On 2021-05-19 5:52 p.m., Anca, Tibor wrote:
I'm using Fedora 34. For some services I need to connect to my corporate VPN (Cysco). I use openconnect with NetworkManager, which connects fine to the vpn server. But there is a weird problem and I can not figure out, where to change something.
If I use the AnyConnect-Client, the client creates on connect a resolv.conf and saves the simlink to a backup file which is restored upon disconnect. After it connects it modifies the resolv.conf with entries on domain, dns servers etc. So I can call urls only available within the vpn network.
I i use openconnect (which I prefer, because it keeps my network printer available), it doenst do almost anything with resolve.conf. It only adds a search entry, no dns, nothing. In this case I have to enter the ip address of the services I need within the vpn network. I can resolve this by adding an entry into hosts.conf, but nevertheless this bugs me.
I already searched the internet, tried a lot with nmcli, systemd- resolved, but nothing helped. It seems, that openconnect doesn't populate some vital dns entries.
A good VPN does this on purpose - adding ip addresses to what is on the corporate network is a very bad thing from a security standpoint. If you can do that, your admin guys should probably block you. Yes, you like your local printer, but is it secure like the one at work? And how about the fileserver under your desk? Is it also regularly scanned and updated by your work? Adding ip addresses and spoofed hosts that were thought to be secure just makes a mockery of the corporate security. Just don't.