How do I configure the firewall for OpenConnect interface?

kingkong · 2021-10-06T10:48:49.391Z

Hello,

I’m afraid I need step-by-step instructions on how to set up openconnect on the GL-MT300N-V2.
What I have managed to do so far:

My openConnect server is running on a RaspBerry PI 3B+.
The openconnect server uses a Let’s Encrypt certificate.

With the ios app Cisco AnyConnect I can connect to the Raspberry, and the iPhone’s internet traffic then runs through the RaspBerry as well.

The GL-Inet runs in repeater mode, i.e. an existing WLAN is used, and the GL-Inet opens its own WLAN.

On the GL-Inet the Luci console has to be installed - I did that.

Via the Luci console I installed luci-proto-openconnect.
This also installs the openconnect package.

Via Luci → Network-> Interfaces I created a new interface with the self chosen name “VPN”.

In the configuration I only have to enter the address of my OpenConnect server, the username and the password.

But how do I proceed now ?

How do I run the WLAN traffic and the LAN cable over OpenConnect ?

I have already tried some instructions, but nothing works.

Translated with DeepL Translate: The world's most accurate translator (free version)

alzhao · 2021-10-06T12:08:00.656Z

Did Openconnect actually connect to your server?

As far as I know, if you use MT300N-V2, there is not enough space to install openconnect. You may need to use an USB key and use exroot to install everything on the USB.

After openconnect actually build the turnnel, you should see network interfaces and you can add firewall rules to route the traffice.

kingkong · 2021-10-07T13:26:52.369Z

Bildschirmfoto 2021-10-07 um 12.33.04989×797 101 KB

How do i configure firewall/routing ?

alzhao · 2021-10-08T07:59:35.851Z

Can you show the firewall section?

alzhao · 2021-10-08T08:06:20.908Z

Here is my settings when using openvpn for your reference.

image1014×679 53.3 KB

image1024×966 51 KB

image1005×901 56.6 KB

image1042×842 53 KB

image945×1211 92.3 KB

alex916 · 2023-05-24T08:16:06.519Z

Did it work , i followed this tread but i still can’t get to navigate with my vpn if i try to ping i get destination unreachable.

Many thanks

alzhao · 2023-05-24T08:36:20.307Z

This thread does not contains guide for open connect.

Here is a guide OpenWRT 路由器 OpenConnect VPN 详细图文教程 - 基础配置篇 - 思有云 - IOIOX

You can use Google translation to read it.

alex916 · 2023-05-24T12:29:31.312Z

@alzhao Hi but the screenshots are of the openconnect plugin installed on the GL.iNet or not? I have installed the openconnect plugin and then access by lucid to the web interface, configured the vpn (Anyconnect Cisco) that has interface has its on IP, but i can’t let my pc gather the ip from this interface dhcp anche then surf by the VPN has written in my post GL-MT300N-V2 Openconnect CISCO i think i don’t make the good firewall, nat and tunnel configuration, or it is not possibile?

alzhao · 2023-05-24T12:50:49.482Z

Sorry the guide is for server, not client.

You can post all of your firewall settings to have a check.

alex916 · 2023-05-24T13:40:07.903Z

@alzhao many thanks, i missed that was for server non client.
this is my interface

interface11191×822 48.3 KB

this is my firewall

interface 21118×769 29.5 KB

but if i try to ping 8.8.8.8 i get that “destination port is unreachable” 192.168.8.1

many thanks

alzhao · 2023-05-24T13:44:20.910Z

The openconnect Interface zone is “CISCOVPN”, not openvpn. YOu can change all the openvpn to CISCOVPN in the firewall zone?

alex916 · 2023-05-24T13:47:39.791Z

It’s only a custom name of the cisco configuration given in af firewall zone
interface3

interface4
but it is using the cisco protocol for VPN

I can change it ,if it effects the result