Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to use VPN and LAN access simultaneously (using local printers, SMB shares, ...) Theoretically the task should be easy:

  1. All local IP's targets (192.*) should go directly to eth0, the rest to the virtual device. As I get static "global" IP from the VPN, there will be no ambiguity and the routing won't be complicated.

  2. There have to be 2 DNS servers: the local one and the one provided via vpn.

When not connected to VPN I have 3 routes (dest, router, iface):

  • 192.*, *, eth0
  • link-local, *, eth0
  • default, natrouter.local, eth0

When connected to VPN I have 5 routes:

  • asa-1.vpn., (ipofnatrouter), eth0
  • 141., *, cscotun0
  • 192.*, *, eth0
  • link-local, *, eth0
  • default, 211.vpn., cscotun0

thus it should be possible to access the LAN, but when pinging a local IP (even as root) I get

ping: sendmsg: Operation not permitted

How can I make this work with (X)Ubuntu 10.10 and the Cisco Anyconnect VPN?

Note that, since Michał Šrajer gave a workaround, I'm now searching for the intended solution (using config xml). Even when editing the /opt/cisco/vpn/profile/AnyConnect-TargetVPN-Default.xml it gets overriden with each established VPN connection. I played around with <LocalLanAccess> and <PPPExclusion> as mentioned in the Documentation (PDF) without any mentionable success.

Overriding /etc/resolv.conf with an appropriate config for lan and vpn lets vpanagentd consume all cpu. As the vpn client changes that file at start, it is neccessary to modify it "live". As a workaround I use a modified /etc/hosts file.

share|improve this question
related:… – mbx Aug 7 '11 at 16:45
Suggest only mark Michal's answer as accepted if you dont receive any other answers - otherwise it will confuse others thinking the question has been answered. – fossfreedom Aug 7 '11 at 20:15
I considered waiting but as switching your accepted answer isn't impolite I have choosen the first answer as it meets the basic requirements. If one comes up with a better answer, I'll choose it. However, the best answer given within a week will receive the bounty. – mbx Aug 7 '11 at 20:58
up vote 3 down vote accepted

it's kind of ugly, but works for me:

iptables-save | grep -v DROP | iptables-restore
iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT
share|improve this answer
This is at least a workaround. thx – mbx Aug 7 '11 at 17:08
you can polish it to allow only what you need. – Michał Šrajer Aug 7 '11 at 18:47
@mbx: Thank you! That was my first bonus :-D – Michał Šrajer Aug 14 '11 at 12:37
unfortunately they cancelled the Greedo and the Boba Fett Badge – mbx Aug 17 '11 at 7:06

I got tired of the limited 32 bit client for Ubuntu and tried out openconnect which is interoperable with Anyconnect VPN server. Since openconnect is integrated into the network manager, setting default routes was a cinch. It also allows you to set custom search domains and server IPs from the NM interface itself. If you can get it to connect to your VPN gateway without problems, I would suggest completely replacing Anyconnnect client with OpenConnect ...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.