How to connect my ubuntu to my workplace, GlobalProtect VPN, using win 7 VM

I want to connect to my work place PaloAlto GlobalProtect VPN. The problem: there is no linux client (or I can use linux but it requires cooperation of the IT group...)

4 Answers

I have recently extended the fantastic open-source VPN client OpenConnect to support the PAN GlobalProtect VPN, both in its SSL-VPN and IPsec/ESP modes.

This is a work in progress, but I've been using it for real work already and it works very well for me. Having other people test it would be awesome and I welcome your feedback!

Build the globalprotect branch from this repository:

... and then run it like this to test it (you can omit the --certificate part if your VPN doesn't use a client certificate):

$ ./openconnect --protocol=gp [--certificate=my_cert_with_pk.pem] \ server.company.com --dump -vvv Please enter your username and password. Username: Password:

Currently it only supports username, password, and optionally client certificate authentication… since that's the only example I have. But I'd welcome feedback if there are other authentication methods in use out there.

PS- For my VPN, the VPN tunnel server is the same as the VPN "portal" server, but your VPN may differ. Try using both the "Portal address" and the "GlobalProtect Gateway IP" shown in the Windows client with OpenConnect:

[ GlobalProtect Windows client ]

My working configuration Linux host ifconfig:

vboxnet0 Link encap:Ethernet HWaddr 0a:ee:27:00:09:00 inet addr:192.168.137.100 Bcast:192.168.137.255 Mask:255.255.255.0 inet6 addr: fe80::800:27ff:fe00:0/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:1340 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:0 (0.0 B) TX bytes:429784 (429.7 KB) wlan0 Link encap:Ethernet HWaddr 82:49:34:1a:a6:e9 inet addr:10.157.48.55 Bcast:10.157.48.255 Mask:255.255.255.0 inet6 addr: fe80::8219:34ff:fe15:a6e9/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:10935 errors:0 dropped:0 overruns:0 frame:0 TX packets:9571 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:6235519 (6.2 MB) TX bytes:2625822 (2.6 MB)

Linux host route:

Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface default 10.157.48.1 0.0.0.0 UG 400 0 0 wlan0 10.0.0.0 192.168.137.1 255.0.0.0 UG 0 0 0 vboxnet0 link-local * 255.255.0.0 U 1000 0 0 wlan0 192.168.137.0 * 255.255.255.0 U 100 0 0 vboxnet0

~$ netstat -nr

Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 10.157.48.1 0.0.0.0 UG 0 0 0 wlan0 10.0.0.0 192.168.137.1 255.0.0.0 UG 0 0 0 vboxnet0 169.254.0.0 0.0.0.0 255.255.0.0 U 0 0 0 wlan0 192.168.137.0 0.0.0.0 255.255.255.0 U 0 0 0 vboxnet0

Windows igconfig:

Ethernet adapter VPN: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::a0fd:e08a:6a52:87db%12 IPv4 Address. . . . . . . . . . . : 10.7.8.23 Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : Ethernet adapter vboxnet0: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::a4bb:6e53:572:5682%13 IPv4 Address. . . . . . . . . . . : 192.168.137.1 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::90de:f93f:b73d:871f%11 IPv4 Address. . . . . . . . . . . : 10.0.2.15 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.0.2.2

(assuming the VPN subnet is "10.0.0.0/255.0.0.0" you can adjust to your needs)

Install win 7 VM.
Install and configure VPN access in the win VM and share the internet connection of the VPN virtual adapter
In virtualbox go to: File -> Preferences -> Network -> Host-only Networks -> add a network and modify it to have the folowing IP 192.168.137.100 *see troubleshooting 1
make a backup of /etc/resolve.conf
(i am now with ubuntu 15.10) set DNS manually in your connection config to be 192.168.137.1 and some other dns which is not in the VM and not in the VPN (e.g your router IP, ISP dns ip etc.). (the old trick was not perfect: replace "nameserver whatever" with "nameserver 192.168.137.1") you can "nslookup google.com" and see the dns IP in the reply
add route - "route add -net 10.0.0.0 netmask 255.0.0.0 gw 192.168.137.1"

Troubleshooting: 1. In the win VM check the IP of the host-only then make sure the vboxnet0 is in the same subnet, try to ping the vbox-net-adapter ip that is in the win machine

I spend some hours in that project and it really works:

I do not understand that today there is android application for Global Project and is not present any solution for Ubuntu or others Linux users.

So, I have to install many packages to perform this steps: