3

I'm trying to connect to a business VPN (Cisco AnyConnect). I'm utilizing openconnect and a connection has been established. That connection is also seen by the ip add command. The default route according to ip route seems to be wlp5s0. How would I configure openconnect in such a way that rather than utilizing this route, it should select the VPN one? The issue I have is that my IP address won't change once I've connected to the VPN. I have tried the terminal openconnect version and the gnome GUI install for Cisco. Same problem with both.

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eno1: <NO-CARRIER,BROADCAST,MULTICAST,UP> mtu 1500 qdisc fq_codel state DOWN group default qlen 1000
    link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
3: wlp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether YY:YY:YY:YY:YY:YY brd ff:ff:ff:ff:ff:ff
    inet 192.111.111.111/24 brd 192.111.111.255 scope global dynamic noprefixroute wlp5s0
       valid_lft 86208sec preferred_lft 86208sec
    inet6 ffff::ffff:ffff:ffff:ffff/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever
4: vpn0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1300 qdisc fq_codel state UP group default qlen 500
    link/none 
    inet 192.111.11.111/22 brd 192.111.111.255 scope global noprefixroute vpn0
       valid_lft forever preferred_lft forever
    inet6 eeee::eeee:eeee:eeee:eeee/64 scope link stable-privacy 
       valid_lft forever preferred_lft forever

Not quite sure what's safe to share and not, so I just modified some of the entries.

This is the ip route entry

default via 192.168.1.1 dev wlp5s0 proto dhcp metric 600 
10.0.0.0/8 dev vpn0 scope link 
10.0.0.2 dev vpn0 scope link 
10.0.0.3 dev vpn0 scope link 
<office ip cidr>/23 dev vpn0 scope link 
<office ip> via 192.168.1.1 dev wlp5s0 src 192.168.1.17 
169.254.0.0/16 dev wlp5s0 scope link metric 1000 
172.16.0.0/12 dev vpn0 scope link 
<Company IP CIDR>/22 dev vpn0 scope link 
<Company IP CIDR>/24 dev vpn0 scope link 
192.168.0.0/16 dev vpn0 scope link 
192.168.1.0/24 dev wlp5s0 proto kernel scope link src 192.168.1.17 metric 600 
192.168.20.0/22 dev vpn0 scope link

I'm trying to reach 10.12.122.197 which should be within the same LAN as the VPN.

Running Ubuntu 19.10 by the way.

1
  • Showing the output of ip route would be helpful as well. Do any routes go through your VPN after you connect? The openconnect server does not automatically push a default route to your VPN client unless it is configured to do so. If you are unable to configure the openconnect server, you may have to change your default route manually after your client connects. Mar 11 '20 at 21:44
0

The required changes to achieve what you are after would depend on the configuration on the VPN server side. It may not be configured to pass traffic to external networks.

You can test this by adding a route entry on the client system:

# ip route add default dev vpn0

Then try a traceroute to an external net:

# traceroute 1.1.1.1

One way to push a route like this to the clients is to set up split-tunneling on the cisco device, specify a split-tunnel ACL and within that ACL add the appropriate rules. Those rules will be pushed as routes to the clients upon connecting.

If adding the route does not work, the configuration on the VPN server will require adjustment.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.