Configuring Cisco VPN Anyconnect to use VPN and the local network simultaneously

Question

I want to use VPN and LAN access simultaneously (using local printers, SMB shares, ...) Theoretically the task should be easy:

1. All local IP's targets (192.*) should go directly to eth0, the rest to the virtual device. As I get static "global" IP from the VPN, there will be no ambiguity and the routing won't be complicated.

2. There have to be 2 DNS servers: the local one and the one provided via vpn.

When not connected to VPN I have 3 routes (dest, router, iface):

• 192.*, *, eth0
• link-local, *, eth0
• default, natrouter.local, eth0

When connected to VPN I have 5 routes:

• asa-1.vpn., (ipofnatrouter), eth0
• 141., *, cscotun0
• 192.*, *, eth0
• link-local, *, eth0
• default, 211.vpn., cscotun0

thus it should be possible to access the LAN, but when pinging a local IP (even as root) I get

ping: sendmsg: Operation not permitted

How can I make this work with (X)Ubuntu 10.10 and the Cisco Anyconnect VPN?

Note that, since Michał Šrajer gave a workaround, I'm now searching for the intended solution (using config xml). Even when editing the /opt/cisco/vpn/profile/AnyConnect-TargetVPN-Default.xml it gets overriden with each established VPN connection. I played around with <LocalLanAccess> and <PPPExclusion> as mentioned in the Documentation (PDF) without any mentionable success.

Overriding /etc/resolv.conf with an appropriate config for lan and vpn lets vpanagentd consume all cpu. As the vpn client changes that file at start, it is neccessary to modify it "live". As a workaround I use a modified /etc/hosts file.

Solution 1

it's kind of ugly, but works for me:

iptables-save | grep -v DROP | iptables-restore
iptables -P INPUT ACCEPT; iptables -P OUTPUT ACCEPT

Solution 2

I got tired of the limited 32 bit client for Ubuntu and tried out openconnect which is interoperable with Anyconnect VPN server. Since openconnect is integrated into the network manager, setting default routes was a cinch. It also allows you to set custom search domains and server IPs from the NM interface itself. If you can get it to connect to your VPN gateway without problems, I would suggest completely replacing Anyconnnect client with OpenConnect ...

Comments

[sabna]

related: superuser.com/questions/78713/…

[nilsonneto]

Suggest only mark Michal's answer as accepted if you dont receive any other answers - otherwise it will confuse others thinking the question has been answered.

[sabna]

I considered waiting but as switching your accepted answer isn't impolite I have choosen the first answer as it meets the basic requirements. If one comes up with a better answer, I'll choose it. However, the best answer given within a week will receive the bounty.

[sabna]

This is at least a workaround. thx

[Michał Šrajer]

you can polish it to allow only what you need.

[Michał Šrajer]

@mbx: Thank you! That was my first bonus :-D

[sabna]

unfortunately they cancelled the Greedo and the Boba Fett Badge

[Maxim Akristiniy]

my company reources are not accessible with openconnect, only with anyconnect, not found way to enable them with openconnect