4

On Ubuntu 14.10, I'm connecting to the same VPN service using either OpenConnect (through the network-manager-openconnect(-gnome) packages or the Cisco AnyConnect Client. Using the AnyConnect client, I have had no problems, while OpenConnect gives me strange connection issues (but only with some programs).

I suspect the problems are caused by the fact that the VPN provider does not support IPv6. Connecting to http://whatismyipv6.com using the AnyConnect client, an IPv4 address is displayed, while using OpenConnect, my (non-VPN!) IPv6 address is shown. The AnyConnect client seems to force all connections through the VPN, even if IPv6 is unavailable. The following is a screenshot of the Statistics -> Details page in the AnyConnect client:

AnyConnect details

How can I achieve the same using OpenConnect? In Network Manager, under "Edit connection", there is an "IPv6 settings" tab, but the only relevant setting seems to be "Method" with the options "Ignore", "Automatic (VPN)" and "Automatic (VPN) addresses only" – I don't know what the difference between them is, but none of them seem to do what I want. Is the --disable-ipv6 flag that can be given to openconnect related? How would one use that in Network Manager?

Note: I have seen this question about disabling IPv6 with OpenVPN, but the answer given there is unsatisfactory – I don't want to manually and globally enable/disable IPv6 every time I connect to or disconnect from the VPN.

1 Answer 1

2

Default Route

You'll need to change your default route.

If you type route in a terminal, you'll see where packets will be sent, based upon their destination address. By default, your VPN will only set up a route to route traffic on a specific subnet over the VPN. You can set this gateway to be your default gateway, if that's what you want to do:

  • sudo route add default gw 192.168.1.254 eth0

Be sure to change the 192.168.1.254 with whatever IP your gateway is for your VPN.

OpenConnect Routing

OpenConnect, by default, forces you to set up your own routes. You can change this behavior by installing vpnc vpnc-scripts and adding the following to your openconnect command:

  • --script=/etc/vpnc/vpnc-script

Note:

I prefer using OpenConnect vs AnyConnect.

1
  • 1
    openconnect already tries to read /usr/share/vpnc-scripts/vpnc-script (which is provided by the vpnc package, not the vpnc-scripts package that provides /etc/vpnc/vpnc-script - don't ask me why). Oct 14, 2015 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .