I've migrated a Windows 10 machine to Ubuntu.
On Windows 10 I connected to a Cisco VPN through the Cisco AnyConnect client. It worked fine and allowed me to use port 443
while connected to the VPN (browsing in HTTPS, reading the emails, etc...) .
If I'm not mistaken, this should be related to the Cisco AnyConnect client trying DTLS over UDP by default (with a fallback on TCP in case it doesn't work).
I've connected to the same Cisco VPN from Ubuntu with the OpenConnect Client, which should behave the same.
It works fine but, when the VPN is on, the port 443
is blocked (it I try browsing or reading emails, it hangs).
I've tried changing the DTLS port from 443
to 10443
:
$ sudo openconnect -u [email protected] --dtls-local-port=10443 vpn.acme.com
but I'm not sure how to read the output:
POST https://vpn.acme.com/ Connected to 11.22.33.44:443 SSL negotiation with vpn.acme.com Connected to HTTPS on vpn.acme.com XML POST enabled Please enter your username and password. POST https://vpn.acme.com/ Enter your one-time password (OTP). If you do not have an OTP, you must register an authentication device in your OneLogin user profile. Response: POST https://vpn.acme.com/ Got CONNECT response: HTTP/1.1 200 OK CSTP connected. DPD 30, Keepalive 20 Connected as 10.10.25.54, using SSL, with DTLS in progress Established DTLS connection (using GnuTLS). Ciphersuite (DTLS1.2)-(ECDHE-(null))-(AES-256-GCM). Unknown DTLS packet type f9, len 16
It seems it's running on 10443
, so the 443
from the previous output should refer to the handshake only (and not to the UDP connection):
$ sudo netstat -peanut | grep 10443
udp 0 0 192.168.2.48:10443 11.22.33.44:443 ESTABLISHED
It still blocks every traffic on 443, though.
How can I prevent the OpenConnect VPN client from isolating my entire computer?