4

I want to use VPN and LAN access simultaneously (using local printers, SMB shares, ...) Theoretically the task should be easy:

  1. All local IP's targets (192.*) should go directly to eth0, the rest to the virtual device. As I get static "global" IP from the VPN, there will be no ambiguity and the routing won't be complicated.

  2. There have to be 2 DNS servers: the local one and the one provided via vpn.

When not connected to VPN I have 3 routes (dest, router, iface):

  • 192.*, *, eth0
  • link-local, *, eth0
  • default, natrouter.local, eth0

When connected to VPN I have 5 routes:

  • asa-1.vpn., (ipofnatrouter), eth0
  • 141., *, cscotun0
  • 192.*, *, eth0
  • link-local, *, eth0
  • default, 211.vpn., cscotun0

thus it should be possible to access the LAN, but when pinging a local IP (even as root) I get

ping: sendmsg: Operation not permitted

How can I make this work with (X)Ubuntu 10.10 and the Cisco Anyconnect VPN?

Note that, since Michał Šrajer gave a workaround, I'm now searching for the intended solution (using config xml). Even when editing the /opt/cisco/vpn/profile/AnyConnect-TargetVPN-Default.xml it gets overriden with each established VPN connection. I played around with <LocalLanAccess> and <PPPExclusion> as mentioned in the Documentation (PDF) without any mentionable success.

Overriding /etc/resolv.conf with an appropriate config for lan and vpn lets vpanagentd consume all cpu. As the vpn client changes that file at start, it is neccessary to modify it "live". As a workaround I use a modified /etc/hosts file.

  • related: superuser.com/questions/78713/… – mbx Aug 7 '11 at 16:45
  • Suggest only mark Michal's answer as accepted if you dont receive any other answers - otherwise it will confuse others thinking the question has been answered. – fossfreedom Aug 7 '11 at 20:15
  • I considered waiting but as switching your accepted answer isn't impolite I have choosen the first answer as it meets the basic requirements. If one comes up with a better answer, I'll choose it. However, the best answer given within a week will receive the bounty. – mbx Aug 7 '11 at 20:58
3
+50

it's kind of ugly, but works for me:

iptables-save | grep -v DROP | iptables-restore
iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT
1

I got tired of the limited 32 bit client for Ubuntu and tried out openconnect which is interoperable with Anyconnect VPN server. Since openconnect is integrated into the network manager, setting default routes was a cinch. It also allows you to set custom search domains and server IPs from the NM interface itself. If you can get it to connect to your VPN gateway without problems, I would suggest completely replacing Anyconnnect client with OpenConnect ...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.