connections and fixes missing PSK config issue

    • Enables wireguard as the client protocol for LNKe (VNS3 network platform), previously limited to openvpn.

    1 detail in Everything

25. 5.2.5 Jun 4, 2022 · release notes

    VNS3 5.2.5 adds interface-specific route tables with iptables LOOKUP target and Azure Standard IP auto-discovery

    • Adds interface-specific routing capabilities via the ROUTING_CUST virtual firewall table designator and -j LOOKUP iptables target for complex packet flow selection

    1 detail in Everything

26. 5.2.1 Nov 16, 2021 · release notes

    VNS3 5.2.1 adds Traffic Pairs for VPNsVPNsA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., Plugin Catalog/Dashboard, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. logs

    • Adds Traffic Pairs UI/API feature to define local/remote subnet pairs for route-based VPNs without manual state management
    • Adds Plugin Catalog under Main Menu > Plugins to allow in-place installation of monitoring and security plugins via the web UI
    • Adds Plugin Dashboard under Main Menu > Plugins for simplified plugin management access
    • Adds BGP event logs available via Logging Plugin at /mnt/logs/vns3_connection_logs/bgpd.log
    • Adds alerts for BGP session up/down states for BGP peers

    5 details in Everything

27. 5.1.7 Oct 1, 2021 · release notes

    VNS3 5.1.7 adds BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. session up/down alerts to the Alerts function and improves IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support./PFS support.

    • Adds bgp session alert type to the VNS3 Alerts function for push HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. notifications when a BGP Peer session disconnects or connects
    • Improves IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. subsystem with further IKEv2/PFS support

    2 details in Everything

28. 5.1.2 Jun 14, 2021 · release notes

    Cohesive VNS3 5.1.2 adds aggressive mode IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. client support and plugin manager UI access.

    • Adds support for VNS3 acting as an aggressive mode IPsec client (IKEv1 only)
    • Adds Plugin Manager to the Action menu of a running container

    2 details in Everything

29. 5.1.1 Jun 2, 2021 · release notes

    VNS3 5.1.1 adds secondary IP discovery, route disabling, auto-HA clientpack routes, custom BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peering and enhanced drop logs

    • Adds automatic discovery of Secondary IPs from AWS, Azure, and Google Cloud metadata on the Interfaces page.
    • Enables administrators to disable routes via UI and API for debugging or pre-work without deletion.
    • Adds automatic high availability for clientpack routes: the route is active on the controller to which the clientpack is connected and moves when it reconnects to another peer.
    • Adds a Configure link on the Controller Peering page to customize BGP configuration for topology peers.
    • Allows resetting Firewall connection tracking via a new Reset Connection Tracking link in the UI.

    +1 more show less

    • Enables improved drop log visibility by supporting conntrack packet monitors via the API.

    6 details in Everything

30. 5.0.2 Mar 12, 2021 · release notes

    Cohesive VNS3 5.0.2 adds API for resetting connection tracking and suppresses excessive VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. tunnel alerts

    • Adds API endpoint to reset the firewall connection tracking system, clearing destination/source NAT memory and open connection status.
    • Suppresses site-to-site VPN tunnel up-down alerts to a maximum of one per minute when configurations are out of sync.

    2 details in Everything

31. 4.11.4 Mar 9, 2021 · release notes

    VNS3 4.11.4 adds route enable/disable control, CA expiry warnings, and clientpack gateway failover for VNS3 Controller.

    • Routes entered via API or Web UI can now be disabled, rendering them grayed out in the UI but keeping them in the database without forcing them into the OS routing table
    • Paired controller High Availability use-case now supports clientpack gateways as next hops for IoTIoTA collective label for internet-connected physical devices — sensors, cameras, routers, appliances — that tools target because they run embedded firmware with limited patching and broad network exposure. and database cluster quorum scenarios, enabling automatic failover routing behind the clientpack device

    2 details in Everything

32. 5.0.0 Feb 5, 2021 · release notes

    VNS3 5.0 adds per-controller naming, BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. aliases, route disable/enable, and IPv4 public IP fallback.

    • Adds ability to set individual names for controllers separate from the topology name
    • Adds support for specifying an ASN alias when creating a BGP peering configuration
    • Allows routes to be disabled and re-enabled without deletion
    • Adds dynamic IPv4 public IP resolution via port 80 when cloud metadata lookup fails
    • Enables compression re-enablement via API call on the VNS3 controller for OpenVPN 2.5 clients

    +1 more show less

    • Adds warning display on Clientpacks page when CA is within 6 months of expiration

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Less secure, older versions of TLS will not be allowed; Overlay clients must use a version of openvpn agent and an operating system capable of negotiating with TLS v1.2 or higher.
    • !Compression is NOW DISABLED on overlay client communication by default.
33. 4.11.3 Sep 16, 2020 · release notes

    VNS3 Plugin Manager alpha release and LIST type support for FWsets

    • Adds the VNS3 Plugin Manager (alpha) to manage running plugin containers
    • Adds LIST type support to FWsets, allowing them to hold entries of PORT or NET sets

    2 details in Everything

34. 4.11.2 Aug 28, 2020 · release notes

    VNS3 4.11.2 adds Gsuite auth and IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. endpoint descriptions

    • Support People VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. users authenticating against Gsuite.
    • Description field added to IPsec Endpoint configuration to track device details.

    2 details in Everything

35. 4.9.2 Mar 30, 2020 · release notes

    Adds clientpack connect/disconnect alerts, async Import Snapshot, pre-licensing task queries, and login blocking during configuration.

    • Adds :async parameter to the Import Snapshot API call to return a task ID for status checking instead of blocking.

    1 detail in Everything

36. 4.9.1 Mar 11, 2020 · release notes

    VNS3 4.9.1 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory./GSuite auth, Webhook integration builder, Wireguard peering, and API VIPVIPA Virtual IP address — a single IP shared across multiple hosts or services, commonly used for load balancing or failover so traffic can be rerouted without changing the client-facing address. address

    • Adds Google GSuite and JumpCloud as supported directory providers for controller administrator authentication
    • Adds new alert types: process_change, user_password_change, controller_reboot, controller_reset_defaults, and system_general
    • Enables beta support for Wireguard encryption in inter-controller peering to increase throughput and concurrency

    3 details in Everything

37. 4.6.1 Jun 11, 2019 · release notes

    VNS3 4.6.1 notes describe API tokens and timed UI access introduced in 4.5.0+, plus push alerts, MARK firewall rules, and beta multi-interface IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. support.

    └──▷ TRY IT
    Authenticate to the VNS3 API using a timed token instead of basic auth.
    copy

    $ curl -k -X GET -H api-token:<API_TOKEN> https://controller_ip_address:8000/api/config

    Use the CLI tool with a specific API token.
    copy

    $ vnscubed.rb -H localhost -T n5v5nf4uc74upteo1v1 desc_config

    • Supports API token authentication in vnscubed.rb using the -T parameter in place of -K and -S, documented with the 4.5.0+ token capability.
    • Supports the api-token HTTP header for token-authenticated REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. calls, documented with the 4.5.0+ token capability.
    • Documents timed access URLs for the Web UI in VNS3 4.5.0+, including expiration and management through VNS3:ms.
    • Adds push alerts to PagerDuty, Slack, and Webex Teams for IPsec tunnel events
    • Adds beta support for terminating IPsec connections on multiple interfaces using compat in Extra Configs together with a local-peer-id entry.

    +1 more show less

    • Adds support for MARK rule patterns in firewall configuration (replacing CONNMARK-only limitation)

    6 details in Everything

38. 4.4.2 Mar 19, 2019 · release notes

    The Clientpacks page now displays the most recent connect and disconnect times for clientpack hosts.

39. 4.4.1 Dec 23, 2018 · release notes

    VNS3 4.4.1 adds GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. over VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support, 32-bit BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses., plugin env vars, and IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. MTU controls

    • GRE encapsulation is now supported for site-to-site configurations via the create_ipsec_endpoint API with "vpn_type":"gre" and "route_based_int_address".
    • 32bit private Autonomous System Numbers (4200000000 – 4294967294) are now allowed in BGP Peering configurations.
    • Site-to-site Extra Configs entry box now accepts mtu= keyword to control Maximum Transmission Unit and local-peer-id= to override Local IKE ID.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The create_ipsec_endpoint API parameter "gre":false is no longer supported as a no-op indicator; it must be explicitly defined as vpn_type":"policy" or omitted to avoid invalid parameter errors.
40. 4.3.11 Oct 24, 2018 · release notes

    VNS3 4.3.11 adds per-tunnel traffic accounting, nat-t autodiscovery via compat flag, and failed plugin import deletion.

    • Displays Bytes in/Bytes out per tunnel on home pages and in the desc ipsec status API call for monitoring synchronization losses
    • Allows compat:encapsulation=auto to force auto-negotiation of NAT-T vs Native IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. in site-to-site connections

    2 details in Everything

41. 4.3.10 Apr 26, 2018 · release notes

    VNS3 Controller 4.3.10 allows encrypted overlay CIDRs to overlap with remote subnet CIDRs and improves IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. rekey behavior.

    • Encrypted overlay networks on VNS3 can now overlap with CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. specifications for subnets on the other side of IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. connections, allowing a more specific subset CIDR to communicate successfully with a broader tunnel range (e.g., 10.0.0.0/24 overlay with 10.0.0.0/8 remote subnet).
    • Improved IKEv2 support allows VNS3 to act as the rekey responder by configuring phase1 and phase2 lifetimes on the connecting side to be less than those on VNS3.

    2 details in Everything

42. 4.3.9 Apr 23, 2018 · release notes

    VNS3 4.3.9 extends plugin logging permissions to /mnt/logs sub-directories and adjusts tunnel recovery timing.

    • Extends writable permission for plugins to sub-directories of /mnt/logs
    • Increases the automatic IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel restart timer from the 30 seconds used in 4.3.8 to 5 minutes (300 seconds).

    2 details in Everything

43. 4.3.8 Apr 18, 2018 · release notes

    VNS3 4.3.8 adds AWS userdata password reset, incremental clientpack API, and new firewall marking capabilities.

    • reset_api_password, reset_ui_password, and reset_firewall arguments in AWS Userdata enable immediate controller access and firewall state management after boot
    • The add_clientpacks API supports the requested-ips argument for incremental overlay IP allocation without generating all clientpacks upfront.
    • Web UI displays the specific element causing Inactive Due to Syntax Error on the IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. Endpoint page instead of a generic message
    • Firewall supports Connection Marking and Hash Marking capabilities via the firewall interface
    • Docker context directory uploads now support zip, b2, and .tar.gz formats for plugin creation

    5 details in Everything

44. 4.3.5 Jan 4, 2018 · release notes

    Adds VNS3 Controller password reset capability via AWS user metadata.

45. 4.3.4 Nov 7, 2017 · release notes

    VNS3 4.3.4 improves CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware.-load and memory-utilization reporting, including cached and buffered memory in UI and API information.

    • Improves CPU load information on the VNS3 Status page
    • Improves memory utilization information via UI and API by taking into account what the VNS3 linux-based OS is caching/buffering
    • Changes IKEv1 Native IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. behavior to behave like VNS3 3.x system wide Native IPsec

    3 details in Everything

46. 4.3.3 Aug 6, 2017 · release notes

    Alpha firewall enhancements with subchains and host/port sets, AWS BYOL support, and Google Cloud Marketplace launcher.

    • Alpha firewall enhancements support customer-created subchains and firewall host and port sets.
    • Allow container plugins to be retrieved from site with self-signed cert
    • VNS3 snapshot files now include NTP data if configured via API
    • Support for AWS BYOL Marketplace image added

    4 details in Everything

47. 4.3.2 May 21, 2017 · release notes

    Cohesive VNS3 Controller 4.3.2 introduces the beta release of Overlay Engines.

48. 4.3.1 May 2, 2017 · release notes

    Cohesive VNS3 Controller 4.3.1 adds alpha overlay engines, enhanced BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. peering, and API throughput improvements.

    • Alpha release of overlay engines to add more encryption and tunneling cores
    • Significantly enhanced dynamic BGP peering capabilities
    • Increased API throughput
    • Improved cluster performance for topologies with 16 or more controllers
    • Improved firewall performance

    +3 more show less

    • Improved UI for Routing and Clientpacks
    • Reduced api server default logging level
    • Reduced size of configuration snapshot files by removing unneeded log data

    8 details in Everything

49. 4.11.1 Sep 29, 2016 · release notes

    VNS3 4.11.1 adds IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. PFS groups 22-24, SCTPSCTPA transport-layer protocol (RFC 4960) maintained by the IETF that delivers messages with optional ordering and built-in multi-homing, giving cyber tools reliable framing without TCP's head-of-line blocking. routing, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. NPS support, clientpack alerts, and async snapshot API.

    • Adds support for PFS Groups 22, 23, and 24 to the IPsec subsystem
    • Enables routing of Stream Control Transmission Protocol (SCTP) packets
    • Adds Microsoft NPS Server authentication support for PeopleVPN users via LDAP/AD
    • Supports separate LDAP groups for VNS3 Administrators and PeopleVPN users in the configuration
    • Adds TLS/LDAPSLDAPSLDAP over TLS — the encrypted variant of the Lightweight Directory Access Protocol, standardized in RFC 2830, used to query directory services like Active Directory without exposing credentials in plaintext. connection configuration options for PeopleVPN LDAP/AD integration

    +2 more show less

    • Adds async parameter to snapshot creation API calls to enable asynchronous monitoring via task ID
    • Enables querying Task Status before licensing using existing API endpoints

    7 details in Everything

50. 4.8.2 Sep 29, 2016 · release notes

    Adds custom webhook destinations, duration-based packet monitors with new API calls, and BGPBGPA routing protocol that lets autonomous systems on the internet exchange reachability information, determining how traffic flows between networks. Cyber tools use it to monitor route hijacks or inject sinkholes. reset via UI/API in v4.8.2

    └──▷ TRY IT
    Create a packet monitor that runs for exactly ten minutes
    copy

    $ create_packet_monitor(duration='10 minutes', filter_type='PCAP')

    Configure environment variables for a plugin instance via the Web UI
    📍Go to Plugins › Allocate/Edit › Environment Variables section
    • Adds configurable webhooks for IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel up/down events to VNS3, PagerDuty, Slack, AWS SNSSNSAmazon Simple Notification Service, a managed pub/sub messaging service from AWS that lets tools fan out alerts or events to multiple subscribers — queues, email, HTTP endpoints, or Lambda functions — without managing broker infrastructure., Webex Teams, or custom destinations via the Alerts page template
    • Adds create_packet_monitor, start_packet_monitor, stop_packet_monitor, and delete_packet_monitor API calls with support for duration filters like one day, 10 minutes, or forever
    • Adds three packet filter types: PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic., Netflow, and Conntrack
    • Adds two output destinations for packet monitors: file download and host delivery of netflow data
    • Adds ability to reset the BGP subsystem via a link on the IPsec page in the Web UI or through the API

    +1 more show less

    • Adds environment variable configuration for plugin deployments directly in the Web UI

    6 details in Everything

51. 3.5.1.14 Mar 18, 2016 · release notes

    VNS3 3.5.1.14 adds SNAT/MASQUERADE control, optional gateway specs for Interface Routes, and jumbo frame support via config file change.

    • ms system now allows an instance to function as an HA backup controller
    • Relaxes firewall constraints to give customers more control using SNAT and MASQUERADE.
    • Endpoint section of the IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. page is now sorted by name (consistent with Status page table)
    • Interface Routes now take an optional gateway specification
    • Overlay server can use jumbo frames when available via change to client side config file

    +1 more show less

    • PREROUTING_CUST and POSTROUTING_CUST customer firewall chains can now use valid jump targets for the NAT table

    6 details in Everything

52. 3.5.0.8 Jun 3, 2015 · release notes

    VNS3 3.5.0.8 adds tunnel subnet editing, raises the API rate limit, and automatically restarts the SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale. agent after a crash.

    • Adds ability to edit the local or remote subnet of an IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. tunnel via the Web UI
    • Increases the internal firewall limit for API calls from 20 to 50 per 5 seconds

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Reverts the VNS3 snapshot import behavior for native IPsec (ESP / Protocol 50) connections introduced in 3.5.0.4, requiring users to follow the legacy manual migration steps (download snapshot, remap public IP, reboot, then import).
53. 3.5.0.7 Feb 2, 2015 · release notes

    VNS3 3.5.0.7 adds console display of the outer adapter IP address and advertisement-only routes.

    • Displays the IP address of the outer network adapter, usually eth0, in the console for easier identification in virtual environments.
    • Routes can now be configured as advertisements only, without requiring an attached network interface on the Controller.

    2 details in Everything

54. 3.5.0.6 Jan 21, 2015 · release notes

    Container UI adds local filesystem upload for Docker files; API improves VNS3:ms snapshot retention support. version 3.5.0.6

    • container UI now lets you upload containers or docker files from local filesystem
    • Improved API support for VNS3:ms and automatic snapshot retention

    2 details in Everything

55. 3.5.0.4 Sep 2, 2014 · release notes

    VNS3 Controller 3.5.0.4 adds signed HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. support for container imports and enhances IPSEC tunnel error handling.

    • Allow use of signed HTTPS URLs in the docker/lxc container import capability.
    • Improved error handling in create_ipsec_tunnel API call.

    2 details in Everything

56. 4.0 Apr 30, 2014 · release notes

    VNS3 4.0 adds per-endpoint NAT-Traversal control, IKEv2IKEv2The second version of the Internet Key Exchange protocol, standardized by the IETF, used to negotiate and authenticate IPsec tunnels. Cyber tools build on it for reliable, fast VPN session setup with built-in NAT traversal and EAP support. support, selectable Exo Ping source interface, and configurable HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. certs for UI/API access.

    • Adds NAT-Traversal control on a per endpoint basis to IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. controls
    • Fully supports IKEV2 in the IPsec subsystem
    • Allows Exo Ping with a selectable source interface
    • Enables disabling individual IPsec tunnels
    • Makes HTTPS certificates for Web UI and API access configurable

    5 details in Everything

57. 3.5.0.2 Apr 1, 2014 · release notes

    VNS3 Controller 3.5 adds Routing Robot, Docker integration, GREGREA tunneling protocol that wraps one network packet inside another, letting tools carry arbitrary traffic across IP networks without modifying the payload, useful for traffic capture and network emulation. support and API IP range fetching

    └──▷ TRY IT
    Fetch a clientpack for a specific subnet range via the API to automate on-demand cloud overlay networks.
    copy

    $ curl -X POST https://<vns3-manager>/api/clientpack/fetch_next_clientpack?ip_range=10.0.0.0/24

    Monitor the VNS3 Manager's resource usage directly from the web interface.
    📍In the VNS3 Manager UI, navigate to the System Health section to view memory, swap, and disk utilization metrics.
    • Adds fetch_next_clientpack API parameter to specify an IP range for clientpack generation
    • Adds System Health UI displays for memory utilization, swap, and disk space in VNS3 Manager
    • Adds Routing Robot feature with client-side routing agents to automate topology updates
    • Adds Docker integration allowing customizable virtual networks within Docker containers
    • Adds GRE tunneling support including Layer 2 Bridging over GRE and GRE over IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications.

    +1 more show less

    • Adds TrendMicro Integration with Deep Security central management platform

    6 details in Everything

58. 3.0.4 Nov 26, 2013 · release notes

    VNS3 Controller 3.0.4 adds Outbound NAT for AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. replacement and Web UI clientpack check-in/out controls

    └──▷ HOW TO FIND IT
    Manage client access status directly from the browser without scripting API calls for check-in/out state changes.
    📍In the Web UI, navigate to the Clientpacks section and use the new Checked in / Checked out status controls.
    • Adds Outbound NAT capabilities to allow VNS3 to replace the AWS VPC NAT AMI, reducing deployment complexity and runtime fees in Private VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules..
    • Enables marking Clientpacks as checked in or checked out via the Web UI, a capability previously restricted to the API.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Shutdown link has been removed from the Web UI; you must now use the cloud or virtual infrastructure console to shutdown an instance of VNS3.
59. 3.0.1 Apr 17, 2013 · release notes

    VNS3 Controller 3.0.1 adds NAT, port forwarding, SNMPSNMPA UDP-based protocol for querying and managing network devices, standardized by the IETF. Cyber tools use it to pull interface stats, topology data, and device state from routers, switches, and servers at scale., clientpacks, and enhanced snapshot credentials.

    • Adds outbound NAT capabilities to replace AWS VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware. NAT AMI for private VPCsVPCsVirtual Private Clouds — isolated, software-defined network environments inside a public cloud provider such as AWS, Azure, or GCP — give cyber tools a controlled network boundary with configurable routing, subnets, and access rules.
    • Adds port forwarding support via UI by specifying src/dst IP and port
    • Adds dual-honed VLAN support with Private VLAN menu for IBM SCE, GoGrid, ElasticHosts
    • Adds SNMP support for popular MIBs to enable Zenoss and Cacti monitoring
    • Adds clientpack configuration files for Linux/Mac, Windows, iOS, and Android in a single config file

    +1 more show less

    • Allows setting new UI and API credentials when restoring from snapshot

    6 details in Everything

60. 3.0 Sep 12, 2012 · release notes

    VNS3 3.0 adds expanded REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services., CloudWAN, direct tunnel management, and enhanced network sniffer capabilities

    • Adds CloudWAN feature to establish connectivity between multiple endpoints using globally distributed public cloud data center network
    • Expands REST API with new calls for greater programmatic control over VNS3 topology
    • Adds ability to monitor tun0 (Overlay Network) or eth0 (IPsecIPsecA suite of IETF protocols that authenticate and encrypt IP packets at the network layer, giving cyber tools a standards-based way to build VPNs or secure host-to-host tunnels without modifying applications. Connections) interfaces via Network Sniffer
    • Adds UI and API endpoints to view negotiated tunnel parameters, encryption domains, history, logs, and restart/delete individual IPsec tunnels

    4 details in Everything