Get ForestVPN

One universal app covers all three. It is not on the App Store today: the listing under this name currently serves an older build, and this page carries the link the day the update replaces it — not before.

Same universal listing as iPhone and iPad — no separate purchase. There is no public TestFlight link and no notarized direct download yet; the current build pipeline uploads to TestFlight for internal testers only. This section gains a link the day either one opens up.

Phone, tablet and Android TV share one VpnService implementation, in development in this repo. It is not published, there is no beta and no waiting list — this page updates the day a build ships.

forestvpn-quantum — the same core, packaged for a machine with no App Store. It installs /usr/bin/fv: a daemon and a CLI, no graphical front end on Linux yet.

1. 01

   Add the repository

   apt.fvpn.net — signed with the same archive key every exit node trusts. apt refuses an unsigned repo, which is the point.

2. 02

   Install the package

   apt install forestvpn-quantum pulls fv plus the systemd units that run it.

3. 03

   Run it

   fv run connects, fv show prints the same eight-state readout the phone gets, fv diag explains a bad one.

# /etc/apt/sources.list.d/forestvpn.sources
Types: deb
URIs: https://apt.fvpn.net
Suites: stable
Components: main
Signed-By: /usr/share/keyrings/forestvpn-archive-keyring.gpg

apt update && apt install forestvpn-quantum

The repository is what buys you apt upgrade afterwards, rather than checking back for a new .deb by hand. It's the same one the exit fleet itself updates from.

The Tauri UI and its privileged tunnel service are in development. No signed installer exists to link to yet — an unsigned one would just trip Defender and teach people to click through that warning, which is worse than no download.

A RouterOS container, verified on real hardware — a MikroTik cAP ax pulled the image, registered, printed a pairing code, and connected. It holds its own machine key and asks the control plane for an exit the same way the phone does.

1. 01

   Give the container its own address

   Three lines in RouterOS's terminal — a /30 that exists only between the container and the router, nothing to hunt for on your LAN.

2. 02

   Add and start the container

   Pinned image, not :latest — a router you are not standing in front of should never silently swap what it is running.

3. 03

   Read the pairing code

   It prints to /log before the container has any network reachability at all. Open the ForestVPN app, already signed in with your account number, and enter the code.

4. 04

   Pick the exit from your phone

   The router serves its own status page on the address you just gave it — open it from a phone on the same network and tap a location. That is the one thing a screenless box cannot do for itself.

The load-bearing three lines

/interface/veth/add name=veth-fvpn address=172.31.254.2/30 gateway=172.31.254.1
/ip/address/add address=172.31.254.1/30 interface=veth-fvpn
/interface/list/member/add list=LAN interface=veth-fvpn
/container/mounts/add list=fvpn-state src=/forestvpn dst=/etc/forestvpn mode=rw
/container/add remote-image=suquant/fvpn:0.3.6 interface=veth-fvpn root-dir=/fvpn \
    mountlists=fvpn-state entrypoint=/mikrotik.sh privileged=yes logging=yes \
    start-on-boot=yes dns=172.31.254.1 name=fvpn
/container/start [find name="fvpn"]

Free tier

2 GB per connection, 5 connections a day. No card, nothing to cancel.

Paying is optional

One plan, three billing rungs, bought through Apple or the web. We never see a card number either way.

Sign-in is a number

A 32-character account number, generated at purchase — no email, no password, and no way for us to recover it if you lose it.

Questions first?

Help, or write to support@fvpn.net.

Open source inside

The tunnel core's license, reproduced in full inside the Linux package.