alle

A universal VPN client that manages multiple VPN connections with rule-based routing, with interfaces for human (Web UI and CLI) and programs (REST API and Docker image).

Supported

NordVPN

Proton VPN

Planned

ExpressVPN	Surfshark	CyberGhost	PIA	Windscribe
IPVanish	Mullvad	PureVPN	VyprVPN	HideMyAss
VPN Unlimited	PrivadoVPN	TorGuard	PrivateVPN	FastestVPN
IVPN	AirVPN	VPN.ac	VPNSecure.me	SlickVPN

See VPN provider research for setup archetypes, provider-specific constraints, and excluded providers.

Web UI

Why alle

For people

You already pay for a commercial VPN — but its official client connects to one location at a time. Switching countries means disconnecting, reconnecting, and breaking whatever was using the old exit. Two locations at once is not on offer.

alle keeps several exits live simultaneously, from one provider or mixed across providers. Different traffic leaves through different VPN servers, decided by alle's routing rules:

For programs

Every action the CLI performs is also a REST call, and each exit is a stable 127.0.0.1:<port> proxy. So another program can drive the whole lifecycle of many VPN connections — create, probe, rotate, retire — on its own schedule, with no human clicking a client. That is what makes proxy rotation across regions, and reaching geofenced resources from wherever they are served, something you can script.

It also ships as a container image (ziyudo/alle) so a compose stack can add it as one service and let sibling containers reach the internet through whichever exit the rules pick.

You may also have heard of gluetun or vopono — alle and gluetun and alle and vopono compare alle to each.

What alle does

alle runs multiple VPN exits side by side, each its own local HTTP+SOCKS proxy. One router entrypoint sends traffic by rule to an exit, straight out, or nowhere at all — see Rule-based routing. For a whole-machine VPN through those same rules there is an optional TUN mode (alle tun on, one-time privilege grant): CLI reference, runbook.

The runtime model — one sing-box process, state, ports, probes — is in How it works. What is supported today is in Current status.

For AI Coding Agents

alle for agents — copy-paste to your coding agent to teach them how to use alle. It carries the model, the facts that change how the code is written, and links it can fetch on demand.

Quick Start

For macOS + Linux: installs alle and its user-level login service

curl -LsSf https://github.com/zydo/alle/releases/latest/download/install.sh | sh

Then add a VPN provider (use NordVPN as example) and create a connection ("channel").

alle providers add nordvpn      # will ask you for NordVPN token
alle channels add nordvpn --country "United States"
alle start
alle channels ls                # prints each channel's local proxy port

Homebrew, uv, pipx, Docker, the checksum-verified manual install, and the uninstaller are all in Getting started; container deployments are in Docker.

Documentation

Using alle

• Getting started — install, quick start, provider setup, everyday commands, channel enable/disable.
• Rule-based routing — the router entrypoint: rulesets, first-match priority, kill-switch, built-in LAN bypass.
• Web UI — the browser dashboard (alle ui): pages, sign-in, remote access over SSH.
• CLI reference — every command, flag, and environment variable.

Automating alle

• alle for agents — the entry point to hand a coding agent: model, minimal call set, failure modes, progressive links.
• REST API — the /api/v1 contract: everything the CLI can do, over HTTP with Bearer auth. Loopback by default; opt-in network exposure for compose siblings. Machine-readable spec: openapi.yaml.
• Declarative setup and the bundle format — the whole setup (providers, channels, rules) as one YAML file: backup/restore, startup config, secret indirection.

Deploying alle

• Docker — image design, proxy hub, VPN gateway container (tun), trust boundaries.
• Docker Compose walkthrough — bundle authoring, secrets, managing alle from a sibling container, day-2 operations, troubleshooting.
• TUN runbook — whole-machine capture: privilege models per platform, verification, rollback.

Understanding alle

• How it works — the runtime model: one sing-box, state, ports, probes.
• Current status — supported providers and platforms, feature matrix, what is planned, and the non-goals.
• Security model — trust boundaries, credential handling, Web UI/API hardening, fail-closed routing.
• VPN provider research — which providers can be supported next, and why some can't.
• alle and gluetun — how the two differ, and how to choose between them.
• alle and vopono — request-level routing vs. per-process network-namespace isolation.

Security and privacy

See the Security model.

License

MIT