Most companies pick one VPN product, and most people end up needing three:
the employer's AnyConnect, a client's FortiGate, a GlobalProtect portal and a
home OpenVPN server, each with its own heavy client, tray icon and update
nag. Molehill replaces all of them with one small app.
It is the Windows sibling of
omarchy-plugin-vpngui
and shares its look and its sign-in logic: Tokyo Night colours, monospace,
flat and square, nothing in the way.
What it does
- All your VPNs side by side. Every connection has its own switch, and
several can be up at the same time. The header switch is the master switch:
off disconnects everything, on reconnects the last one.
- Sign-in where you are. Whatever the server asks for (username and
password, a group or gateway to choose, an SMS or authenticator code, a
FortiToken push, a second password) appears on the connection's card.
Molehill fills in what it knows and only asks for the rest.
- Browser SSO (SAML). Microsoft Entra, Okta, Google and the rest open in
your default browser and hand the result back to Molehill, for every
protocol that supports it.
- Remembered, safely. Passwords go to Windows Credential Manager (per user,
DPAPI). A password the server rejects is forgotten; a mistyped 2FA code is
not mistaken for a wrong password. The group or gateway you pick is
remembered for next time.
- Untrusted certificates, handled. If Windows doesn't trust the server's
certificate, Molehill shows its fingerprint and asks once; after that the
connection is pinned to exactly that certificate.
- Client certificates. For servers that want a certificate from your
Windows store along with the password, pick it in the connection's editor;
Molehill signs in as you, so Windows lets it use your certificate.
- Keeps itself up to date. When a new Molehill is released, you get a
Windows notification and an Update button; the installer is downloaded,
checked against its published SHA-256 and run for you.
- No prerequisites to hunt for. OpenVPN and OpenConnect are downloaded,
verified and installed by Molehill. It checks for new versions twice a day
and offers the update in the app.
- Out of the way. A tray icon that changes colour with the state (blue
idle, amber connecting, mint for one VPN up, violet for several, coral when
one failed), a matching dot on the taskbar button, its own tray menu to flip
tunnels, and closing the window keeps the tunnels up. Live traffic counters,
connected time and a log per tunnel.
- Yours to arrange. Drag connections into the order you want, resize the
window's height, and it opens where you left it. Tokyo Night dark or
Tokyo Night Day light, following Windows unless you pick one.
Supported VPNs
| VPN | Engine | Sign-in |
|---|
| OpenVPN | OpenVPN 2.6 (official MSI, DCO / TAP drivers) | A .ovpn file, a profile fetched from OpenVPN Access Server with your username and password, or a manual setup (address, port, UDP/TCP, CA, tls-auth / tls-crypt). Username & password, certificates, private key passphrase, static and dynamic challenges (OTP), browser SSO (WEB_AUTH, OPEN_URL, CR_TEXT) |
| Cisco AnyConnect / ocserv | OpenConnect | Whatever form the server sends: group list, username, password, second password / OTP, SMS or Microsoft Authenticator codes. Client certificates from the Windows store. Browser SSO. Certificate pinning |
| Fortinet FortiGate | OpenConnect | Username & password, realm, 2FA codes (SMS, email, FortiToken) or FortiToken push. Browser SSO the FortiClient way (redirect to 127.0.0.1:8020). Certificate pinning |
| Palo Alto GlobalProtect | OpenConnect | Portal, then gateway (chosen for you when there's one, or the one you picked last time). Username & password, 2FA challenges. Browser SSO in your default browser, like gpauth. Certificate pinning |
WireGuard, shown in the artwork, is planned.
Install
- Download
molehill-setup-<version>.exe from
Releases and run it.
It installs the app and the Molehill service.
- Open Molehill and add a connection with + New. If the engine for that
protocol is missing, the Components page offers to install it.
Requires Windows 10 or 11, 64-bit.
How it works
molehill.exe (you) molehill-service.exe (LocalSystem)
┌───────────────────────┐ named pipe ┌───────────────────────────────────────┐
│ Slint UI + tray │ ◄────────────► │ tunnel manager │
│ profiles (%APPDATA%) │ JSON lines │ ├─ openvpn.exe ◄─ management iface │
│ Credential Manager │ │ ├─ oc-auth helper (libopenconnect) │
│ browser SSO handoff │ │ │ └─ openconnect.exe + vpnc-script│
└───────────────────────┘ │ └─ Fortinet / GlobalProtect SSO │
│ component installer (verified) │
└───────────────────────────────────────┘
- The app runs as you. It keeps your profiles in
%APPDATA%\Molehill, your
saved passwords in Credential Manager, and opens the browser for SSO.
- The service runs as LocalSystem, because creating tunnels, routes and DNS
needs it. It never shows UI.
- OpenVPN is driven through its management interface, so credentials
never touch the disk.
- OpenConnect protocols sign in through a small helper process that loads
libopenconnect and turns every server form, certificate question and
browser step into a prompt in the app. openconnect.exe then runs the
tunnel with the session cookie, pinned to the certificate that was checked.
- IPC is the pipe
\\.\pipe\molehill, local only, open to SYSTEM,
Administrators and interactive users.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
