Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Split tunneling with openconnect - A guide on how to use openconnect to establish a vpn connection to an enterprise cisco anyconnect vpn endpoint with client side routing.

Introduction

The purpose of this short howto is to show you how to:

  • use openconnect [1] to connect to an enterprise cisco anyconnect endpoint
  • whilst minimizing the amount of traffic that your route through the vpn connection

Usually VPN administrators will puth the default route to the users, so that all user traffic is routed through the vpn connection. This is to address the various security concerns around compromised user computers bridging external internet traffic into the secure VPN network.

While the VPN administrator can push routes to the clients, the client can ignore these default routes and establish client side routing so that only the required A.B.C.D/E network is routed through the VPN. All other traffic will still use the clients default route and default outbound internet connection.

This is called split-tunneling VPN routing and it is the type of setup you'll have at the end of this small howto.

Setup on a linux operating system

installation

  • install openconnect on your operating system

openconnect binary kernel capabilities

  • the openconnect binary won't be allowed to create the tun0 tunnel without being granted some the root capability to administer networks - see man 7 capabilities for details
sudo setcap cap_net_admin+ep /usr/bin/openconnect
  • to check if this capability was added, run getcap
getcap -rv /usr/bin/openconnect
...
/usr/bin/openconnect = cap_net_admin+ep

install vpn-slice

By default openconnect comes with vpnc-script [3] which is a bash script that can be run, on the client side, to setup routing. While this can work perfectly fine it needs manual user interaction to modify this script whenever changes are needed.

A more automated way of adding/removing routing and other settings can be achieved using vpn-slice

  • [2] vpn-slice will aid with automatically adding and removing routes and adding and removing /etc/hosts entries.
  • I've used pip and virtualenv to create a separate python virtual environment for vpn-slice.
mkvirtualenv vpn-slice
pip3 install https://github.com/dlenski/vpn-slice/archive/master.zip

Establish vpn connection

Establish a vpn connection to the corporate network only routing the required subnet through the vpn tunnel. Replace all bits between < > with your vpn settings.

sudo openconnect <corporate-vpn-endpoint> \
     -m 1290 \
     -u <your-vpn-user> \
     --servercert sha256:<0446a7EXAMPLE8901278394> \
     -s 'vpn-slice <10.10.0.0/14>'
  • the first time when you connect, openconnect will print on your terminal the servercert shasum, on subsequent connections use this printend shasum as the value for --servercert
  • replace <10.10.0.0/14> with the subnet you want to route over the corporate vpn.

These are the routes before starting the vpn:

default via 10.1.1.1 dev wlp4s0 proto static metric 600
10.1.1.0/24 dev wlp4s0 proto kernel scope link src 10.1.1.50 metric 600
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1

These are the routes after connecting to the vpn. vpn-slice will only create routes for the vpn subnet and the vpn dns servers and the rest of your traffic goes out though your default route which hasn't changed after connecting to the vnp.

default via 10.1.1.1 dev wlp4s0 proto static metric 600
10.1.1.0/24 dev wlp4s0 proto kernel scope link src 10.1.1.50 metric 600
10.10.0.0/14 dev tun0 scope link
10.10.0.0/14 dev tun0 scope link metric 6
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1
180.10.34.165 dev tun0 scope link
180.10.34.165 dev tun0 scope link metric 6

Resources

@rocarvaj

This comment has been minimized.

Copy link

@rocarvaj rocarvaj commented Apr 15, 2020

Thanks for this, although I didn't have to use it. First I checked if all traffic was routed through the VPN connection and it wasn't the case. For anyone out there reading this, you can check by using the answers here: https://serverfault.com/q/480060.

@stefancocora

This comment has been minimized.

Copy link
Owner Author

@stefancocora stefancocora commented Apr 17, 2020

Great that this gist was of help for you!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.