HQ
Acme HQConnected · 12m 48s
vpn.acme.example:10443 · ana.souza
Free · open source · written in Rust
Your VPNs.
One window.
No terminal.
Connect to every FortiGate environment you work with, see which tunnels are up and get back to work. No commands to memorize, no config files to edit by hand.
TunnelYardYour tunnels
3 profiles · 2 connected
Search profiles
New profileDisconnect
NX
North clientConnected · 04m 22s
ssl.north.example:443 · ana
ST
StagingDisconnected
vpn.staging.example:443 · deploy
Console Runs without root v3.0.9
Works with
LinuxFortiGate SSL VPN
Why it exists
You wanted to reach the network.
Not babysit a terminal.
openfortivpn works, but it asks for sudo every time, keeps a terminal open per client and tells you about a drop only when something breaks. TunnelYard does the same job in a window.
Before
Terminal · bash
$ sudo openfortivpn -c client.conf
INFO: Connected to gateway.
INFO: Authenticated.
ERROR: pppd: The link was terminated.
$ sudo openfortivpn -c client.conf
_
- sudo and a password on every connection
- One terminal open for each client
- You find out about a drop when a request fails
With TunnelYard
AC
ConnectedAcme HQvpn.acme.example
Sign inGateway accepted
Set upRoutes and DNS
WorkTunnel ready
StatusConnected
Uptime12m 48s
Tunnels2 connected
- One click to connect
- Several tunnels side by side
- A notification when one drops, and automatic reconnect
What it does
Made for people
on many networks.
One client or twenty: every profile sits in the same list, connects with one click and tells you when something changes.
Several tunnelsEvery client.
Every client.
At the same time.
Each profile runs its own tunnel. Connect work, the lab and a client VPN together and see the state of each one in the same window.
A form. The same .conf.
Create, edit or import openfortivpn .conf files. They stay in /etc/openfortivpn and still work without TunnelYard.
Know when it connects. And when it drops.
Desktop notifications and a live console, so you never have to watch a terminal.
Close the window.
The tunnels stay up.
Control every connection from the tray, and open TunnelYard at login if you want.
English or Portuguese. Light or dark.
Pick the language and theme, or let TunnelYard follow your system.
Least privilege
The window never runs as root.
TunnelYard keeps the interface and the privileged work apart. Only the step that starts a tunnel needs administrator rights, and your system asks for them through PolicyKit.
Read how it works in the code01
You click Connect
The app prepares only the profile you picked.
02
Your system asks
PolicyKit asks for permission, then a small helper starts openfortivpn.
03
The tunnel runs on its own
Each tunnel is a separate process, so one failing never takes the others down.
Performance notes
Every MiB,
on the record.
One measurement on one machine, reported in full, including what it does not prove.
Linux x64 · v2.6.0 debug build · Sep 08, 2026App with 2 tunnels connected
115.4MiB
Average resident memoryRSS · 60 samples, one per second
Where the memory goes
- Interface
- 86.3 MiB 74.8%
- VPN processes
- 29.1 MiB 25.2%
The TunnelYard window (Rust and GPUI)
Two openfortivpn and two pppd
Change over the minute
0.25 MiBThe total change across all 60 samples. Memory stayed flat the whole time, so a chart would just be a straight line.
The numbers come with context.
So does the method.
How we measured
Ubuntu 26.04.1 LTS, x86_64, development build 2.6.0, measured on Sep 08, 2026: 60 readings of VmRSS from /proc/PID/status, one second apart. Interface is the app window. VPN processes is the sum of two openfortivpn and two pppd.
We also measured a freshly opened app with no tunnels at 241.9 MiB. We leave that number out of the comparison on purpose: it was a different process, running for a different time, with a different screen open. The difference between the two says nothing about what connecting costs.
Adding RSS values can count shared memory more than once. GPU, kernel, shells and desktop services are not included. No passwords were read and the existing connections were left alone. Other machines and release builds will differ.
One command
Paste it in a terminal.
It does the rest.
The script checks your processor and package manager, then installs the matching package from GitHub. If TunnelYard is open with tunnels connected, it asks before disconnecting them and restarts the app when it is done.
curl -fsSL https://tunnelyard.lucascavalheri.com.br/install.sh | bashNeeds root or sudo. Works on x86_64 and ARM64 with apt, dnf, yum, zypper, pacman or apk, and falls back to the portable archive.
Version 3.0.9
Pick your Linux.
Choose your processor first, then your distro. A package for the wrong processor will not open.
Your processor
v3.0.9A package built for the other processor will not run on this machine.
Your distro
Debian and Ubuntu · .deb
Fedora, RHEL and openSUSE · .rpm
Arch Linux · pacman
Alpine · apk
Gentoo, Void, NixOS · portable
Choose your processor, then your distro.
The file downloads straight from GitHub.
Debian and Ubuntu use .deb. Fedora, RHEL and openSUSE use .rpm. Arch uses a pacman package. Alpine uses .apk (needs gcompat). Gentoo, Void, NixOS and anything else use the portable archive.See every file and instruction.