Proxies and VPN

Proxies

Web Proxy

If you're just looking to access library resources like subscription journals, you can make use of the library's web-based proxy.

SSH Tunnel

If you're looking for a quick and dirty way to obtain a VT IP, you can run a secure shell socks proxy using a CVL (ECE) or rlogin (CS) shell account.

VPN

Connecting to the Internet through Virginia Tech's Virtual Private Network (VPN) is the only officially advertised and supported method of accessing certain resources such as VT Network Software from off-campus. Alternatively, you can use SSH tunnels or proxies to obtain a Virginia Tech IP address.

To connect to Virginia Tech's VPN service you have two options:

1. Use the graphical Cisco Secure client offered. To install and use this application see their KB by clicking that link to the left.
2. Setup OpenConnect for the CLI option. Which is detailed below. (There may be a way to tie this into the Network Manager GUI tool, but I haven't gone that far yet)

OpenConnect Install

There is a bug ( Cisco Anyconnect STRAP channel bindings with TLSv1.3 (#659) ) in the repo versions that prevents OpenConnect from connecting to VT's VPN service. This was fixed in the HEAD branch, but that means we need to build and install it from source.

In the following instructions whenever you see USERNAME, replace this with your Linux system's username.

I want to also note that these instructions were tested on Ubuntu linux with the Firefox browser. If you have something different you may need to modify the below instructions to work with your distro.

Build OpenConnect --HEAD from source and configure system

Install GIT if it is not already installed on the system:

sudo apt-get install git

Then clone the source code for OpenConnect --HEAD:

cd $HOME
git clone git://git.infradead.org/users/dwmw2/openconnect.git

The next step is to install required dependencies, then build and install OpenConnect. The script below handles all those tasks. You can copy the below code into a file and run as a script or you can run each command individually in a terminal if you so choose.

#!/bin/bash

# Install dependencies
sudo apt install \
  build-essential gettext autoconf automake libproxy-dev \
  libxml2-dev libtool vpnc-scripts pkg-config zlib1g-dev \
  libp11-kit-dev libp11-dev libssl-dev

# Build
cd openconnect
./autogen.sh
./configure
make && make check
sudo make install && sudo ldconfig

# Verify
openconnect --version

Next download the latest vpnc-script for OpenConnect and make executable.

cd $HOME
wget https://gitlab.com/openconnect/vpnc-scripts/raw/master/vpnc-script
chmod 744 vpnc-script

The command that gets used to connect to the VPN has one portion that requires the use of sudo for the vpnc-script. The sudo credentials prompt tends to get buried in all of OpenConnect’s message output to the terminal window. We can add a line to the sudoers file to avoid getting prompted. Open the sudoers file for editing with the following command:

sudo visudo

(or sudo vi /etc/sudoers if that is your preference)

Now add the following line to end of the sudoers file to allow the user to run the vpnc-script without being prompted for an admin password:

USERNAME ALL=(ALL) NOPASSWD: SETENV: /home/USERNAME/vpnc-script

As the user account does not have permission to create the required /var/run/vpnc directory (and this directory gets deleted every reboot) we need to run the following command to have the system create the directory for us at boot and set some proper permissions:

echo "d /run/vpnc 770 root netdev - -" | sudo tee /etc/tmpfiles.d/vpnc.conf

Add the user to the groups netdev and kvm so they have proper permissions to access certain files and directories:

sudo usermod -a -G kvm USERNAME
sudo usermod -a -G netdev USERNAME

We need to create a TUN/TAP interface device so that it is ready to use by the user and OpenConnect when connecting to the VPN. If we don’t do this OpenConnect will fail as it cannot create this interface for us since it is getting run by the non-root user account. We can have the system create a tun interface at boot for us by creating the following file:

cd /etc/systemd/network/
sudo vi 90-tun0.netdev

Then add the following to this file:

 [NetDev]
Name=tun0
Kind=tun
 [TUN]
Mode=tun
User=USERNAME

Now enable the system-networkd service:

sudo systemctl enable systemd-networkd

And to be safe that everything has taken affect lets do a restart of the system.

Connecting to the Cisco Secure VPN

Below are the commands for connecting to the different VPN Realms (VT-Traffic or All-Traffic):

Connect to VT-Traffic:

openconnect --server=https://vpn.vt.edu/VT-Traffic --useragent=AnyConnect -s 'sudo -E /home/USERNAME/vpnc-script' --external-browser /usr/bin/firefox -i tun0

Connect to All-Traffic:

openconnect --server=https://vpn.vt.edu/All-Traffic --useragent=AnyConnect -s 'sudo -E /home/USERNAME/vpnc-script' --external-browser /usr/bin/firefox -i tun0

If you want to make things easier to type each time you connect, add the above commands as shell aliases.

Once you've run the above command and done the Single-Sign On/Two-Factor authentication in the browser window that opens, you should be connected to the VPN. Just leave the terminal window open that you ran the openconnect command in initially to maintain the VPN connection.

Disconnecting from the VPN

Disconnecting is pretty simple. When done use Ctrl-C in the same terminal window that OpenConnect is running and allow a few seconds for it to close the connection and return to a terminal prompt.

IPsec

See IPsec