Hello Chris,
On 08/22/2017 05:37 PM, Chris Laprise wrote:
Working with OpenConnect would be great.
There is also a GUI part that needs to be installed:
NetworkManager-openconnect-gnome in Fedora.
I tried all hints you have given, but nothing seems to work.
At least I was able to get a fedora-25 based proxy VM up and running and
my work AppVm could connect through the proxy (without any VPN involved)
I've decided to try to setup AnyConnect from within my Work AppVM and
use openconnect-gnome to connect to our Cisco ASA.
I have therof created a new template based on a fedora 25 clone and made
sure that NetworkManager-openconnect-gnome is installed in the template.
But if I start the AppVM and start Network Manager I can open the Create
new VPN window but all options are still greyed out - can someone
reproduce this problem on Qubes 3.2
- Launch Network Connections from the App Menu
- Right Click > Edit Connections
- Add
- Connection Type = VPN
- Cisco AnyConnect Compatible VPN (openconnect)
- Create
- all options are greyed out in the next Screen
Any options how to make this work?
Finally, I should mention leak prevention measures. If you are able to
get the VPN to function with proxyVM + appVMs, you can then add these
commands in proxyVM to prevent appVMs from having non-VPN access:
iptables -I FORWARD -o eth0 -j DROP
iptables -I FORWARD -i eth0 -j DROP
These need to show up at the _top_ of the FORWARD chain, which is why
'-I' insert is used; You can ensure they'll be at the top by executing
them last after a connection is made (probably from
/rw/config/qubes-firewall-user-script).
I'll try to get VPN up and running first, then I can harden it.
- PhR
--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/c250aa2e-73c1-3e1e-4fae-1f09329791a0%40googlemail.com.
For more options, visit https://groups.google.com/d/optout.
