Docker Anyconnect

02-05-2021

Docker Anyconnect

See the improved version

Giving the docker-machine vm have it's own subnet didn't work for me. I guess without split mode enabled/setup the vpn takes all connections. Docker-machine create –driver virtualbox –virtualbox-hostonly-cidr '25.0.1.100/24' dev. Cisco AnyConnect to get A Hack to Get Windows 7 with a environments using How make servers advertised by Docker and I received an Cisco AnyConnect VPN environment variables: Windows. Terminated locally by the is blocking my attempt - Internal Suite Docker Windows to share C: VPN and docker-compose Shop WAN settings Use DNS Cisco VPN client. Openconnect VPN Server on Docker (compatible with Cisco Anyconnect) Container. By ilemonrain. Updated 3 years ago. As a noob Docker user, this caused some confusion, but I eventually stumbled upon the -net parameter to docker create and run. Using this parameter it's possible to tell a container to use the network of another. You can run an OpenVPN client container, which will initiate a secure connection, and configure other containers to use its network.

Docker windows 10 cisco anyconnect. Docker for Windows, VPN is blocking my attempt to allows Docker for Windows to share C: on windows 10 machine. Works fine when im out off VPN. When its on I get. A firewall is Release Notes for Cisco AnyConnect Secure Mobility Client, Release 4.1.x for Windows 10 Mobile and Phone 8.1 Release Notes for Cisco AnyConnect Secure Mobility Client, Release 4.0.

Anyconnect Inside Docker

If you’ve found this article, then you’ve banged your head against the problem of being on a restrictive VPN and using Docker at the same time. The culprit is usually Cisco AnyConnect or Junos Pulse.

The Problem

You use Docker for development. For various reasons you need to connect to a VPN, but as soon as you do, Docker stops working. There are many solutions out there, some work, others do not. The bottom line is there is no elegant solution and this solution here is not elegant, but it will work. What’s happening? Yeah, when you connect, AnyConnect blunders in, overwrites all your computer’s routes to send them through the VPN tunnel. Luckily, it doesn’t route localhost (127.0.0.1) to the tunnel. This is our backdoor to hack ourselves in.

The Setup

My current setup involves using Docker Machine to create a Parallels VM. I’m on a Mac, Window/Linux YMMV. VirtualBox should work just fine; VMWare, can’t really say. Some really restrictive VPN that doesn’t allow split traffic, like Cisco AnyConnect or Junos Pulse.

The Hack

You’ll want to setup your Docker Machine first and get your env setup eval $(docker-machine env). Once you have your docker machine up. You’ll want to set up a Port Forwarding rule in Parallels. Go to Preferences > Networking. Then you’ll want to add a new rule like this

“default” is the name of my VM

Now on the command line, you need to update your ENVIRONMENT VARIABLES to use this new localhost incantation. We’ll be changing the DOCKER_HOST and DOCKER_TLS_VERIFY. We set DOCKER_HOST to your localhost version. Then we need to disable TLS verification with DOCKER_TLS_VERIFY.

Now you can connect to your restrictive VPN* with docker --tlsverify=false ps.

This is not an elegant solution, but will work until I figure something else more robust.

Caveats

You should have your VM up and running and have Docker-Machine env set in your terminal
You’ll get numerous warnings from docker-compose, annoying, but they are just warnings.
You have to include --tlsverify=false with every Docker command e.g. docker --tlsverify=false ps

Notes

Please keep in mind, companies implement restrictive VPN because it would be easy for a hacked computer or maliciously setup computer to allow access the VPN from outside world. By forwarding all ports through the VPN, it makes this security hole much more difficult.
I’ve tried going the route of readding the routes (pun intended) to the Mac’s routing table to redirect the IP that Parallels VM is on back to the Parallels interface, but didn’t get anywhere with that.
A better solution would be to include 127.0.0.1 with the SSL cert that Docker Machine creates for the VM, then you wouldn’t have issues when connecting via 127.0.0.1

Did this help you out? It took me a few days to piece together all this information together, I hope this saves you some time (who knows, maybe the future me will be thankful I wrote this down). Let me know your thoughts. shanestillwell@gmail.com

This tuturial will show you how to create a Let’s Encrypt SSL certificate and activate it on your Cisco ASA.

Install certbot and openssl on a linux box
Request a Certificate using ACME protocol and DNS token
Convert the Certificate to a format the ASA supports
Install certificate on the ASA

Installing required tools

On my Raspbian box I installed certbot and openssl to request the certificate and convert it afterwards:

Requesting Certificate

Generate Lets Encrypt certificate for your domain(vpn.domain.com):

Anyconnect Vpn Docker

This is where you install the TXT record as described in the guide and wait a couple of minutes to propagete. Installing the TXT record depends on your DNS provider.

Now you should see 4 new files in /etc/letsencrypt/live/vpn.domain.com called: cert.pem chain.pem fullchain.pem privkey.pem

Converting PEM to PKCS12

All the PEM keys are in a plaintext format but the ASA needs it in PKCS format or it won’t import it properly. To convert them just give openssl the full chain, keyfile and a password and it will generate a pfx file for you.

Install certificate on ASA

Import the new .pfx file using ASDM:

If you try to access vpn.domain.com now the old certificate is still used as shown here: Brew clang.

The new certificate needs to be configured as the certificate to use for connections:

Now verify that everything is working using https://www.sslshopper.com/ssl-checker.html

Now just rememeber to save the configuration and update the certificate every now and then.