stratumctl vpn

Connect this machine to a VPC over Client VPN

stratumctl vpn [flags]

Aliases: client-vpn, cvpn

Connect this machine to a VPC’s Client VPN endpoint with a single command — no manual WireGuard configuration.

connect generates a local keypair (private key stays on this device), downloads the tunnel config (AllowedIPs are derived from your Cedar authorization rules), and brings the interface up with wg-quick. Use --print-config to emit the.conf instead (macOS/Windows/CI).

Subcommands

stratumctl vpn authorization-rules: Authorize which destinations Client VPN clients may reach
stratumctl vpn client-config: Download a Client VPN configuration for a device
stratumctl vpn client-endpoints: Create, inspect and delete Client VPN endpoints
stratumctl vpn connect: Connect this machine to a Client VPN endpoint
stratumctl vpn disconnect: Tear down a Client VPN tunnel
stratumctl vpn list: List Client VPN endpoints you can connect to
stratumctl vpn reresolve: Re-resolve the endpoint DNS and re-point the live tunnel (self-heal after a failover)
stratumctl vpn rotate-key: Rotate the endpoint’s WireGuard server key (disconnects all clients until they re-download)
stratumctl vpn routes: Manage routes pushed to Client VPN clients
stratumctl vpn setup: Create a ready-to-connect Client VPN endpoint in one command
stratumctl vpn status: Show local Client VPN tunnels
stratumctl vpn target-network-associations: Associate subnets with a Client VPN endpoint

stratumctl vpn authorization-rules

Authorize which destinations Client VPN clients may reach

stratumctl vpn authorization-rules [flags]

Aliases: authz, rules

Rules are enforced server-side: a connected client with no matching rule is denied every destination.

Subcommands

stratumctl vpn authorization-rules authorize: Authorize a destination CIDR for Client VPN clients
stratumctl vpn authorization-rules list: List authorization rules
stratumctl vpn authorization-rules revoke: Revoke an authorization rule

stratumctl vpn authorization-rules authorize

Authorize a destination CIDR for Client VPN clients

stratumctl vpn authorization-rules authorize <endpoint-id> --target-cidr <cidr> [flags]

Aliases: create, add

Examples

stratumctl vpn authorization-rules authorize cvpn-4k8m2x7q9a --target-cidr 10.0.0.0/16
stratumctl vpn authorization-rules authorize cvpn-4k8m2x7q9a --target-cidr 10.0.2.0/24 --description "database subnet"

Flags

Flag	Type	Description
`--description`	string	Human-readable note
`--principal`	string	Principal the rule applies to
`--principal-type`	string	Principal kind the rule applies to (server default when unset)
`--project`	string	Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--target-cidr`	string	Destination CIDR to authorize (required)

stratumctl vpn authorization-rules list

List authorization rules

stratumctl vpn authorization-rules list <endpoint-id> [flags]

Examples

stratumctl vpn authorization-rules list cvpn-4k8m2x7q9a
stratumctl vpn authorization-rules list cvpn-4k8m2x7q9a --output json

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn authorization-rules revoke

Revoke an authorization rule

stratumctl vpn authorization-rules revoke <endpoint-id> <rule-id> [flags]

Aliases: delete

Examples

stratumctl vpn authorization-rules revoke cvpn-4k8m2x7q9a cvpnau-7k2m9x4q8a

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn client-config

Download a Client VPN configuration for a device

stratumctl vpn client-config [flags]

Aliases: config

Subcommands

stratumctl vpn client-config download: Issue a WireGuard config for a device public key

stratumctl vpn client-config download

Issue a WireGuard config for a device public key

stratumctl vpn client-config download <endpoint-id> --public-key <base64> [flags]

Examples

stratumctl vpn client-config download cvpn-4k8m2x7q9a --public-key "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=" --device-name laptop

Flags

Flag	Type	Description
`--device-name`	string	Optional label for the enrolled device
`--project`	string	Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--public-key`	string	The device’s WireGuard PUBLIC key (required; the private key stays on the device)

stratumctl vpn client-endpoints

Create, inspect and delete Client VPN endpoints

stratumctl vpn client-endpoints [flags]

Aliases: endpoints, endpoint

Subcommands

stratumctl vpn client-endpoints create: Create a Client VPN endpoint
stratumctl vpn client-endpoints delete: Delete a Client VPN endpoint
stratumctl vpn client-endpoints get: Show one Client VPN endpoint

stratumctl vpn client-endpoints create

Create a Client VPN endpoint

stratumctl vpn client-endpoints create --vpc <vpc-id> --client-cidr <cidr> [flags]

Examples

stratumctl vpn client-endpoints create --vpc vpc-9k2m4x7q --client-cidr 198.18.0.0/22
stratumctl vpn client-endpoints create --vpc vpc-9k2m4x7q --client-cidr 198.18.0.0/22 --subnet subnet-3k8m2x7q --security-group sg-3f8d2k9x

Flags

Flag	Type	Description
`--client-cidr`	string	CIDR handed out to connecting clients (required)
`--project`	string	Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--security-group`	stringSlice	Security group governing who may reach the endpoint’s UDP/51820. Repeatable. Requires –subnet. Without one, ingress is all-or-nothing: associating a floating IP opens the endpoint to the internet
`--subnet`	stringSlice	Tenant subnet to place an interface in. Repeatable. Must be in –vpc, and required for –security-group: a security group binds to a port, so the endpoint needs an interface of its own
`--vpc`	string	VPC the endpoint terminates into (required)

stratumctl vpn client-endpoints delete

Delete a Client VPN endpoint

stratumctl vpn client-endpoints delete <endpoint-id> [flags]

Examples

stratumctl vpn client-endpoints delete cvpn-4k8m2x7q9a

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn client-endpoints get

Show one Client VPN endpoint

stratumctl vpn client-endpoints get <endpoint-id> [flags]

Examples

stratumctl vpn client-endpoints get cvpn-4k8m2x7q9a
stratumctl vpn client-endpoints get cvpn-4k8m2x7q9a --output json

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn connect

Connect this machine to a Client VPN endpoint

stratumctl vpn connect <endpoint-id> [flags]

Examples

stratumctl vpn connect cvpn-4k8m2x7q9a
stratumctl vpn connect cvpn-4k8m2x7q9a --print-config
stratumctl vpn connect cvpn-4k8m2x7q9a --qr

Flags

Flag	Type	Default	Description
`--device-name`	string		Label for this enrolled device (defaults to the hostname)
`--print-config`	bool	`false`	Print the WireGuard.conf to stdout instead of bringing the tunnel up (contains your private key)
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--qr`	bool	`false`	Print the.conf as a scannable QR for the WireGuard mobile app instead of bringing the tunnel up

stratumctl vpn disconnect

Tear down a Client VPN tunnel

stratumctl vpn disconnect <endpoint-id> [flags]

Examples

stratumctl vpn disconnect cvpn-4k8m2x7q9a
stratumctl vpn disconnect cvpn-4k8m2x7q9a --forget

Flags

Flag	Type	Default	Description
`--forget`	bool	`false`	Also revoke this device’s server-side enrollment and delete the local key
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn list

List Client VPN endpoints you can connect to

stratumctl vpn list [flags]

Examples

stratumctl vpn list
stratumctl vpn list --output json

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn reresolve

Re-resolve the endpoint DNS and re-point the live tunnel (self-heal after a failover)

stratumctl vpn reresolve <endpoint-id> [flags]

Examples

stratumctl vpn reresolve cvpn-4k8m2x7q9a

stratumctl vpn rotate-key

Rotate the endpoint’s WireGuard server key (disconnects all clients until they re-download)

stratumctl vpn rotate-key <endpoint-id> [flags]

Examples

stratumctl vpn rotate-key cvpn-4k8m2x7q9a --yes

Flags

Flag	Type	Default	Description
`--project`	string		project id (defaults to the configured project)
`--yes`	bool	`false`	confirm the disruptive rotation

stratumctl vpn routes

Manage routes pushed to Client VPN clients

stratumctl vpn routes [flags]

Associating a target network creates its own route automatically; add routes here for destinations beyond the associated subnet.

Subcommands

stratumctl vpn routes create: Add a route for Client VPN clients
stratumctl vpn routes delete: Delete a Client VPN route
stratumctl vpn routes list: List Client VPN routes

stratumctl vpn routes create

Add a route for Client VPN clients

stratumctl vpn routes create <endpoint-id> --destination <cidr> --target-subnet <subnet-id> [flags]

Examples

stratumctl vpn routes create cvpn-4k8m2x7q9a --destination 10.0.2.0/24 --target-subnet subnet-3k8m2x7q

Flags

Flag	Type	Description
`--destination`	string	Destination CIDR (required)
`--project`	string	Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--target-subnet`	string	Subnet the traffic exits through (required)

stratumctl vpn routes delete

Delete a Client VPN route

stratumctl vpn routes delete <endpoint-id> <route-id> [flags]

Examples

stratumctl vpn routes delete cvpn-4k8m2x7q9a cvpnrt-5k8m2x7q9a

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn routes list

List Client VPN routes

stratumctl vpn routes list <endpoint-id> [flags]

Examples

stratumctl vpn routes list cvpn-4k8m2x7q9a
stratumctl vpn routes list cvpn-4k8m2x7q9a --output json

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn setup

Create a ready-to-connect Client VPN endpoint in one command

stratumctl vpn setup --vpc <vpc-id> [flags]

Create + fully wire a Client VPN endpoint for a VPC in one step: create the endpoint, associate a subnet, authorize ingress, wait until it’s available, and (unless –no-public) allocate + attach a floating IP so it’s dial-able. Prints the vpn connect command to run next.

Examples

stratumctl vpn setup --vpc vpc-9k2m4x7q
stratumctl vpn setup --vpc vpc-9k2m4x7q --subnet subnet-3k8m2x7q --authorize 10.0.0.0/16 --no-public

Flags

Flag	Type	Default	Description
`--authorize`	string		CIDR clients may reach (default: the associated subnet’s CIDR; use the VPC CIDR for the whole VPC)
`--client-cidr`	string	`10.240.0.0/22`	Address pool handed to connecting clients (must not overlap the VPC/subnets)
`--no-public`	bool	`false`	Skip allocating + attaching a floating IP (endpoint won’t be dial-able until you associate one)
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--subnet`	string		Subnet to associate (default: the VPC’s first subnet)
`--vpc`	string		VPC ID to attach the endpoint to (required)

stratumctl vpn status

Show local Client VPN tunnels

stratumctl vpn status [flags]

Examples

stratumctl vpn status
stratumctl vpn status --output json

stratumctl vpn target-network-associations

Associate subnets with a Client VPN endpoint

stratumctl vpn target-network-associations [flags]

Aliases: associations, assoc

An endpoint with no target-network association terminates nothing — the association is what places the tunnel inside a subnet.

Subcommands

stratumctl vpn target-network-associations associate: Associate a subnet with a Client VPN endpoint
stratumctl vpn target-network-associations disassociate: Remove a target-network association
stratumctl vpn target-network-associations list: List a Client VPN endpoint’s target-network associations

stratumctl vpn target-network-associations associate

Associate a subnet with a Client VPN endpoint

stratumctl vpn target-network-associations associate <endpoint-id> --subnet <subnet-id> [flags]

Aliases: create

Examples

stratumctl vpn target-network-associations associate cvpn-4k8m2x7q9a --subnet subnet-3k8m2x7q

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)
`--subnet`	string		Subnet to associate (required)

stratumctl vpn target-network-associations disassociate

Remove a target-network association

stratumctl vpn target-network-associations disassociate <endpoint-id> <association-id> [flags]

Aliases: delete

Examples

stratumctl vpn target-network-associations disassociate cvpn-4k8m2x7q9a cvpnas-8k2m4x7q9a

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)

stratumctl vpn target-network-associations list

List a Client VPN endpoint’s target-network associations

stratumctl vpn target-network-associations list <endpoint-id> [flags]

Examples

stratumctl vpn target-network-associations list cvpn-4k8m2x7q9a
stratumctl vpn target-network-associations list cvpn-4k8m2x7q9a --output json

Flags

Flag	Type	Default	Description
`--project`	string		Project ID (defaults to STRATUM_PROJECT or profile project_id)