OpenConnect extras

This article relies on the following:

Accessing web interface / command-line interface
Managing configs / packages / services / logs

This how-to describes the most common OpenConnect tuning scenarios adapted for OpenWrt.
Follow OpenConnect client for client setup and OpenConnect server for server setup.
Follow OpenConnect protocol for client configuration.
Follow DDNS client to use own server with dynamic IP address.
Follow Random generator to overcome low entropy issues.

If you want to manage VPN settings using web interface. Install the necessary packages.

# Install packages
opkg update
opkg install luci-app-ocserv
/etc/init.d/rpcd restart

Navigate to LuCI → VPN → OpenConnect VPN to configure OpenConnect server.

# Install packages
opkg update
opkg install luci-proto-openconnect
/etc/init.d/rpcd restart

Navigate to LuCI → Network → Interfaces to configure OpenConnect client.

Preserve default route to restore WAN connectivity when VPN is disconnected.

# Preserve default route
uci set network.wan.metric="1024"
uci commit network
/etc/init.d/network restart

If you do not need to redirect all traffic to VPN. Disable gateway redirection on VPN client.

# Configure VPN service
uci set network.vpn.defaultroute="0"
uci commit network
/etc/init.d/network restart

If VPN gateway is separate from your LAN gateway. Implement plain routing between LAN network and VPN network assuming that:

192.168.1.0/24 - LAN network
192.168.1.2/24 - VPN gateway
192.168.7.0/24 - VPN network

Add port forwarding for VPN server on LAN gateway.

uci -q delete firewall.oc
uci set firewall.oc="redirect"
uci set firewall.oc.name="Redirect-OpenConnect"
uci set firewall.oc.src="wan"
uci set firewall.oc.src_dport="4443"
uci set firewall.oc.dest="lan"
uci set firewall.oc.dest_ip="192.168.1.2"
uci set firewall.oc.family="ipv4"
uci set firewall.oc.proto="tcp udp"
uci set firewall.oc.target="DNAT"
uci commit firewall
/etc/init.d/firewall restart

Add route to VPN network via VPN gateway on LAN gateway.

uci -q delete network.vpn
uci set network.vpn="route"
uci set network.vpn.interface="lan"
uci set network.vpn.target="192.168.7.0/24"
uci set network.vpn.gateway="192.168.1.2"
uci commit network
/etc/init.d/network restart

Set up IPv6 tunnel broker or use IPv6 NAT or NPT if necessary. Enable IPv6 tunnel on VPN server, offer IPv6 DNS, redirect IPv6 gateway.

VPN_POOL6="fd00:7::/64"
VPN_DNS6="${VPN_POOL6%/*}1"
uci set ocserv.config.ip6addr="${VPN_POOL6}"
uci -q delete ocserv.dns6
uci set ocserv.dns6="dns"
uci set ocserv.dns6.ip="${VPN_DNS6}"
uci commit ocserv
/etc/init.d/ocserv restart

Disable ISP prefix delegation to prevent IPv6 leaks on VPN client.

Serve DNS for VPN clients on OpenWrt server when using point-to-point topology.

Route DNS over VPN to prevent DNS leaks on VPN client.

Replace peer DNS with public or VPN-specific DNS provider on OpenWrt client.

Modify the VPN connection using NetworkManager on Linux desktop client.

nmcli connection modify id VPN_CON \
ipv4.dns-search ~. ipv4.dns-priority -50 \
ipv6.dns-search ~. ipv6.dns-priority -50

Prevent traffic leaks on OpenWrt client isolating VPN interface in a separate firewall zone.

uci -q delete firewall.vpn
uci set firewall.vpn="zone"
uci set firewall.vpn.name="vpn"
uci set firewall.vpn.input="REJECT"
uci set firewall.vpn.output="ACCEPT"
uci set firewall.vpn.forward="REJECT"
uci set firewall.vpn.masq="1"
uci set firewall.vpn.mtu_fix="1"
uci add_list firewall.vpn.network="vpn"
uci del_list firewall.wan.network="vpn"
uci -q delete firewall.@forwarding[0]
uci -q delete firewall.lan_vpn
uci set firewall.lan_vpn="forwarding"
uci set firewall.lan_vpn.src="lan"
uci set firewall.lan_vpn.dest="vpn"
uci commit firewall
/etc/init.d/firewall restart

Generate password hash for a new VPN client. Set up multi-client VPN server. Use unique credentials for each client.

# Configure VPN service
VPN_USER="USERNAME1"
VPN_PASS="PASSWORD1"
uci -q delete ocserv.client1
uci set ocserv.client1="ocservusers"
uci set ocserv.client1.name="${VPN_USER}"
uci set ocserv.client1.password="${VPN_HASH}"
uci commit ocserv
/etc/init.d/ocserv restart

Automated VPN server installation.

URL="https://openwrt.org/_export/code/docs/guide-user/services/vpn/openconnect/server"
cat << EOF > openconnect-server.sh
$(wget -U "" -O - "${URL}?codeblock=0")
$(wget -U "" -O - "${URL}?codeblock=1")
$(wget -U "" -O - "${URL}?codeblock=2")
$(wget -U "" -O - "${URL}?codeblock=3")
EOF
sh openconnect-server.sh

OpenConnect extras

Introduction

Extras

References

Web interface

Dynamic connection

Disable gateway redirection

Split gateway

IPv6 gateway

DNS over VPN

Kill switch

Multi-client

Automated