I have the Cisco Annyconnect VPN on my Ubuntu 18.04 machine. I also have an embedded Linux board plugged in that I need to connect to over ssh.
Whenever I connect to my VPN, however, I can no longer talk to my local board (ping 10.1.2.3
fails with the VPN connected, as does ssh [email protected]
). How can I disable the VPN for this board only, so that the interface talking to this local board does not go through the VPN?
Example info:
- My main Ubuntu machine:
- Interface name for the interface connecting to this local Linux board (as shown by
ifconfig
):enxf8e43b9df776
- Static IP to the local Linux board:
10.1.2.1
- Netmask:
255.255.255.0
- Interface name for the interface connecting to this local Linux board (as shown by
- Local embedded Linux board which I need to ssh into:
- Static IP address:
10.1.2.3
- Netmask:
255.255.255.0
- Static IP address:
This doesn't work for me: Is it possible to stop using VPN on some application?
I need to be able to use the VPN to connect to some remote networks while simultaneously using my local embedded Linux board.
Possibly useful:
- https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70847-local-lan-pix-asa.html
grep -rn 'LocalLanAccess' /opt/cisco
grep -rn '<AnyConnectProfile' /opt/cisco
- I need to try this out; this is quite the hack!--building a custom function, C++ name-mangling and all!--and preloading it at the library load time to override the internal function by that name: Super User: How to allow local LAN access while connected to Cisco VPN?
- OpenConnect - an alternative to try, which is apparently compatible with Cisco AnyConnect
Here are some things I did which did not prove to solve the problem or be useful (at least not yet, anyway):
grep -rn 'LocalLanAccess' /opt/cisco
$ grep -rn 'LocalLanAccess' /opt/cisco
/opt/cisco/anyconnect/.anyconnect_global:15:<LocalLanAccess>false</LocalLanAccess></ControllablePreferences>
Binary file /opt/cisco/anyconnect/lib/libvpnapi.so matches
Binary file /opt/cisco/anyconnect/lib/libvpnagentutilities.so matches
/opt/cisco/anyconnect/profile/vpn_profile.xml:15: <LocalLanAccess UserControllable="true">false</LocalLanAccess>
/opt/cisco/anyconnect/profile/AnyConnectProfile.xsd:325: <xs:element name="LocalLanAccess" default="false" minOccurs="0">
cp -i /opt/cisco/anyconnect/.anyconnect_global /opt/cisco/anyconnect/.anyconnect_global.bak
cp -i /opt/cisco/anyconnect/profile/vpn_profile.xml /opt/cisco/anyconnect/profile/vpn_profile.xml.bak
cp -i /opt/cisco/anyconnect/profile/AnyConnectProfile.xsd /opt/cisco/anyconnect/profile/AnyConnectProfile.xsd.bak
# manually update all 3 files to true
$ grep -rn 'LocalLanAccess' /opt/cisco
/opt/cisco/anyconnect/.anyconnect_global:15:<LocalLanAccess>true</LocalLanAccess></ControllablePreferences>
Binary file /opt/cisco/anyconnect/lib/libvpnapi.so matches
Binary file /opt/cisco/anyconnect/lib/libvpnagentutilities.so matches
/opt/cisco/anyconnect/profile/vpn_profile.xml:15: <LocalLanAccess UserControllable="true">true</LocalLanAccess>
/opt/cisco/anyconnect/profile/AnyConnectProfile.xsd:325: <xs:element name="LocalLanAccess" default="true" minOccurs="0">
ip route -n
before and after connecting to the VPN?