Scanning VPN Networks

If the daemon's host is connected to a VPN, the daemon can scan that network. Scanopy works with WireGuard, Tailscale, Headscale, OpenVPN, and any other VPN that creates a network interface on the host.

Setup

1. Connect the daemon's host to your VPN

Install and configure your VPN client on the machine running the daemon. Verify the VPN interface is up:

# You should see a VPN interface (e.g. wg0, tailscale0, tun0)
ip addr

2. Report the new interface to Scanopy

The daemon needs to detect the new VPN interface. Either:

• Restart the daemon — it reports interfaces on startup
• Run the discovery from Discover > Scans — the daemon re-scans its own interfaces and reports them to the server as part of each discovery run

3. Verify the VPN subnet appears

After the discovery completes, check Assets > Subnets. The VPN subnet should appear as an interfaced subnet for the daemon.

4. Configure scanning

• If your discovery has no specific subnets configured (the default), the VPN subnet is picked up and scanned automatically on the next run.
• If you've configured specific subnets, add the VPN subnet manually via Discover > Scans.

What to expect

A VPN tunnel interface has no MAC address, so the daemon scans it at Layer 3, as it does a routed subnet. It finds hosts by TCP probe, so it misses hosts with no open ports and collects no MAC addresses.

Multiple VPN networks

If the daemon's host is connected to multiple VPNs, each VPN interface is detected and its subnet is scanned. No additional configuration is needed beyond connecting the VPN client.