NetworkManager supports VPN connections for all popular VPN connections via plugins.
A VPN plugin consists of the editor dialog and a D-Bus service that manages the actual VPN connection.
Natively Supported by NetworkManager
| WireGuard | NetworkManager 1.16.0+ supports WireGuard natively and requires no plugin |
Plugin maintenance status
Some VPN plugins are no longer maintained at all and are used at your own risk. For an unmaintained plugin, nobody is reviewing contributions, fixing bugs or making releases; issues and merge requests go unanswered and known defects, including security issues, stay unfixed. Before deploying a plugin, check its README and recent commit history, and prefer an actively maintained alternative where one exists.
With the exception of NetworkManager-libreswan, every plugin below is a third-party project with its own maintainers, release schedule and bug tracker. Report problems with them to those projects rather than to NetworkManager.
VPN plugins
| NetworkManager-anyconnect | Wrapper around the proprietary Cisco AnyConnect client, which has to be installed and configured separately. NetworkManager-openconnect speaks the same protocol without it |
| NetworkManager-fortisslvpn (releases) | Fortinet SSLVPN compatible. End of life, unmaintained: upstream has had no maintainer since 2024 and no release since 1.4.0 in 2022. Use NetworkManager-openconnect instead, which covers the same older PPP-based Fortinet protocol |
| NetworkManager-iodine | Tunnel IP traffic via DNS using Iodine |
| NetworkManager-l2tp | L2TP compatible VPN plugin |
| NetworkManager-libreswan (releases) | IPsec IKEv1 VPN, Cisco compatible. Maintained by the NetworkManager maintainers |
| NetworkManager-openconnect (releases) | Cisco AnyConnect, Juniper, and Fortinet SSL VPN (experimental, older protocol only) |
| NetworkManager-openvpn (releases) | OpenVPN |
| NetworkManager-pptp (releases) | PPTP, Microsoft compatible. Unmaintained Independently of the plugin, the PPTP protocol itself is cryptographically broken and should not be used |
| NetworkManager-ssh | Connect using OpenSSH’s Tunnel capability |
| NetworkManager-sstp (releases) | SSTP compatible VPN plugin. Unmaintained |
| NetworkManager-strongswan | IKEv2 enables IPsec plugin with support for EAP, PSK and certificate authentication |
| NetworkManager-vpnc (releases) | IPsec VPN, Cisco compatible. Unmaintained NetworkManager-libreswan covers the same IKEv1 protocol family and is a possible migration target, but connection profiles have to be recreated and per-option parity has not been checked |
Plugin compatibility note
NetworkManager maintains backward compatibility with older plugin versions. That means that the plugin version 0.9.10 will work with later NetworkManager versions, such as 1.2.
For VPN plugins, the major-minor version indicates the minimal required NetworkManager version. It is therefore expected and correct that for certain NetworkManager versions there exists no matching VPN plugin version. For example, for NetworkManager-pptp might not exist a 1.4.0 version because the latest 1.2.x version is suitable and up-to-date to run against latest NetworkManager.