Cisco VPN for nerds on MacOS and Linux

This is a package containing an OpenConnect configuration script for MacOS that allows you to fully control how the VPN connection is made, which routes are added, and how the DNS are configured.

If you are tired of having all your private traffic go through the corporate VPN, but you need it always up, this script is for you. It is MacOS and brew centric, but if you know your way you can of course make it work with your installation from source.

Enjoy!

Setup

Create a working directory, say, ~/code/openconnect and enter into it
```
 mkdir ~/code/openconnect
 cd $_
```

Clone the sources

 git clone https://github.com/vjt/openconnect-macos

Install OpenConnect

 # For MacOS
 brew install openconnect

 # For Debian/Ubuntu/Kali/other apt-based distros
 apt-get install openconnect

Create a directory for your VPN
```
 mkdir myvpn
 cd myvpn
```
Copy the network configuration script for your OS, and set the INTERNAL_ROUTES variable. For MacOS, if you want to run multiple VPNs, also set the SERVICE_NAME variable to a unique value
```
 # For MacOS
 cp ../net.macos.sh net.sh

 # For Linux
 cp ../net.linux.sh net.sh
```
Copy the configuration file and set the user, authgroup and script settings. If you want to be prompted for the username, comment out the user setting.
```
 cp ../vpn.conf vpn.conf
 vi vpn.conf
```
Copy the vpn.sh script and set the VPN_CONF and VPN_CONCENTRATOR variables
```
 cp ../vpn.sh vpn.sh
 vi vpn.sh
```
Grant yourself rights to start the VPN without password: run sudo visudo and add:
```
 %admin ALL=(ALL) NOPASSWD: /usr/local/bin/openconnect
```
at the end of the file.

Connect the VPN

Use the runner script

./vpn.sh

or run it manually, as you please

openconnect -U `whoami` --config ~/code/openconnect/myvpn/vpn.conf concentrator.example.com

Disconnect the VPN

Ctrl+C

Advantages

Start the VPN straight from the Command Line
Only DNS requests for the corporate domain are routed through the VPN
Only corporate traffic is routed through the VPN, for more privacy, security, and reliability.

License

----------------------------------------------------------------------------
"THE BEER-WARE LICENSE" (Revision 42):
<vjt@openssl.it> wrote this file. As long as you retain this notice you
can do whatever you want with this stuff. If we meet some day, and you think
this stuff is worth it, you can buy me a beer in return.

- Marcello Barnaba
----------------------------------------------------------------------------