I want to connect to my work place PaloAlto GlobalProtect VPN. The problem: there is no linux client (or I can use linux but it requires cooperation of the IT group...)
4 Answers
I have recently extended the fantastic open-source VPN client OpenConnect to support the PAN GlobalProtect VPN, both in its SSL-VPN and IPsec/ESP modes.
This is a work in progress, but I've been using it for real work already and it works very well for me. Having other people test it would be awesome and I welcome your feedback!
Build the globalprotect
branch from this repository:
https://github.com/dlenski/openconnect
... and then run it like this to test it (you can omit the --certificate
part if your VPN doesn't use a client certificate):
$ ./openconnect --protocol=gp [--certificate=my_cert_with_pk.pem] \
server.company.com --dump -vvv
Please enter your username and password.
Username:
Password:
Currently it only supports username, password, and optionally client certificate authentication… since that's the only example I have. But I'd welcome feedback if there are other authentication methods in use out there.
PS- For my VPN, the VPN tunnel server is the same as the VPN "portal" server, but your VPN may differ. Try using both the "Portal address" and the "GlobalProtect Gateway IP" shown in the Windows client with OpenConnect:
[]
-
1That's just perfect! The only solution that worked for me without asking the admins any extra configuration questions! I hope it makes its way to the official release Oct 23, 2016 at 23:05
-
Awesome! You are the second person to use it successfully :). Please report any issues on the Github tracker, so I don't bug the official mailing list too much until it makes it into the release.– DanOct 23, 2016 at 23:35
-
BTW, I am not much into VPNs, so forgive my question. when I am connecting via GP client, I am using a specific gateway (vpn.company.com), which is then somehow allowing me to connect to one of different other locations (vpn1.company.com, vpn2.company.com etc). With OpenConnect I can connect to either vpn.company.com or to any of the other vpnx explicitely. Is there a way of choosing the specific location when connecting to the main gateway? Oct 24, 2016 at 13:54
-
I'm not sure what you're asking. OpenConnect should work with any of the gateway servers... does it? The official client can be "locked down" to direct you to a specific gateway, but openconnect does not care about the profile which directs you to a particular server.– DanOct 24, 2016 at 14:34
-
1Cool, thanks. Now I need it to be packaged for Fedora and have a NetworkManager plugin (well, just kidding. It is working now pretty well) :) Oct 24, 2016 at 18:54
My working configuration Linux host ifconfig:
vboxnet0 Link encap:Ethernet HWaddr 0a:ee:27:00:09:00
inet addr:192.168.137.100 Bcast:192.168.137.255 Mask:255.255.255.0
inet6 addr: fe80::800:27ff:fe00:0/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:1340 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:429784 (429.7 KB)
wlan0 Link encap:Ethernet HWaddr 82:49:34:1a:a6:e9
inet addr:10.157.48.55 Bcast:10.157.48.255 Mask:255.255.255.0
inet6 addr: fe80::8219:34ff:fe15:a6e9/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:10935 errors:0 dropped:0 overruns:0 frame:0
TX packets:9571 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:6235519 (6.2 MB) TX bytes:2625822 (2.6 MB)
Linux host route:
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 10.157.48.1 0.0.0.0 UG 400 0 0 wlan0
10.0.0.0 192.168.137.1 255.0.0.0 UG 0 0 0 vboxnet0
link-local * 255.255.0.0 U 1000 0 0 wlan0
192.168.137.0 * 255.255.255.0 U 100 0 0 vboxnet0
~$ netstat -nr
Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 10.157.48.1 0.0.0.0 UG 0 0 0 wlan0
10.0.0.0 192.168.137.1 255.0.0.0 UG 0 0 0 vboxnet0
169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0
192.168.137.0 0.0.0.0 255.255.255.0 U 0 0 0 vboxnet0
Windows igconfig:
Ethernet adapter VPN:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::a0fd:e08a:6a52:87db%12
IPv4 Address. . . . . . . . . . . : 10.7.8.23
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
Ethernet adapter vboxnet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::a4bb:6e53:572:5682%13
IPv4 Address. . . . . . . . . . . : 192.168.137.1
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::90de:f93f:b73d:871f%11
IPv4 Address. . . . . . . . . . . : 10.0.2.15
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.2.2
(assuming the VPN subnet is "10.0.0.0/255.0.0.0" you can adjust to your needs)
- Install win 7 VM.
- Install and configure VPN access in the win VM and share the internet connection of the VPN virtual adapter
- In virtualbox go to: File -> Preferences -> Network -> Host-only Networks -> add a network and modify it to have the folowing IP 192.168.137.100 *see troubleshooting 1
- make a backup of /etc/resolve.conf
- (i am now with ubuntu 15.10) set DNS manually in your connection config to be 192.168.137.1 and some other dns which is not in the VM and not in the VPN (e.g your router IP, ISP dns ip etc.). (the old trick was not perfect: replace "nameserver whatever" with "nameserver 192.168.137.1") you can "nslookup google.com" and see the dns IP in the reply
- add route - "route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.137.1"
Troubleshooting: 1. In the win VM check the IP of the host-only then make sure the vboxnet0 is in the same subnet, try to ping the vbox-net-adapter ip that is in the win machine
I spend some hours in that project and it really works:
https://github.com/dlenski/openconnect
I do not understand that today there is android application for Global Project and is not present any solution for Ubuntu or others Linux users.
So, I have to install many packages to perform this steps:
./autogen.sh
./configure
don't give up! Best Regards
-
Is it possible you could expand on this further, and explain how it would work from within a Windows Virtual Machine, hosted on an Ubuntu machine? Nov 18, 2016 at 3:36