In order to access the enterprise intranet remotely, we have to use the Cisco AnyConnect VPN client. We're allowed to install it on any personal machines, and they provide downloads and instructions for Windows, Mac and Linux. This works fine except for the routing table configurations they provide.

They route everything except the and (that's not a typo) subnets over the VPN. This is baked into the client and I can't find a way to change it. All I really need are ports 80, 443 and 22 for a small Class C subnet routed through the VPN tunnel.

Is there a way to change the routing table configurations? Barring that, would it be possible to setup a linux VM with an HTTP/S proxy and SSH that route over the VPN tunnel?

  • I don't understand the problem you're trying to solve. Can you restate your question? – joeqwerty Jul 25 '16 at 16:01
  • @joeqwerty : The VPN is pushing almost all traffic down the VPN tunnel unnecessarily. So any internet bound traffic is being pushed through the VPN tunnel and private network addresses that aren't valid on the intranet. This is a huge bottleneck since the VPN throughput is severely constrained. – MyItchyChin Jul 25 '16 at 16:26

It doesn't allow split tunnels. This is a security feature of the VPN software. Allowing split tunnels puts the business network at risk because this can be used to bypass the firewall. The software actively monitors host routing changes, and it will reverse changes made to the host routing.

  • 1
    I disagree that a split tunnel puts them at risk. The Web Security Agent (local firewall) runs by default regardless of the status of the Secure Mobility Agent (the VPN). Both can be disabled or removed, because they're installed on unmanaged machines. So there's a risk that the machine can be compromised and then connect to the VPN. – MyItchyChin Jul 25 '16 at 16:31
  • 2
    The risk is that you could use the tunnel from inside the firewall at the business site to get to things on the Internet which are forbidden by policies and protections on the firewall. It really doesn't matter whether or not you disagree, that is why the software was designed that way, and how it works. – Ron Maupin Jul 25 '16 at 16:36
  • Could you elaborate on how you could use split tunneling to circumvent the firewall at a business site? We're talking about off-site unmanaged clients connecting to a VPN. – MyItchyChin Jul 25 '16 at 16:45
  • It is the equivalent of allowing a PC at the business to have a separate connection to the Internet. The PC could be configured to allow others to go through it to the Internet. This makes the business firewall and Internet policies moot. Your offsite PC is directly connected to the business network while using the VPN, just as if it was connected at the business site. When you disconnect the tunnel, your routing returns to normal. Cisco designs the software for businesses, not end-users. – Ron Maupin Jul 25 '16 at 16:50
  • Those aren't equivalents. VPN users should be treated as hostile and relegated to a subnet on your network with limited routing on the intranet. The Cisco VPN supports this and actually allows account level restrictions. Additionally the clientside routes are not defined by Cisco, they're defined by the network admin deploying the production. The VPN client also comes with a separate Firewall solution that is required to be running while the VPN client is running, but can be disabled when the VPN client is disabled. – MyItchyChin Jul 25 '16 at 17:02

Since the routing has to allow for TCP packets towards the VPN server, you can use clever NAT rules and software like SSLH to multiplex additional streams (such as SSH with tunnels) on this by-design hole.

See details here for step-by-step instructions and how/why this works

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.