https://wiki.nixos.org/w/index.php?action=history&feed=atom&title=OpenConnectOpenConnect - Revision history2026-05-30T13:42:40ZRevision history for this page on the wikiMediaWiki 1.45.1https://wiki.nixos.org/w/index.php?title=OpenConnect&diff=32122&oldid=prevOnny: Initial page2026-05-30T09:20:22Z<p>Initial page</p>
<p><b>New page</b></p><div>[https://www.infradead.org/openconnect/ OpenConnect] is a free, open‑source client‑to‑site VPN that works with many commercial SSL‑VPN gateways, such as Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure (including Pulse Connect Secure), Juniper Network Connect, Fortinet, F5 and Array Networks.<br />
<br />
== Setup ==<br />
Following example configures a permanent VPN connection using OpenConnect using the protocol <code>anyconnect</code>.<syntaxhighlight lang="nix"><br />
openconnect.interfaces.myvpn = {<br />
gateway = "vpn-ac.uni-heidelberg.de/2fa";<br />
protocol = "anyconnect";<br />
user = "myuser";<br />
passwordFile = "/etc/secrets/openconnect-secret";<br />
extraOptions = {<br />
useragent = "AnyConnect";<br />
non-inter = true;<br />
};<br />
};<br />
</syntaxhighlight>Further you can also provide TOTP secrets for two-factor-authentications (which should be <u>avoided in production</u> environments since it decreases the security concept drastically) and use <code>vpn-slice</code> to achieve split tunneling instead of routing all traffic through the VPN gateway.<syntaxhighlight lang="nix"><br />
openconnect.interfaces.myvpn = {<br />
[...]<br />
extraOptions = {<br />
token-mode = "totp";<br />
token-secret = "base32:ABC123";<br />
script = "${pkgs.vpn-slice}/bin/vpn-slice 129.206.0.0/16";<br />
};<br />
};<br />
</syntaxhighlight><br />
<br />
[[Category:Networking]]<br />
[[Category:VPN]]</div>Onny