How can I use ZScaler to access protected websites via Ubuntu without a dedicated Ubuntu client?

3 Answers 3


My company decided to drop our VPN for ZScaler and being the only person running Linux at my company I was left behind because ZScaler doesn't have a native Linux client.

Let me start by saying that this workaround is extremely labyrinthine and equally fragile. It requires two full computers which makes it both expensive and impossible to do on the go so this is not a solution for laptops and remote / traveling employees. For the second computer I recommend picking up an old used computer on eBay to use as the dedicated Windows 10 machine. Otherwise you can repurpose almost any old laptop laying around. Anything with WiFi and an Ethernet port will work.

Additionally, I hope that the product team at ZScaler sees the fragility of this workaround (a hack really) and is inspired to create a dedicated Linux client for us diehard Linux guys who just can't go back to macOS once we've switched.

Here's what you're going to need for this workaround:

  • A windows 10 laptop fully updated with WiFi and Ethernet capabilities
  • The ZScaler client for Windows 10
  • A short Ethernet cable for connecting your Linux and Windows 10 machines
  • A long Ethernet cable for connecting your Linux machine to the Internet
  • A USB->Ethernet adapter for giving your Linux desktop a second Ethernet connection

Step 1: Connecting to ZScaler on Windows 10

Install the ZScaler client for Windows 10. Login with your credentials and verify you can access internal and/or ZScaler protected websites as well as external websites and the broader Internet.

Connect and verify ZScaler works on Windows 10

Step 2: Verify all the necessary connections in Windows 10

In order for this to work your Windows 10 computer will need access to the outside internet (WiFi in this example), and the ZScaler adapter, and a local Ethernet connection to share ZScaler over. The below picture shows all of this.

Verify Windows 10 Connections

Step 3: Prepare your local Ethernet connection

Part of the magic of this workaround is directly connecting your Windows 10 machine to your Linux machine via Ethernet and creating a private network between the two. In order to do this, you'll need to enter the properties of the local Ethernet connection's adapter and adjust the IPV4 settings to set a static IP address (very important) and also a subnet mask. I've chosen and respectively and it works great. Any valid internal IP address and subnet mask combination should work fine in theory.

Configure local Ethernet connection

Step 4: Sharing the ZScaler connection

This is one of the critical parts of the puzzle. Your Linux machine is going to get access to ZScaler via Windows 10 connection sharing. Right click on the ZScaler connection once it's connected and go to 'Properties'.

Open ZScaler Properties

Step 5: Share your ZScaler adapter to your Linux machine

To do this, make sure your two computers are connected directly via Ethernet to Ethernet. It should be Linux <- Ethernet -> Windows 10. Then, go to the Sharing tab for the ZScaler adapter properties and share the ZScaler adapter with the Ethernet adapter which bridges your Linux machine to your Windows 10 machine.

Share ZScaler to your Ethernet Adapter

Step 6: Verify ZScaler access on Linux

By now your Linux computer should be connected directly to your Windows 10 Machine and you should be able to resolve your internal website(s) on your Linux machine and nothing else. You should have no internet access. If you do, unplug your adapter(s) that give you internet connection. This is an extremely important step. Verify you can only access internal ZScaler-specific targets. If you're still having trouble with this step then try rebooting everything and starting over. Also, double check your static IP configuration on the Windows 10 machine as this doesn't tend to stick between reboots.

Verify ZScaler connection on Linux

Step 7: Get internet access

In order to get Internet access you'll now need to use your USB->Ethernet adapter and plug it into your Linux machine. You should see services like Slack auto-login once your second Ethernet connection resolves and connects.

Step 8: Restore access to ZScaler-protected websites

Because plugging in a new internet connection changes your DNS and internet settings configuration at the Linux adapter level you need to restore access to ZScaler-protected assets via IP Tables in Linux. For this you need to know the IP address range of your protected assets, the static IP of your Windows 10 machine, and the device name itself for your internal private connection between Linux and Windows 10. For myself and my company the commands are:

  • sudo ip route add via dev eno1
  • sudo ip route add via dev eno1

Where eno1 is the name of the network adapter that is directly connecting Windows 10 to Linux and is the static IP address you configured in Windows 10 and and are the CIDR ranges for your ZScaler protected assets. You can find the name of the correct adapter using to route your ZScaler traffic through using ifconfig on your Linux machine and substitute in your device hardware name for eno1.

Step 9: Enable access to future ZScaler-protected websites

Right now you can only access websites that you've already requested from ZScaler before plugging in your internet connection. This is a DNS issue. In order to fix this, you need to set the Windows 10 machine as your default DNS server so that when you request access to internal websites by name internal.mycompany.com then ZScaler can be used to resolve those hostnames. Once the hostname is resolved and the IP address shows a valid internal range you configured previously via IPTables then the traffic should be routed to the eno1 or equivalent adapter and then to ZScaler to load. You should see two wired connections now in Linux when you're done.

Double wired connection settings

Go ahead and edit the 'PCI Ethernet Connected' connection because that's the one we get internet from via our USB->Ethernet adapter.

Now we need the static IP address that we chose for our Windows 10 machine on the private network that exists between Linux <-> Windows 10. This is why setting a static IP address is important. We want to hard code this IP address as our DNS server.

Update your DNS server

And that's it! And this is how it works. All DNS requests are sent to ZScaler due to the DNS entry when configuring your network adapter. When a public IP is returned, your regular USB Ethernet connection resolves it successfully. When a private IP is returned, the IPTables forward the request to the adapter you specified when you executed sudo ip route add.... This allows the Windows 10 / ZScaler machine to load the website's content and send it back to you via Windows 10 connection sharing.

This is essentially a split connection where all DNS requests are handled by ZScaler (since it is the only one who can resolve and load internal hostnames) but public content is loaded via your Linux USB Ethernet adapter and private content is loaded via your Ethernet<->Ethernet shared connection to Windows 10.

What breaks this 'workaround'?

  • Any reboot to the Windows 10 machine
  • Power outage. See above.
  • Changes in network topography on the Windows 10 side causing a new network / internet connection
  • Changes in DHCP lease timing / renewing

What is sub-optimal about this workaround?

  • All DNS requests go through the ZScaler machine so your once hyper-fast wired connection is now as slow as WiFi for DNS requests at least.
  • You can never turn off your W10 computer ever again otherwise you must perform this ritual every time to get your internet working again for both internal and external hosts.
  • It takes a lot of practice to get this setup working reliably on a day-to-day basis. It took me about two months to master the workflow and resolve issues quickly when they come up.

I'll finish by saying that this is an absolute last-resort and that any company looking to switch to ZScaler from a VPN solution should consider the lack of a dedicated Linux client and how that may or may not affect their engineers' ability to get work done.

  • Anyone know how to adapt this for WSL? I'm running Ubuntu in WSL but it's still not able to connect to secure sites.
    – Roger-123
    Commented Jan 12, 2021 at 21:27

Very good workaround, thanks!

Just to let you know that this solution is also working with a Windows VM (I am using libvirt/kvm https://libvirt.org/drvqemu.html). Also, I believe that you have no choice and is the default sharing IP (on Windows 10 at least).

Add a second virtual network adapter to your VM (do not configure the gateway):

  • NAT

And then on the linux host, add a local IP alias to communicate with the VM (adapt 'virbr0' with you virtual NIC adapter, it may differ if you are using another virtualization solution like virtualbox):

sudo ip a add dev virbr0

Verify that you are able to ping the windows VM on from the Linux host (you may have to accept ICMP on windows 10 firewall https://www.howtogeek.com/howto/windows-vista/allow-pings-icmp-echo-request-through-your-windows-vista-firewall/)


Finally, add the routes through the VM to reach distant corp networks (adapt to your needs):

sudo ip r add via
sudo ip r add via

If you know the corp DNS you can also configure a local resolver (unbound for instance) to use this DNS for some specific domains or subdomains.

  • This is very helpful! I'm running Ubuntu and have Windows 10 installed in a VM using VirtualBox but I'm not too confident with network changes on my Ubuntu host. If I apply these changes, can I easily disable them as well if I want to use my default network settings?
    – Subbeh
    Commented Mar 11, 2020 at 10:12
  • 1
    Hi @Subbeh! Those changes (ip command) will be cleared at next reboot. And you can also delete them changing 'add' by 'del' keyword. See 'man ip'.
    – Faustin
    Commented Mar 11, 2020 at 13:53
  • Thanks @faust, but I'm afraid this is all a bit too foreign to me and I'm running into a lot of issues. With the risk of sounding like a complete idiot, I created the adapter for Windows and assigned Now is installing libvirt enough for it to work with my vbox VM? Regarding adding routes - is this the part where I enter the addresses of the services I can only access through VPN? I'm trying to SSH into a machine with address Would I need to run sudo ip r add via to get it working? This gives me a routing error
    – Subbeh
    Commented Mar 12, 2020 at 4:22
  • Hi @Subbeh! I have improved my guide. Regarding Libvirt you don't need to install it, it's another virtualization solution but you have already one (virtualbox). If you are trying to ssh to then yes, the 'ip r' command is good. And you may restrict to only this IP (so without '/24').
    – Faustin
    Commented Mar 12, 2020 at 11:44
  • 1
    Sorry @Subbeh, I can't test further for you because I have no virtualbox plateform. From your pastebin, 'vboxnet0' may not be the right virtual nic, why is there not any other IP, what is the virtual LAN that your host use to communicate with your VM's, take a look at virtualbox.org/manual/ch06.html#network_nat_service... Also if you only need SSH, you can install OpenSSH server on your windows VM and use ProxyJump (man ssh), SSH A > B > C (where A=linux host, B=windows VM and C=corp host). Good luck!
    – Faustin
    Commented Mar 15, 2020 at 12:13

I also had the problem using Zscaler on my Ubuntu to access private company websites. Fortunately, I still have a private notebook with Windows 10. So I installed Zscaler on this private Windows 10 Notebook. Then I connected the Win-10 Notebook via Ethernet to the Internet. After that I created a Mobile Hotspot. After that i allowed other users in the Network to use the Ehternet Connection and As Home-Network-Connnection is set The Mobile-Hotspot-Connection. After that I was able to connect the Ubuntu via the Mobile Hotspot and i could access the private Company Network Sites. May this help someone.

  • Another great workaround. Nice one! Commented Apr 7, 2020 at 21:52
  • This solution is super easy and work great! Commented Sep 8, 2020 at 21:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .