VPN Endpoint Prober
Enter a host you run and the VPN Endpoint Prober sends real WireGuard, OpenVPN, IKEv2 and TLS handshakes to it, then shows which ports answered, which stayed silent and which are closed, with the TLS certificate and who owns the address.
Sends real packets. Probe only hosts you run or have permission to test.
No host probed yet
Enter a host you are allowed to test and press Probe. Nothing is sent until you do. A silent host takes several seconds per probe.
Probes this session
Open a saved run without sending traffic. Use Probe again explicitly to repeat that run’s host and ports.How the prober works
The pwnsy VPN API resolves the host and refuses private, loopback, link-local, multicast and reserved addresses. It then sends five probes at the resolved address in parallel: a WireGuard handshake initiation over UDP, an OpenVPN hard reset over UDP and again over TCP on the same port, an IKEv2 SA_INIT over UDP, and a TLS handshake over TCP with the host name as SNI.
While the probes run, this page looks up the A, AAAA and CAA records for the name at dns.google. When the probes finish it asks the pwnsy API who owns the probed address (ASN, network name and country). Certificate fields are read without trust-chain validation. Matching subject and issuer does not verify a self-signature or identify a VPN.
Only the four ports you set are touched, with a handful of packets and no port sweep. A VPN on another port, behind port knocking or behind a CDN stays invisible. This browser remembers the last host that probed successfully so the field is filled next time; ports reset to the defaults on every visit. The session table is cleared when you leave the page.
How to read the result
Confirmed
The API classifies a protocol-specific reply as WireGuard, OpenVPN or IKEv2. TLS replies are counted separately: they do not identify a VPN. A reply does not establish product identity, vulnerability or an authenticated session.
Silent
Nothing answered. A hardened server and a firewall that drops packets look identical, so silence is never upgraded to a detection.
Closed
Closed means the API reports a refusal or port-unreachable response. Timeouts, silence, errors and unknown outcomes retain separate labels and counters. Missing or failed evidence marks the run incomplete.
Network ownership is enrichment only. A cloud or CDN provider name does not establish that the address is a proxy edge or reveal the origin. Expand a protocol row for its port state, round trip time and, on the TLS port, the certificate: version, cipher, ALPN, subject, issuer, days to expiry, whether it names the host, SAN list and serial.
Questions
Which hosts can I probe?
Only hosts you run or have permission to test. Each request probes one public host on four ports with a handful of packets. Private, loopback, link-local, multicast and reserved addresses are refused.
Why is a port silent instead of closed?
A WireGuard server and an OpenVPN server with tls-auth or tls-crypt drop packets from strangers without replying. A firewall that drops traffic looks the same from outside. Silent means nothing answered, so it never counts as a detection.
Why does a host behind Cloudflare show nothing?
A proxied hostname may reach an edge instead of your server. Network ownership alone cannot establish proxying; check your DNS and provider configuration. These probes cover one resolved address only.
Why is a self-signed certificate on 443 flagged?
The API reports matching certificate subject and issuer. This is not signature or trust-chain verification, and it does not identify a VPN. Review trust, expiry and hostname coverage separately.
Can I probe ports other than the defaults?
Yes. Open Ports to set each protocol's port, or pick a port set such as Stealth 443 or SSL-VPN 10443. A port written in a URL, such as host:8443, becomes the TLS port.
Probes run live from the pwnsy VPN API. Packet formats follow the WireGuard protocol, the OpenVPN wire protocol and RFC 7296. DNS via dns.google.