Home / ubuntu / Questions / 572895
In Process
Socob
Asked: 2015-01-13 08:00:14 +0800 CST

OpenConnect: Force all connections throught VPN (if IPv6 unavailable)

  • 772

On Ubuntu 14.10, I'm connecting to the same VPN service using either OpenConnect (through the network-manager-openconnect(-gnome) packages or the Cisco AnyConnect Client. Using the AnyConnect client, I have had no problems, while OpenConnect gives me strange connection issues (but only with some programs).

I suspect the problems are caused by the fact that the VPN provider does not support IPv6. Connecting to http://whatismyipv6.com using the AnyConnect client, an IPv4 address is displayed, while using OpenConnect, my (non-VPN!) IPv6 address is shown. The AnyConnect client seems to force all connections through the VPN, even if IPv6 is unavailable. The following is a screenshot of the Statistics -> Details page in the AnyConnect client:

AnyConnect details

How can I achieve the same using OpenConnect? In Network Manager, under "Edit connection", there is an "IPv6 settings" tab, but the only relevant setting seems to be "Method" with the options "Ignore", "Automatic (VPN)" and "Automatic (VPN) addresses only" – I don't know what the difference between them is, but none of them seem to do what I want. Is the --disable-ipv6 flag that can be given to openconnect related? How would one use that in Network Manager?

Note: I have seen this question about disabling IPv6 with OpenVPN, but the answer given there is unsatisfactory – I don't want to manually and globally enable/disable IPv6 every time I connect to or disconnect from the VPN.

networking

1 Answers

  1. Default Route

    You'll need to change your default route.

    If you type route in a terminal, you'll see where packets will be sent, based upon their destination address. By default, your VPN will only set up a route to route traffic on a specific subnet over the VPN. You can set this gateway to be your default gateway, if that's what you want to do:

    • sudo route add default gw 192.168.1.254 eth0

    Be sure to change the 192.168.1.254 with whatever IP your gateway is for your VPN.

    OpenConnect Routing

    OpenConnect, by default, forces you to set up your own routes. You can change this behavior by installing vpnc vpnc-scripts and adding the following to your openconnect command:

    • --script=/etc/vpnc/vpnc-script

    Note:

    I prefer using OpenConnect vs AnyConnect.

    • 2