3

In order to ssh into a computer I need to connect to its Cisco AnyConnect Compatible VPN (openconnect) server.

I can do that without a problem, but I would like only the ssh traffic to be routed using the vpn. Mainly because I want to be able to use remote desktop to access my computer and I cannot do that when connected to the vpn.

Is this possible? how?


Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.1.9.1        0.0.0.0         UG    0      0        0 eth0
10.1.9.0        0.0.0.0         255.255.255.0   U     1      0        0 eth0
128.143.1.0     0.0.0.0         255.255.255.0   U     0      0        0 vpn0
128.143.20.85   0.0.0.0         255.255.255.255 UH    0      0        0 vpn0
172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0
192.35.48.194   10.1.9.1        255.255.255.255 UGH   0      0        0 eth0

1 Answer 1

2

The easiest way to do this is change your routing table.

THIS DOES NOT SEND ONLY SSH TRAFFIC, IT SENDS ALL TRAFFIC SENT TO SSH TARGET.

When you connect your Cisco VPN it probably changes the default route to go through your VPN tunnel. Try the following to get it to send all traffic except traffic destined for your ssh host out of your gateway and not the tunnel.

MY_ROUTER=192.168.0.1
SSH_TARGET=192.168.10.12
CISCO_DEV_NAME=ppp0 # not sure what cisco call there tunnel devices check ifconfig -a when connected

# Delete the default route
sudo route del default

# Change the default route back to your router
sudo route add default gw $MY_ROUTER 

# Add explicit route for ssh target to go through the tunnel
sudo route add $SSH_TARGET/32 $CISCO_DEV_NAME 

I am unsure how to do this automatically when you connect your VPN, I can do it with pptp but have no idea on Cisco anyconnect.

8
  • Sorry for the stupid question... what do I have to change to make this work? Just SSH_TARGET= MY_SERVER.COM ? my router should be the ip address of my router? do i need to change cisco_dev_name ? Thanks!
    – Ignacio
    Mar 3, 2015 at 15:41
  • Yes you should set SSH_TARGET to the ip of your ssh server your are connecting to MY_ROUTER to your gateway when your not on the tunnel and CISCO_DEV_NAME is the name of the tunnel device, connect as normal then do ifconfig -a you should see your device name of cisco VPN.
    – squareborg
    Mar 3, 2015 at 15:49
  • how do i know what is my gateway when i'm not on the tunnel?
    – Ignacio
    Mar 3, 2015 at 15:56
  • type route -n it will be the line that starts 0.0.0.0, the gateway ip will be under the gateway column.
    – squareborg
    Mar 3, 2015 at 16:11
  • That is what I thought. After following your instructions I can do almost everything but use the internet in the computer connected to the vpn. That computer can ssh into the server and I can remote access that computer, but I cannot browse the internet...
    – Ignacio
    Mar 3, 2015 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .