OpenConnect: Setting default routes

Question

I'm trying to use OpenConnect to connect to my company's Cisco VPN (AnyConnect)

The connection seems to work just fine, what I'm not understanding is how to set up routing. I'm doing this from the command line.

I use the default VPN script to connect like this:

openconnect -u MyUserName --script path_to_vpnc_script myvpngateway.example.com

I type in my password, and I'm connected fine, but my default route has changed to force all traffic down the VPN link, whereas I just want company traffic down the VPN link.

Are there some variables that I need to be putting into the vpnc-script? It's not very clear how this is done.

Aditya K · Accepted Answer · 2015-08-12T13:25:38.753

This answer is as follows:

Use the following bash wrapper script to call the vpnc-script. In the wrapper script, the routes to be used for the VPN connection can be specified via a ROUTES variable.

#!/bin/bash
#

# Routes that we want to be used by the VPN link
ROUTES="162.73.0.0/16"

# Helpers to create dotted-quad netmask strings.
MASKS[1]="128.0.0.0"
MASKS[2]="192.0.0.0"
MASKS[3]="224.0.0.0"
MASKS[4]="240.0.0.0"
MASKS[5]="248.0.0.0"
MASKS[6]="252.0.0.0"
MASKS[7]="254.0.0.0"
MASKS[8]="255.0.0.0"
MASKS[9]="255.128.0.0"
MASKS[10]="255.192.0.0"
MASKS[11]="255.224.0.0"
MASKS[12]="255.240.0.0"
MASKS[13]="255.248.0.0"
MASKS[14]="255.252.0.0"
MASKS[15]="255.254.0.0"
MASKS[16]="255.255.0.0"
MASKS[17]="255.255.128.0"
MASKS[18]="255.255.192.0"
MASKS[19]="255.255.224.0"
MASKS[20]="255.255.240.0"
MASKS[21]="255.255.248.0"
MASKS[22]="255.255.252.0"
MASKS[23]="255.255.254.0"
MASKS[24]="255.255.255.0"
MASKS[25]="255.255.255.128"
MASKS[26]="255.255.255.192"
MASKS[27]="255.255.255.224"
MASKS[28]="255.255.255.240"
MASKS[29]="255.255.255.248"
MASKS[30]="255.255.255.252"
MASKS[31]="255.255.255.254"

export CISCO_SPLIT_INC=0

# Create environment variables that vpnc-script uses to configure network
function addroute()
{
    local ROUTE="$1"
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_ADDR=${ROUTE%%/*}
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_MASKLEN=${ROUTE##*/}
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_MASK=${MASKS[${ROUTE##*/}]}
    export CISCO_SPLIT_INC=$((${CISCO_SPLIT_INC}+1))
}

# Old function for generating NetworkManager 0.8 GConf keys 
function translateroute ()
{
    local IPADDR="${1%%/*}"
    local MASKLEN="${1##*/}"
    local OCTET1="$(echo $IPADDR | cut -f1 -d.)"
    local OCTET2="$(echo $IPADDR | cut -f2 -d.)"
    local OCTET3="$(echo $IPADDR | cut -f3 -d.)"
    local OCTET4="$(echo $IPADDR | cut -f4 -d.)"

    local NUMADDR=$(($OCTET1*16581375 + $OCTET2*65536 + $OCTET3*256 + $OCTET4))
    local NUMADDR=$(($OCTET4*16581375 + $OCTET3*65536 + $OCTET2*256 + $OCTET1))
    if [ "$ROUTESKEY" = "" ]; then
        ROUTESKEY="$NUMADDR,$MASKLEN,0,0"
    else
        ROUTESKEY="$ROUTESKEY,$NUMADDR,$MASKLEN,0,0"
    fi
}

if [ "$reason" = "make-nm-config" ]; then
    echo "Put the following into the [ipv4] section in your NetworkManager config:"
    echo "method=auto"
    COUNT=1
    for r in $ROUTES; do
        echo "routes${COUNT}=${r%%/*};${r##*/};0.0.0.0;0;"
        COUNT=$(($COUNT+1))
    done
    exit 0
fi

for r in $ROUTES; do
    addroute $r
done

exec /etc/openconnect/vpnc-script

Then connect as follows:

openconnect -u myusername --script wrapper-script -b vpngateway.example.com

For anyone wondering how they can add multiple prefixes/routes to the ROUTES variable, you can do so by separating each entry with a single space. For example: ROUTES="162.73.0.0/16 162.74.0.0/16" — Elliot B., Apr 21 '16 at 01:15
On Debian 8, Ubuntu 16.04 and 17.04 default vpnc-script is located at `/usr/share/vpnc-scripts/vpnc-script`, so on these OS I was need to change last string of wrapper appropriately. Thank you for your solution! — Envek, Apr 25 '17 at 15:24
My work VPN is 10.0.x.x so I set up ROUTES = 10.0.0.0/16 and I am using ubuntu, so I set the exec to /usr/share/vpnc-scripts/vpnc-script -- but I cannot get to the outside world. Any Ideas? — mmaceachran, Sep 24 '18 at 23:23
How can I achieve the opposite, i.e., exclude some routes from the VPN? — HappyFace, Jul 08 '19 at 10:41

score 10 · Answer 2 · answered Jul 29 '19 at 12:42

I found that the best way to achieve split tunneling is to use vpn-slice. You basically can tell which routes you want and it will be your vpn script that does the routing, instead of what the configuration the server provides:

openconnect --script 'vpn-slice 10.0.0.0/16' -b vpngateway.example.com

Although by default it doesn't override your dns server to the one provided by the server, rather you have to manually list all domains and it would resolve and add them to your hosts file:

openconnect --script 'vpn-slice 10.0.0.0/16 host1' -b vpngateway.example.com

score 2 · Answer 3 · answered Feb 13 '19 at 21:14

Here's a script which does split-tunnelling on both IPv4 and IPv6 networks (based on the script Aditya K provided, which still allowed caused all IPv6 traffic to be routed to the VPN). Note also that the setting of CISCO_SPLIT_INC_${N}_MASK variables no longer appears to be needed):

#!/bin/bash
#

# Routes that we want to be used by the VPN link
ROUTES="162.73.0.0/16"
ROUTES6="1ef2:23e:5a4::0/48"

export CISCO_SPLIT_INC=0

# Create environment variables that vpnc-script uses to configure network
function addroute()
{
    local ROUTE="$1"
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_ADDR=${ROUTE%%/*}
    export CISCO_SPLIT_INC_${CISCO_SPLIT_INC}_MASKLEN=${ROUTE##*/}
    export CISCO_SPLIT_INC=$((${CISCO_SPLIT_INC}+1))
}

export CISCO_IPV6_SPLIT_INC=0
# Do the same for IPv6
function addroute6()
{
    local ROUTE="$1"
    local NET="${ROUTE%%/*}"
    local MASKLEN="${ROUTE##*/}"
    export CISCO_IPV6_SPLIT_INC_${CISCO_IPV6_SPLIT_INC}_ADDR=$NET
    export CISCO_IPV6_SPLIT_INC_${CISCO_IPV6_SPLIT_INC}_MASKLEN=$MASKLEN
    export CISCO_IPV6_SPLIT_INC=$((${CISCO_IPV6_SPLIT_INC}+1))
}

# Old function for generating NetworkManager 0.8 GConf keys 
function translateroute ()
{
    local IPADDR="${1%%/*}"
    local MASKLEN="${1##*/}"
    local OCTET1="$(echo $IPADDR | cut -f1 -d.)"
    local OCTET2="$(echo $IPADDR | cut -f2 -d.)"
    local OCTET3="$(echo $IPADDR | cut -f3 -d.)"
    local OCTET4="$(echo $IPADDR | cut -f4 -d.)"

    local NUMADDR=$(($OCTET1*16581375 + $OCTET2*65536 + $OCTET3*256 + $OCTET4))
    local NUMADDR=$(($OCTET4*16581375 + $OCTET3*65536 + $OCTET2*256 + $OCTET1))
    if [ "$ROUTESKEY" = "" ]; then
        ROUTESKEY="$NUMADDR,$MASKLEN,0,0"
    else
        ROUTESKEY="$ROUTESKEY,$NUMADDR,$MASKLEN,0,0"
    fi
}

if [ "$reason" = "make-nm-config" ]; then
    echo "Put the following into the [ipv4] section in your NetworkManager config:"
    echo "method=auto"
    COUNT=1
    for r in $ROUTES; do
        echo "routes${COUNT}=${r%%/*};${r##*/};0.0.0.0;0;"
        COUNT=$(($COUNT+1))
    done
    exit 0
fi

for r in $ROUTES; do
    addroute $r
done

for r in $ROUTES6; do
    addroute6 $r
done

exec /etc/openconnect/vpnc-script

OpenConnect: Setting default routes

3 Answers3

Linked