mjhjmtu

I'm trying to use OpenConnect to connect to my company's Cisco VPN (AnyConnect)

The connection seems to work just fine, what I'm not understanding is how to set up routing. I'm doing this from the command line.

I use the default VPN script to connect like this:

openconnect -u MyUserName --script path_to_vpnc_script myvpngateway.example.com

I type in my password, and I'm connected fine, but my default route has changed to force all traffic down the VPN link, whereas I just want company traffic down the VPN link.

Are there some variables that I need to be putting into the vpnc-script? It's not very clear how this is done.

This answer is as follows:

Use the following bash wrapper script to call the vpnc-script. In the wrapper script, the routes to be used for the VPN connection can be specified via a ROUTES variable.

#!/bin/bash
#

# Routes that we want to be used by the VPN link
ROUTES="162.73.0.0/16"

# Helpers to create dotted-quad netmask strings.
MASKS[1]="128.0.0.0"
MASKS[2]="192.0.0.0"
MASKS[3]="224.0.0.0"
MASKS[4]="240.0.0.0"
MASKS[5]="248.0.0.0"
MASKS[6]="252.0.0.0"
MASKS[7]="254.0.0.0"
MASKS[8]="255.0.0.0"
MASKS[9]="255.128.0.0"
MASKS[10]="255.192.0.0"
MASKS[11]="255.224.0.0"
MASKS[12]="255.240.0.0"
MASKS[13]="255.248.0.0"
MASKS[14]="255.252.0.0"
MASKS[15]="255.254.0.0"
MASKS[16]="255.255.0.0"
MASKS[17]="255.255.128.0"
MASKS[18]="255.255.192.0"
MASKS[19]="255.255.224.0"
MASKS[20]="255.255.240.0"
MASKS[21]="255.255.248.0"
MASKS[22]="255.255.252.0"
MASKS[23]="255.255.254.0"
MASKS[24]="255.255.255.0"
MASKS[25]="255.255.255.128"
MASKS[26]="255.255.255.192"
MASKS[27]="255.255.255.224"
MASKS[28]="255.255.255.240"
MASKS[29]="255.255.255.248"
MASKS[30]="255.255.255.252"
MASKS[31]="255.255.255.254"

export CISCO_SPLIT_INC=0

# Create environment variables that vpnc-script uses to configure network
function addroute()

 local ROUTE="$1"
 export CISCO_SPLIT_INC_$CISCO_SPLIT_INC_ADDR=$ROUTE%%/*
 export CISCO_SPLIT_INC_$CISCO_SPLIT_INC_MASKLEN=$ROUTE##*/
 export CISCO_SPLIT_INC_$CISCO_SPLIT_INC_MASK=$MASKS[$ROUTE##*/]
 export CISCO_SPLIT_INC=$(($CISCO_SPLIT_INC+1))


# Old function for generating NetworkManager 0.8 GConf keys 
function translateroute ()

 local IPADDR="$1%%/*"
 local MASKLEN="$1##*/"
 local OCTET1="$(echo $IPADDR 

if [ "$reason" = "make-nm-config" ]; then
 echo "Put the following into the [ipv4] section in your NetworkManager config:"
 echo "method=auto"
 COUNT=1
 for r in $ROUTES; do
 echo "routes$COUNT=$r%%/*;$r##*/;0.0.0.0;0;"
 COUNT=$(($COUNT+1))
 done
 exit 0
fi

for r in $ROUTES; do
 addroute $r
done

exec /etc/openconnect/vpnc-script

Then connect as follows:

openconnect -u myusername --script wrapper-script -b vpngateway.example.com

Here's a script which does split-tunnelling on both IPv4 and IPv6 networks (based on the script Aditya K provided, which still allowed caused all IPv6 traffic to be routed to the VPN). Note also that the setting of CISCO_SPLIT_INC_$N_MASK variables no longer appears to be needed):

#!/bin/bash
#

# Routes that we want to be used by the VPN link
ROUTES="162.73.0.0/16"
ROUTES6="1ef2:23e:5a4::0/48"

export CISCO_SPLIT_INC=0

# Create environment variables that vpnc-script uses to configure network
function addroute()

 local ROUTE="$1"
 export CISCO_SPLIT_INC_$CISCO_SPLIT_INC_ADDR=$ROUTE%%/*
 export CISCO_SPLIT_INC_$CISCO_SPLIT_INC_MASKLEN=$ROUTE##*/
 export CISCO_SPLIT_INC=$(($CISCO_SPLIT_INC+1))


export CISCO_IPV6_SPLIT_INC=0
# Do the same for IPv6
function addroute6()

 local ROUTE="$1"
 local NET="$ROUTE%%/*"
 local MASKLEN="$ROUTE##*/"
 export CISCO_IPV6_SPLIT_INC_$CISCO_IPV6_SPLIT_INC_ADDR=$NET
 export CISCO_IPV6_SPLIT_INC_$CISCO_IPV6_SPLIT_INC_MASKLEN=$MASKLEN
 export CISCO_IPV6_SPLIT_INC=$(($CISCO_IPV6_SPLIT_INC+1))


# Old function for generating NetworkManager 0.8 GConf keys 
function translateroute ()

 local IPADDR="$1%%/*"
 local MASKLEN="$1##*/"
 local OCTET1="$(echo $IPADDR 

if [ "$reason" = "make-nm-config" ]; then
 echo "Put the following into the [ipv4] section in your NetworkManager config:"
 echo "method=auto"
 COUNT=1
 for r in $ROUTES; do
 echo "routes$COUNT=$r%%/*;$r##*/;0.0.0.0;0;"
 COUNT=$(($COUNT+1))
 done
 exit 0
fi

for r in $ROUTES; do
 addroute $r
done

for r in $ROUTES6; do
 addroute6 $r
done

exec /etc/openconnect/vpnc-script