OpenConnect VPN Client on MacOS

openconnect.md

Unfortunately, the Cisco AnyConnect client for Mac conflicts with Pow causing a grey-screen-of-death kernel panic anytime you connect to the VPN and Pow is installed.

As an alternative, there is OpenConnect, a command-line client for Cisco's AnyConnect SSL VPN.

Here's how to install and set up OpenConnect on MacOS:

1. OpenConnect can be installed via homebrew:

    brew update
    brew install openconnect
   

2. Install the MacOS TUN/TAP driver

3. (Optional) Running openconnect requires sudo, as it affects the resolution of DNS, so it is recommended to add password-less sudo ability for the openconnect command.

    sudo visudo -f /etc/sudoers
   

And added this line:

    %admin  ALL=(ALL) NOPASSWD: /usr/local/bin/openconnect

4. (Optional) When connecting to your SSL VPN, openconnect may complain about a self-signed certificate being in the chain and force you to explicitly accept it every time. The self-signed cert is actually the root certficate and is one with implicit trust (i.e. trusted by browsers), so we can safely trust it by specifying the CA file after exporting it from KeyChain:

5. Determine the name your root certificate (i.e. visit your SSL VPN in Chrome, click the green lock, click "Certificate Information")

6. Open the Keychain Access App

7. Search the "System Roots" keychain to find your root certificate and select it

8. File > Export Items... the certificate as a .pem file somewhere on your hard drive (I put it in ~/.ssh/<certificate name>.pem

9. Connect

    sudo openconnect --user=<VPN username> --cafile=<.pem file from step 4.3> <your vpn hostname>
   

   The only thing you should be prompted for is your VPN password, add the command to the aliases file.

10. To disconnect, press Ctrl-c in the window where you inititated the VPN connection.