Skip to main content
Warning: You are using the test version of PyPI. This is a pre-production deployment of Warehouse. Changes made here affect the production instance of TestPyPI (testpypi.python.org).
Help us improve Python packaging - Donate today!

vpnc-script replacement for easy split-tunnel VPN setup

Project Description

vpn-slice

This is a replacement for the vpnc-script used by OpenConnect or VPNC.

Instead of trying to copy the behavior of the standard Cisco VPN clients, which normally reroute all your network traffic through the VPN, this one tries to minimize your contact with an intrusive corporate VPN. This is also known as a “split-tunnel” VPN, since it splits your traffic between the VPN tunnel and your normal network interfaces.

vpn-slice makes it easy to set up a split-tunnel VPN:

  • It only routes traffic for specific hosts or subnets through the VPN.
  • It automatically looks up named hosts, using the VPN’s DNS servers, and adds entries for them to your /etc/hosts (which it cleans up after VPN disconnection), however it does not otherwise alter your ``/etc/resolv.conf`` at all.

Who this is for

If you are using a VPN to route all your traffic for privacy reasons or to avoid censorship in repressive countries), then you do not want to use this.

The purpose of this tool is almost the opposite; it makes it easy to connect to a VPN while minimizing the traffic that passes over the VPN.

This is for people who have to connect to the high-security VPNs of corporations or other bureaucracies (which monitor and filter and otherwise impede network traffic), and thus wish to route as little traffic as possible through those VPNs.

Requirements

  • Python 3.3+
  • dig (DNS lookup tool; tested with v9.9.5)
  • Linux OS (the iproute2 and iptables utilities are used for all routing setup)

You can install the latest build with pip (make sure you are using the Python 3.x version, usually invoked with pip3):

$ pip3 install https://github.com/dlenski/vpn-slice/archive/master.zip

Usage

You should specify vpn-slice as your connection script with openconnect or vpnc. It has been tested with both OpenConnect v7.06 and vpnc v0.5.3.

For example:

$ sudo openconnect gateway.bigcorp.com -u user1234 \
    -s 'vpn-slice 192.168.1.0/24 hostname1 hostname2'
$ cat /etc/hosts
...
192.168.1.1 dnsmain00 dnsmain00.bigcorp.com         # vpn-slice-tun0 AUTOCREATED
192.168.1.2 dnsbackup2 dnsmain2.bigcorp.com         # vpn-slice-tun0 AUTOCREATED
192.168.1.57 hostname1 hostname1.bigcorp.com        # vpn-slice-tun0 AUTOCREATED
192.168.1.173 hostname1 hostname1.bigcorp.com       # vpn-slice-tun0 AUTOCREATED

or

# With vpnc, you *must* specify an absolute path for the disconnect hook
# to work correctly, due to a bug which I reported:
#   http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2016-August/004199.html
$ sudo vpnc config_file \
       --script '/path/to/vpn-slice 192.168.1.0/24 hostname1 hostname2'

There are many command-line options to alter the behavior of vpn-slice; try vpn-slice --help to show them all.

Running with --verbose makes it explain what it is doing, while running with --dump shows the environment variables passed in by the caller.

Inspiration

jagtesh’s split-tunnelling tutorial gist taught me the basics of how to set up a split-tunnel VPN by wrapping the standard vpnc-script.

apenwarr’s sshuttle has the excellent --auto-hosts and --seed-hosts options. These inspired the automatic host lookup feature.

License

GPLv3 or later.

TODO

  • Fix timing issues
  • IPv6 support?
  • Support OSes other than Linux?
Release History

Release History

This version
History Node

0.1.3

History Node

0.1.2

History Node

0.1.1

History Node

0.1

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
vpn_slice-0.1.3.tar.gz (8.3 kB) Copy SHA256 Checksum SHA256 Source Nov 30, 2016

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting