OpenConnect - Revision history

Onny: Fix vpn-slice usage for NixOS env

2026-09-01T22:35:40Z

Fix vpn-slice usage for NixOS env

← Older revision		Revision as of 22:35, 1 September 2026
Line 19:		Line 19:
	token-mode = "totp";		token-mode = "totp";
	token-secret = "base32:ABC123";		token-secret = "base32:ABC123";
	script = "${lib.getExe pkgs.vpn-slice} 129.206.0.0/16";		script = "${lib.getExe pkgs.vpn-slice} --no-ns-hosts --no-host-names 129.206.0.0/16";
	};		};
	};		};
	</syntaxhighlight>		</syntaxhighlight>

			We need to add <code>--no-ns-hosts --no-host-names</code> to <code>vpn-slice</code> since on NixOS <code>/etc/hosts</code> is read-only.
	[[Category:Networking]]		[[Category:Networking]]
	[[Category:VPN]]		[[Category:VPN]]

Onny: add missing networking namespace before openconnect option

2026-09-01T12:43:14Z

add missing networking namespace before openconnect option

← Older revision		Revision as of 12:43, 1 September 2026
Line 3:		Line 3:
	== Setup ==		== Setup ==
	Following example configures a permanent VPN connection using OpenConnect using the protocol <code>anyconnect</code>.<syntaxhighlight lang="nix">		Following example configures a permanent VPN connection using OpenConnect using the protocol <code>anyconnect</code>.<syntaxhighlight lang="nix">
	openconnect.interfaces.myvpn = {		networking.openconnect.interfaces.myvpn = {
	gateway = "vpn-ac.uni-heidelberg.de/2fa";		gateway = "vpn-ac.uni-heidelberg.de/2fa";
	protocol = "anyconnect";		protocol = "anyconnect";
Line 14:		Line 14:
	};		};
	</syntaxhighlight>Further you can also provide TOTP secrets for two-factor-authentications (which should be <u>avoided in production</u> environments since it decreases the security concept drastically) and use <code>vpn-slice</code> to achieve split tunneling instead of routing all traffic through the VPN gateway.<syntaxhighlight lang="nix">		</syntaxhighlight>Further you can also provide TOTP secrets for two-factor-authentications (which should be <u>avoided in production</u> environments since it decreases the security concept drastically) and use <code>vpn-slice</code> to achieve split tunneling instead of routing all traffic through the VPN gateway.<syntaxhighlight lang="nix">
	openconnect.interfaces.myvpn = {		networking.openconnect.interfaces.myvpn = {
	[...]		[...]
	extraOptions = {		extraOptions = {

Onny at 10:07, 1 September 2026

2026-09-01T10:07:12Z

← Older revision		Revision as of 10:07, 1 September 2026
Line 19:		Line 19:
	token-mode = "totp";		token-mode = "totp";
	token-secret = "base32:ABC123";		token-secret = "base32:ABC123";
	script = "${pkgs.vpn-slice}~~/bin/vpn-slice~~ 129.206.0.0/16";		script = "${lib.getExe pkgs.vpn-slice} 129.206.0.0/16";
	};		};
	};		};

Onny: Initial page

2026-05-30T09:20:22Z

Initial page

New page

[https://www.infradead.org/openconnect/ OpenConnect] is a free, open‑source client‑to‑site VPN that works with many commercial SSL‑VPN gateways, such as Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure (including Pulse Connect Secure), Juniper Network Connect, Fortinet, F5 and Array Networks.

== Setup ==
Following example configures a permanent VPN connection using OpenConnect using the protocol <code>anyconnect</code>.<syntaxhighlight lang="nix">
openconnect.interfaces.myvpn = {
gateway = "vpn-ac.uni-heidelberg.de/2fa";
protocol = "anyconnect";
user = "myuser";
passwordFile = "/etc/secrets/openconnect-secret";
extraOptions = {
useragent = "AnyConnect";
non-inter = true;
};
};
</syntaxhighlight>Further you can also provide TOTP secrets for two-factor-authentications (which should be <u>avoided in production</u> environments since it decreases the security concept drastically) and use <code>vpn-slice</code> to achieve split tunneling instead of routing all traffic through the VPN gateway.<syntaxhighlight lang="nix">
openconnect.interfaces.myvpn = {
[...]
extraOptions = {
token-mode = "totp";
token-secret = "base32:ABC123";
script = "${pkgs.vpn-slice}/bin/vpn-slice 129.206.0.0/16";
};
};
</syntaxhighlight>

[[Category:Networking]]
[[Category:VPN]]