On 2021-05-19 5:52 p.m., Anca, Tibor wrote:
I'm using Fedora 34. For some services I need to connect to my corporate
VPN (Cysco). I use openconnect with NetworkManager, which connects fine
to the vpn server. But there is a weird problem and I can not figure
out, where to change something.
If I use the AnyConnect-Client, the client creates on connect a
resolv.conf and saves the simlink to a backup file which is restored
upon disconnect. After it connects it modifies the resolv.conf with
entries on domain, dns servers etc. So I can call urls only available
within the vpn network.
I i use openconnect (which I prefer, because it keeps my network printer
available), it doenst do almost anything with resolve.conf. It only adds
a search entry, no dns, nothing. In this case I have to enter the ip
address of the services I need within the vpn network. I can resolve
this by adding an entry into hosts.conf, but nevertheless this bugs me.
I already searched the internet, tried a lot with nmcli, systemd-
resolved, but nothing helped. It seems, that openconnect doesn't
populate some vital dns entries.
A good VPN does this on purpose - adding ip addresses to what is on the
corporate network is a very bad thing from a security standpoint. If
you can do that, your admin guys should probably block you. Yes, you
like your local printer, but is it secure like the one at work? And how
about the fileserver under your desk? Is it also regularly scanned and
updated by your work? Adding ip addresses and spoofed hosts that were
thought to be secure just makes a mockery of the corporate security.
Just don't.
_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
