Connect with the Witina VPN app

To connect anywhere, a policy has to let one of your teams in. If you don’t see any sites, ask an administrator; see Policies.

Install the app

Download it from VPN devices in your profile (open the menu at the top right and choose My Profile), or from VPN → Connect before you’ve connected an app. The download for the computer you’re on comes first. If your browser doesn’t say which Linux it’s on, both Linux packages come first: choose yours.

Windows 10 or later, 64-bit. Run the installer, and approve it when Windows asks for an administrator. If Windows says the installer is from an unknown publisher, choose More info, then Run anyway.
macOS 11 or later, on Apple silicon or Intel. Witina shows a command to paste into Terminal, which downloads the package and installs it, asking for your password. You can download the package in the browser instead, but macOS refuses to open it at first: in System Settings, under Privacy & Security, choose Open Anyway. To remove the app later, run sudo "/Library/Application Support/Witina VPN/uninstall" in Terminal.
Ubuntu 24.04 or later, 64-bit: the Ubuntu and Debian download. From the folder the .deb is in, run sudo apt install ./ followed by its file name.
Fedora 40 or later, or RHEL 10 and its rebuilds, 64-bit: the Fedora and RHEL download. On RHEL and its rebuilds, turn on EPEL first. From the folder the .rpm is in, run sudo dnf install ./ followed by its file name.

On Linux and macOS you’re asked for your password at install, not when you connect.

Connect the app to your account

Open Witina VPN. It runs in the tray on Windows, in the menu bar on macOS, and in the top bar on Linux, and opens its window. When it starts, it opens a link in your browser, and its window shows the same code, such as ABCD-EFGH.
In the browser, check that the code matches the app’s. Only continue if your own app opened the page: don’t use a Witina VPN link anyone else gave you.
Choose Connect as for the account the app should connect as. The page lists every account this browser is signed in to, and the app can reach the sites that account’s policies allow.

The connection lasts until you quit the app. The next time you open it, you connect it again the same way. If a link has run out, choose Open the link in the app’s window for a new one.

If the page shows a warning

Witina compares the browser’s address and operating system with the app’s. If they don’t match, the page says This page may not have been opened by your own app, and what it found. If someone sent you the link, close the page: turning a site on would connect their computer, as you.

A mismatch can be fine, for example behind a proxy or a browser VPN. To continue, tick I opened this page from my own Witina VPN app.

Turn sites on and off

The page lists each site you can connect to, by organization and then by customer.

To connect, turn on the site’s switch. It shows Turning on…, then Connecting… and Connected, each with the time left. You can have several sites on at once, in more than one organization.
Extend gives the session its full length again, from now.
To disconnect, turn the switch off, or choose Turn off next to the site in the app’s window.

A site can’t be turned on when the VPN is off there, or when none of its gateways can take a session right now; the page says which.

To come back to these switches later, go to VPN → Connect in Witina, or choose Open Witina VPN in the app.

The app’s window lists the sites that are on, the gateway each is connected through, and when it ends. Fifteen minutes and again two minutes before a session ends, the window warns you; extend it in Witina.

When a site’s addresses clash with your network

If a site uses the same addresses as the network your computer is on, those addresses can’t go through the tunnel. You reach them by their alias instead, and the app’s window shows both, for example “192.168.1.0/24: on this network, only as 100.96.1.0/24”. Names in the site’s DNS domains resolve to the alias, so connecting by name works without changing anything. See Overlapping addresses.

When you change networks

The app follows your computer onto a new network: Wi-Fi to a phone hotspot, docking, waking from sleep. Your sites stay on, and traffic resumes within a few seconds.

When a site can’t connect

If no direct path can be made to the site, the app shows an error saying the connection needs Witina’s relay, which isn’t available yet. It can happen on phone hotspots and some carrier networks; try another network. See When there’s no direct path.

Quit, disconnect, and revoke

Quit Witina VPN, in the tray menu, or Quit, ending your sessions, in the window, turns every site off and disconnects the app. Closing the window keeps the app running in the tray or menu bar.
On GNOME, the top-bar icon needs the AppIndicator extension. Ubuntu has it turned on. The Fedora and RHEL package installs it with the app; turn it on in the Extensions app. Without it, closing the window minimizes the app instead.
Connected apps, on the VPN devices page, lists the apps connected as you right now. Disconnect ends an app’s sessions; using it again means opening the app and its link again. Disconnect any you don’t recognize.
Your devices, on the same page, lists the computers you’ve used the VPN from. Revoke ends a computer’s sessions, and it can no longer connect.

Updates

The app keeps itself up to date.

Windows and macOS. When the app isn’t connected, it installs an update in the background. While it’s connected, it waits: the tray or menu bar offers Restart Witina VPN to finish updating, and the window Restart Witina VPN. Restarting turns your sites off; turn them on again in Witina. If you quit instead, the update installs then.
Ubuntu. Installing the app adds Witina’s package repository, and Ubuntu’s automatic updates install a new version within a day.
Fedora and RHEL. Installing the app adds Witina’s package repository, and the app checks it soon after the computer starts and every six hours.

On Linux, an update doesn’t interrupt a running app: it offers the same restart when you’re ready.

What the app needs from your network

HTTPS (TCP 443) to app.witinaai.com, where it connects to your account, and to downloads.witinaai.com, for updates.
Outbound UDP to the STUN servers, stun.cloudflare.com on port 3478 and stun.l.google.com on port 19302, and to the sites’ gateways.
On Linux, names in a site’s DNS domains need systemd-resolved or NetworkManager to manage the computer’s DNS. Without either, the app skips the domains, and you connect to the site’s devices by address.