Skip to main content

​
Why VPN profiles?

By default, Pentest-Tools.com scans targets over the public internet. VPN profiles let you scan internal networks, private infrastructure, and resources not exposed to the internet. VPN profiles can be shared with team members so your whole team can run scans through the same VPN connection. See Sharing VPN profiles for details.
VPN profiles require the Internal network scanning add-on. Learn more about add-ons.

​
How it works

1

Create a VPN profile

Create a new VPN profile in Settings > VPN Profiles.
2

Deploy an agent

Install a VPN agent in your internal network using VM, Docker, or cloud deployment.
3

Establish connection

The agent creates a secure outbound tunnel to the platform.
4

Run scans

Scans route through the agent to reach internal targets.

​
Deployment options

Choose the deployment method that fits your environment:

Virtual machine

Pre-configured appliance for VMware, Hyper-V, VirtualBox, or ESXi.

Docker agent

Containerized agent for Docker environments.

Cloud deployment

Deploy in AWS or Azure cloud environments.

Custom OpenVPN

Use your own OpenVPN server configuration.

​
Use cases

The VPN agent needs outbound internet access (TCP port 22 to vpn2.pentest-tools.com) to function. It cannot operate in fully air-gapped networks.

​
Network requirements

The VPN agent requires outbound connectivity only:
No inbound ports need to be opened. The agent initiates all connections outbound.

​
Security considerations

  • The agent only communicates outbound to Pentest-Tools.com (TCP port 22)
  • Traffic is encrypted via SSH tunnel
  • Each scan establishes its own VPN tunnel
  • You can use firewall rules to limit which internal subnets the agent can reach, so it only accesses the targets you intend to scan

​
VPN profile settings

When creating a VPN profile, you can configure: For Custom OpenVPN profiles, you also configure:
  • OVPN file: Your OpenVPN configuration file
  • User authentication: Optional username and password if your OpenVPN server requires authentication

​
Monitoring VPN profiles

​
Agent status (Online/Offline)

For VPN Agent deployments only, the platform shows real-time agent status: The status updates in real time when an agent connects or disconnects.
Online/Offline status only applies to VPN Agent deployments (VM, Docker, Cloud). Custom OpenVPN profiles do not show online/offline status because the platform connects to your OpenVPN server on-demand when running scans.

​
Test connection

Use the Test connection button to verify your VPN profile configuration. This feature works for both VPN Agents and Custom OpenVPN profiles.
  1. Go to Settings > VPN Profiles
  2. Select a VPN profile or click on its name to open the details panel
  3. Click Test connection
  4. Wait for the test to complete
The test attempts to establish a VPN tunnel and reports the result.

​
Connection status

After running a connection test, the profile shows one of these statuses:

​
Connection logs

When you click on a VPN profile, the details panel shows Connection logs. These logs contain output from the last connection test and are helpful for troubleshooting failed connections.
If the connection logs show “No logs. Run a connection test first.”, run a test to populate the logs.

​
VPN profile details

Click on a VPN profile name to open the details panel, which shows:
  • VPN Profile UUID: The unique identifier used to configure agents
  • Workspaces: Associated workspaces
  • Network Settings: DNS servers and VPN gateway (for Custom OpenVPN)
  • Max parallel scans: Parallel scan limit
  • Connection logs: Output from the last connection test
From the details panel, you can also:
  • Test the connection
  • Deploy the agent (for VPN Agent profiles)
  • Edit or delete the profile

​
Sharing VPN profiles

You can share VPN profiles with team members. Shared profiles let them run scans against your internal networks.

​
Permission levels

​
How to share VPN profiles

  1. Go to Settings > Team
  2. Select the team members you want to configure sharing for
  3. Click Share
  4. Set the VPN Profiles permission level
  5. Click Save
Shared profiles appear in your team members’ VPN profile list when they run scans.
Use View permission so team members can run internal scans without accidentally modifying the VPN configuration.
For more on team management and sharing, see Teams and roles.

​
Resource requirements