ocproxy - lwip based proxy for openconnect
This manual page documents briefly the ocproxy command.
ocproxy is a program that provides a SOCKS and
port-forwarding proxy when used in conjunction with openconnect(1).
When using ocproxy, OpenConnect only handles network activity that the user
specifically asks to proxy, so the VPN tunnel no longer "hijacks"
all network traffic on the host.
ocproxy accomplishes this by running a lwIP network stack
in userland, so the OS kernel is no longer directly handling packets sent to
and from the VPN connection.
ocproxy should be invoked directly from OpenConnect or
another VPN program; a file descriptor number is passed through the
VPNFD environment variable to tell ocproxy how to send and
receive VPN traffic. For example:
openconnect --script-tun --script "ocproxy -D 11080
-L2222:unix-host:22" vpn.example.com
Commonly used options include:
- -D, --dynfw
[bind_address:]port
- Start up a SOCKS5 server on TCP port port to dynamically forward
application-level traffic over the VPN proxy. This is intended to resemble
the -D option to ssh(1). If bind_address is
unspecified, ocproxy will bind to the loopback interface by default
unless --allow-remote is used.
- -L, --localfw
port:host:hostport
- Bind to port local TCP port port, and forward incoming connections
to host:hostport on the VPN. host can be a DNS name or a
dotted-quad IP address. If the VPN supplied a default DNS domain name or
--domain was specified on the command line, unqualified hostnames
may be used. This is intended to resemble the -L option to
ssh(1).
- -g, --allow-remote
- Local listening sockets opened by the --dynfw and --localfw
options, by default, will be bound to the loopback interface only
(127.0.0.1) so they are only available on the local machine. If
--allow-remote is specified, the sockets will be bound to
INADDR_ANY (0.0.0.0) instead, and other hosts may connect to them.
This is intended to resemble the -g option to ssh(1).
- -k, --keepalive
interval
- Send a TCP keepalive packet every interval seconds on each open
connection, on the VPN side. This can help avoid idle timeouts, both on
the VPN gateway and on any stateful firewalls in between the two ends.
These options may be useful for debugging ocproxy or
diagnosing problems:
- -v, --verbose
- Enable verbose debugging output.
- -T, --tcpdump
- Write a log of all TCP or UDP packets traversing the VPN to
/tmp/tcpdump. The format largely mirrors the output of the
tcpdump(8) utility.
ocproxy will normally retrieve IP configuration parameters
through environment variables provided by OpenConnect. These options may be
used to override the autodetected parameters:
- -I, --ip
local_ip
- Use local_ip for the VPN side IP address. Example: 192.168.5.20.
This is normally set through the INTERNAL_IP4_ADDRESS environment
variable.
- -M, --mtu
mtu_bytes
- Use mtu_bytes as the maximum transmit unit on the VPN interface; it
generally depends on DTLS and UDP packet overhead. Example: 1300. This is
normally set through the INTERNAL_IP4_MTU environment variable.
- -d, --dns
dns_ip
- Send all VPN side DNS queries to server dns_ip. Example:
192.168.5.2. This is normally set through the INTERNAL_IP4_DNS
environment variable.
- -o, --domain
domain
- Use domain as the default DNS domain, for unqualified hostnames.
This is normally set through the CISCO_DEF_DOMAIN environment
variable.