OpenConnect

OpenConnect is a free, open‑source client‑to‑site VPN that works with many commercial SSL‑VPN gateways, such as Cisco AnyConnect, Palo Alto GlobalProtect, Pulse Secure (including Pulse Connect Secure), Juniper Network Connect, Fortinet, F5 and Array Networks.

Setup

Following example configures a permanent VPN connection using OpenConnect using the protocol anyconnect.

networking.openconnect.interfaces.myvpn = {
  gateway = "vpn-ac.uni-heidelberg.de/2fa";
  protocol = "anyconnect";
  user = "myuser";
  passwordFile = "/etc/secrets/openconnect-secret";
  extraOptions = {
    useragent = "AnyConnect";
    non-inter = true;
  };
};

Further you can also provide TOTP secrets for two-factor-authentications (which should be avoided in production environments since it decreases the security concept drastically) and use vpn-slice to achieve split tunneling instead of routing all traffic through the VPN gateway.

networking.openconnect.interfaces.myvpn = {
  [...]
  extraOptions = {
    token-mode = "totp";
    token-secret = "base32:ABC123";
    script = "${lib.getExe pkgs.vpn-slice} --no-ns-hosts --no-host-names 129.206.0.0/16";
  };
};

We need to add --no-ns-hosts --no-host-names to vpn-slice since on NixOS /etc/hosts is read-only.