0

I've migrated a Windows 10 machine to Ubuntu.

On Windows 10 I connected to a Cisco VPN through the Cisco AnyConnect client. It worked fine and allowed me to use port 443 while connected to the VPN (browsing in HTTPS, reading the emails, etc...) .

If I'm not mistaken, this should be related to the Cisco AnyConnect client trying DTLS over UDP by default (with a fallback on TCP in case it doesn't work).

I've connected to the same Cisco VPN from Ubuntu with the OpenConnect Client, which should behave the same.

It works fine but, when the VPN is on, the port 443 is blocked (it I try browsing or reading emails, it hangs).

I've tried changing the DTLS port from 443 to 10443:

$ sudo openconnect -u [email protected] --dtls-local-port=10443 vpn.acme.com

but I'm not sure how to read the output:

POST https://vpn.acme.com/
Connected to 11.22.33.44:443
SSL negotiation with vpn.acme.com
Connected to HTTPS on vpn.acme.com
XML POST enabled
Please enter your username and password.
POST https://vpn.acme.com/
Enter your one-time password (OTP). If you do not have an OTP, you must register an authentication device in your OneLogin user profile.
Response:
POST https://vpn.acme.com/
Got CONNECT response: HTTP/1.1 200 OK
CSTP connected. DPD 30, Keepalive 20
Connected as 10.10.25.54, using SSL, with DTLS in progress
Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(ECDHE-(null))-(AES-256-GCM).
Unknown DTLS packet type f9, len 16

It seems it's running on 10443, so the 443 from the previous output should refer to the handshake only (and not to the UDP connection):

$ sudo netstat -peanut | grep 10443
udp        0      0 192.168.2.48:10443      11.22.33.44:443       ESTABLISHED

It still blocks every traffic on 443, though.

How can I prevent the OpenConnect VPN client from isolating my entire computer?

3
  • Are you using firewall?
    – JoKeR
    Sep 14, 2019 at 21:17
  • @JoKeR Yes, I'm using UFW. 443 and 10443 are open, though. What are you thinking? Sep 15, 2019 at 0:15
  • That's what I thought :) I'm using it too but my VPN provider told me to turn it off because they have implemented it in ther service and they may conflict with each other. Try to disable it and reboot the system.
    – JoKeR
    Sep 15, 2019 at 9:14

0

You must log in to answer this question.

Browse other questions tagged .