When working to install the Firefox official SSL VPN Extender interface in the question VPN SSL Network Extender in Firefox, I found out and solved some more pieces of the puzzle of this question.
Apparently, whilst command line usage of
snx from checkpoint has been discontinued, the web based client as described in the linked post still works. However, there is a python command line client, that tries to replicate the Web+Java interface on top of the
snx client, and this post is about setting it up to work.
snxvp installed from
python pip does not work. There is an updated patched version on https://github.com/agnis-mateuss/snxvpn, that has some useful patches, including an option for ignoring unsigned and/or expired certificates, and more interestingly, being python2 and python3 compatible.
Furthermore, all the URLs on
snxconnect.py have to be changed from
sslvpn/ to ``.
So the step-by-step instructions are roughly:
- Firstly, installing the
If in the VPN, to get the installation file, do:
wget --no-check-certificate https://VPN_FW_HOSTNAME/SNX/INSTALL/snx_install.sh
Otherwise, you will have to get it from the web interface, as described in the linked answer.
For Debian, you might need:
sudo dpkg --add-architecture i386
sudo apt-get update
I had to install the following:
sudo apt-get install libstdc++5:i386 libx11-6:i386 libpam0g:i386
chmod a+rx snx_install.sh
You will have now a
/usr/bin/snx 32-bit client binary executable. Check if any dynamic libraries are missing with:
sudo ldd /usr/bin/snx
You can only proceed to the following points when all the dependencies are satisfied.
Not sure if you need to run first
snx -s CheckpointURLFQDN -u USER before using
snxconnect, for the signature VPN be saved at
- Now we have the
snxconnect python utility. Such program tries to emulate the web interface, and more interestingly, it does not need Java to authenticate.
So to install and setup
snxconnect, run as root:
apt-get -y install git make libxml2-dev libxslt1-dev zlib1g-dev
apt-get -y install python-pip
pip install pytz
git clone https://github.com/agnis-mateuss/snxvpn
git clone git://git.code.sf.net/p/sfreleasetools/code releasetools
Now, as for taking out the /sslvpn URL, some Checkpoint appliances need it, some do not. I am not still aware of why the difference. I need it, @WileyMarques does not.
sed -i "s/sslvpn\///g" snxconnect.py
. then do as root, for python3: (recommended)
apt-get install python3-pip python3-docutils python3-pip python3-libxml2 python3-dev python3-crypto python3-bs4
python3 setup.py install --prefix=/usr/local
. or instead, do as root, for python2:
apt-get install python-docutils python-libxml2 python-lxml python-dev python-bs4 python-beautifulsoup
sed -i "s/distutils.core/setuptools/g" setup.py
python setup.py install --prefix=/usr/local
After installing it, you can run as a non-privileged user:
/usr/local/bin/snxconnect -H CheckpointURLFQDN -U USER --skip-cert --save-cookies
If all went ok, it will ask for the password, and then display:
SNX connected, to leave VPN open, leave this running!
If you are having problems getting this message, and are instead getting several times in a row, the message: "Unexpected response, try again.", do the Firefox method, and Disconnect and logout properly, waiting a couple of minutes before trying the
snxconnect command again.
- The cookie(s) file will be created at ~/.snxcookies, after a successful usage.
After the VPN being established, you can check with
ip address or
ifconfig you have now a
$ ip addr show dev tunsnx
14: tunsnx: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
inet 10.x.x.x peer 10.x.x.x/32 scope global tunsnx
valid_lft forever preferred_lft forever
inet6 fe80::acfe:8fce:99a4:44b7/64 scope link stable-privacy
valid_lft forever preferred_lft forever
ip route will show you also new routes going through the
For closing/disconnecting the VPN, while you may stop/kill
snxconnect, the better and official way is issuing the command:
SNX - Disconnecting...
In addition, I also found out:
snxconnect seems to behave better when disconnecting the previous VPN connection and logging out in the official web interface if there is some strange problem (have to try doing
snx -d to see if it produces the same result);
- PYTHONHTTPSVERIFY=0 only affects the python2 version;
- if the web interface is doing an HTML redirect to a secondary CheckPoint location, pointing directly to that redirected hostname, holds better results;
- if the certificates of the firewalls are self-signed (they often are) the --skip-cert option has to be used, or authentication will fail;
- for not having so many problems re-authenticating, had to use --save-cookies to use authentication cookies, while the user is logged in in the remote VPN point (it has a timeout of x hours);
- as described in the last question, for the script to work, the option "When signing-in launch SSL Network Extender" has to be changed to "automatically";
- 7776/TCP in localhost has to be free, for
snx to own it, as
snxconnect talks with
snx using it;
- the hostname passed to
snx is handled as a virtual host, and as such you cannot use directly the VPN IP address;
- instaling a 32-bit architecture seems to be a requirement to run the
- you might choose to run as
python2 as a trade-off for less space, however as python2 is being phased out,
snxconnect in a near future might not support it;
- from using the web client interface, it is clear I need to patch/delete all
/sslvpn strings , as my URLs do not start with
/sslvpn. I would check your particular case. I have absolutely no idea whether the presence of that string in the code is due to an old version, would love some feedback;
snxconnect the CheckPoint hostname has to be the exact name the webinterface is showing you once authenticated in there, as it is a web virtual host. Otherwise, you won´t succeed on establishing the VPN;
- The first time
snx is used, a file with the signature of the VPN/Checkpoint server will be created at
- If you need to use OTP from the command line, you have to use
snx alone does not support it.