Re: [Announce] OpenConnect (-GUI) VPN client
 

If your company is using cisco ssl,then you need openconnect. You will know what to do when you run openconnect.

Re: [Announce] OpenConnect (-GUI) VPN client
 

I just wanna use it at home....Can't I do that?? Or may be use some other application...

Re: [Announce] OpenConnect (-GUI) VPN client
 

Try OpenVpn

Re: [Announce] OpenConnect (-GUI) VPN client
 

Hi there, I´m new to Maemo, and I´m trying to configure the VPN. but when I used the -csd-user option, and run the program, it says >> Invalid user <user>.

And when i don´t use the --csd-user, it´says that i should.

At first I was using the GUI, but it was giving me the error about having to use the --csd-user option, so now i´m trying directly from the terminal, since i didn´t know how to edit the GUI.

Thanks..

Re: [Announce] OpenConnect (-GUI) VPN client
 

Any news on the group function for openconnect?
I badly need it!

Re: [Announce] OpenConnect (-GUI) VPN client
 

Me too... :(

Re: [Announce] OpenConnect (-GUI) VPN client
 

very good and simple program BUT there is no group function, so atm the gui is useless to me.

so please implement that feature!

Re: [Announce] OpenConnect (-GUI) VPN client
 

Is there any chance of a custom switch field where one can add custom switches that are run by openconnect.

Re: [Announce] OpenConnect (-GUI) VPN client
 

ok i got it NEARLY working; in xterm enter:
but then it's not working, even disabling dtls via does not work.

any ideas? :confused:

Re: [Announce] OpenConnect (-GUI) VPN client
 

Hello everybody,

since I achieved a connection with the network of my Universty through OpenConnect, I'm experiencing DNS issues with MicroB. I can't stablish any Kind of connection successfuly (WiFi, GPRS, 3G). The N900 conects to the to the network but I cannot access any Webpage. It seems that OpenConnect changed something on the Code. I tried this solution http://talk.maemo.org/showthread.php?p=891595 but that didn't work. I'de be very thankful for any Help

Cheers

Re: [Announce] OpenConnect (-GUI) VPN client
 

some more feedback

- on the OpenConnect GUI. When entering both userID and password and trying to connect to the created profile, it continuously say "no server specified".
Can you include (in the log window) also the complete Openconnect command invocation string to see what might be wrong? Easier in troubleshooting.

As a double check, when using the command line I can make a proper connection so I know my parameters are correct.

As requested before, can you also provide a custom input field for extra switches (as the --no-dtls)?

Which post-connection script is being used by default by the GUI ? I'm using the /etc/vpnc/vpnc-script in my command line string but I only have that file (I guess) because I also installed the vpnc package. Maybe the previous post also has to do with the proper setup (or absence) of the post-connect script?

On the command itself, is it possible to upgrade the version to 2.26, the currently supplied version 2.12 works but is already a year old, if you update the gui, make you can as well put the most recent version of the main code in as well.

Lots of thanks for the work so far, it opened up my access to the office network without laptop. I don't know if that's always such a great idea though :D

At least it give me choices now where to do what. And the possibility to do my labour claim straight on my N900, wherever I am, at a Friday noon ... yeah ! That will save me a few mails from my manager !!

Re: [Announce] OpenConnect (-GUI) VPN client
 

just noticed something, the upgrade of the OpenConnect command itself can potentially also solve the request people have needing to use the UserGroup feature :

From http://www.infradead.org/openconnect.html

Just a thought for an quick-fix... :)

Re: [Announce] OpenConnect (-GUI) VPN client
 

well, good ideas, but lorelei isn't working here anymore (it is a pitty, when you got someone making good software, he stops).
here is the howto on linux machines (but, as i am from germany, it is german)

but back to topic:
we ve got a vpn at our uni, which is using the anyconnect client on win7 and vista, so i thought openconnect should do the job.
but it isn't; so, what am i doing wrong?
also taking out the no-dtls command and/or the no-ipv6 didn't work.

thanks for every help!

Re: [Announce] OpenConnect (-GUI) VPN client
 

Well, I'm not completely away...last few months I was more in lurking mode with no time to interact...

Honestly I don't know as of now if I will ever have the time to continue working on openconnect+gui, since I have concentrate myself more on Erminig (Google calendar sync). There are also other issues that I can't disclose for the moment, which will prevent me working efficiently on OpenConnect.

-lorelei

Re: [Announce] OpenConnect (-GUI) VPN client
 

ah, damn that wasn't the answer i was hoping for ;)
(but it is good, that the maemo community hasn't lost someone with skills)

it would probably take too much time updating the maemoversion? :o
(yes of course it would, but there is still a little hope)

Re: [Announce] OpenConnect (-GUI) VPN client
 

Possible, but I don't see the point, since:

1) I don't see any Maemo client
2) How does it solve the problem for those logging on corporate/academic network that have to use their VPN concentrators?

Is this some kind of advertisement for purevpn?

Re: [Announce] OpenConnect (-GUI) VPN client
 

lol it has to be, just look at the name... what a damn bad try of advertising...

doesn't look very if advertising in
a) wrong forum (its maemo, *****)
b) forums in general

Re: [Announce] OpenConnect (-GUI) VPN client
 

can the source for openconnect-gui be shared ? I would like to modify it to include the extra fields/options and the full commandline as executed inb the debugwindow. i really would like to make this gui useful for me :)
tnx

Re: [Announce] OpenConnect (-GUI) VPN client
 

@Netweaver
http://repository.maemo.org/extras-d...enconnect-gui/

Re: [Announce] OpenConnect (-GUI) VPN client
 

thanks. My first attempt is attached (version 0.5-7) :)

Note that due to the way the arguments are parsed, only one extra option is possible.

this is my first coding effort in Maemo/scratchbox, it's no more then an intelligent cut-paste-change exercise for now. But the end-result sure helps me and might help other people as well.

I might try to port the latest version of openconnect (2.2x), apply the same kind of mods/logic as the maemo-fied 2.12 version. But that's something for later :)
Also, for the future, the GUI might need a rewrite in Qt Quick ... but that's still a (few) bridge(s) to far, one step at a time is good enough for me :)

I don't have a garage account yet and I've never submitted anything to the autobuilder so that's another hurdle to take.
Also, there's no need for me to fork this piece of work, I rather work together with Lorelei to get my patches into the original garage code.

Please test and see if it does what you want. Open to all suggestions/bug reports/requests.

Re: [Announce] OpenConnect (-GUI) VPN client
 

i ll test it tomorrow... thanks for the work!

edit: i didn't :o
but looking good, now i made an alert to remind me testing the new stuff :D

Re: [Announce] OpenConnect (-GUI) VPN client
 

some updates:
I patched and compiled the latest version of openconnect 2.26 and it works!

BUT (there's always a but ...)

I need some help here. I'm still on PR1.2 (lazy, I know) and the SDK is on PR1.3. When I'm building the DEB file, it receives a dependency of libssl >=0.9.8m.

So it doesn't install on mine,as I have a version 0.9.8e from PR1.2.
But when looking in details at my libssl package in FAP, I see there's now a 0.9.8n version available. I upgraded to that one (it also upgraded openssl alongside) and as expected, it now accepts and installs my new openconnect 2.26 DEB.

Can people check if libssl 0.9.8n is indeed the version supplied with PR1.3 ?

First hurdle taken.

Then, when connecting via the openconnect-gui, using the 2.26 version (no other changes), I'm getting a nice error log message about the server certificate not being verifiable due to missing local issuer certificate and asking if I want to accept the certificate anyway. Of course, the openconnect-gui doesn't handle this user input situation.

When running openconnect in xterm, I can enter 'yes' and it connects fine to my VPN server, all fine, as planned.

I think I can also override this check when calling the openconnect command, executed by the openconnect-gui, so there is no user issue with this. It might be a bit less safe. But not less safe than when using the current 2.12 solution, as that one doesn't care at all about the server certificate anyway :)
Do people like this proposed (eyes closed) behaviour ?

The very good thing about the new openssl 0.9.8n version is the fact it seems to allows DTLS :) No need for the default option (--no-dtls) anymore. Yes !!
This should allow performance gains in dropped packets environments, like 3G connections :D

Of course further testing should happen, as there were some other strange messages on screen, about a dead peer. The connection is made fine though, data routed through the VPN.
I'll look into that issue if proven troublesome for some.

So if people confirm the version in PR1.3 and the preferred wanted behaviour concerning the accepting of the server certificate, I can make then make the required changes and get a new GUI version out.

For people who want to follow along, here's the latest, working openconnect 2.26 DEB.

Again, all requests/info is welcome. if time permits, I'll work on them :)

ps. I really need to get my stuff in garage now, getting it properly registered and using autobuild !
Maybe when I have a version of both packages, where people are happy with...

ps2. Maybe I can create my own openconnect VPN status applet, such as the one from VPNC :D

Re: [Announce] OpenConnect (-GUI) VPN client
 

hi i am using pr1.3 and xterm gives me this
(btw your new version of openconnect installs flawlessly)

Re: [Announce] OpenConnect (-GUI) VPN client
 

thanks. That confirms already the version.

On the dtls side, it seems I've been cheering too quickly. It looks as if it's starting in dtls mode (via xterm) but when there's a network glitch, it gets a write error and it reconfigures the vpn link into SSL. So either the openssl in PR1.3 is still (partly) broken in terms of dtls support, or there is something else wrong. Anyhow, my latest gui has the --no-dtls still as a default option so no problem there.

also, in my latest gui, to avoid the servercheck, you can enter the --no-cert-check as the free option in the gui/profile, then everything connects fine, no errors/user input request anymore.
Of course it kills the possibility of specifying the usergroup in there, temporarily.

So if I don't hear objections, I'll create a new GUI, also containing this --no-cert-check option as a default.

Can people also test their connectivity, straight from xterm and via the gui ? Just wondering if the open issues people had improved by my porting of the latest version.

Re: [Announce] OpenConnect (-GUI) VPN client
 

ok, here is my xterm output:
another problem is that i cannot enter my password, i have to open a new xterm and copy the password from there.

via the gui it wasn't possible, because i need the group feature (authgroup), so it stopped at selfsigned cert or the wrong group.

nevertheless thanks for continuing the work on openconnect!

Re: [Announce] OpenConnect (-GUI) VPN client
 

Hi Sirpaul,
I think you're pretty close, at least on the commandline. For the gui version I need to make a change in the code. I'll try to do that asap.

You forgot to include the script, as the openconnect program wants to tell you:
This was probably your problem already with the previous version 2.12, if I recall well. At least now I know (a bit) where to look :D

This is a -technically- working commandline for me, you only need to add the proper Authgroup parameter and you'll be good to go, all on one line of course ... :

The "--background --syslog --no-deflate" part is optional for me. For you, just add the authgroup=abc and replace the proper variables and you're fine. You were just missing the reference to the script (borrowed from the vpnc package) which sets up all default routes etc ...

I'll start changing the gui code now, maybe by tomorrow I'l have a more flexible way of entering default (cross-profile) parameters. brrr, it's getting a bit more real now :)

What's the issue with the entering of the password in the 2.26 version ? My password (all kind of chars) is accepted fine, in gui and straight in xterm?

The maemo version of Openconnect (already as of 2.12) has a feature NOT found in the official openconnect version: the possiblity to add the password straight on the command prompt. That's how the gui works ...

Re: [Announce] OpenConnect (-GUI) VPN client
 

OMG it is working!!!!!
never thought it would ever be going to happen...
THANKS! you ve made my month!
(lol, did not even think, that i was that close...)

i just added the passwd option, it worked pretty well.
connectivity works fine, but i am just using it for some minutes.
(atm i am using my unis vpn!).

EDIT
i ve tested more and it still works good.
i had one problem when the connection was a bit strange, but a reboot did it; besides that, i haven't spotted any errors.

Re: [Announce] OpenConnect (-GUI) VPN client
 

Thanks. I have uploaded the openconnect and openconnect-gui into extras-devel. This is my first upload, the building went fine. I'm not an experienced Debian package maintainer so bare with me when things might not be 100% according to the book.

The gui package uploaded in the repository differs from the .DEB as I already posted in this thread only in the 2nd default parameter, the one to disable server cert verification. The openconnect package itself is the same as the .DEB included by me in this thread.

'Normal' people should get an upgrade notice in FAP, early adopters who installed already the thread versions, might have to do a --reinstall (or remove & install) to get the latest repository versions.

Please let me know how things are going.

The "real" flexible way of entering 'random' cross-profile params will take a bit longer. That's why I released this quick fix for the gui. It will be enough (I think) for at least 80% of all N900 openconnect users :)

Re: [Announce] OpenConnect (-GUI) VPN client
 

the gui is now working flawlessly for me, after entering the authgroup parameter.

BUT i had an issue that after several times connecting to wlan + connecting to the vpn via gui openconnect was not starting via gui neither via xterm; a reboot solved iit for the moment. but dont know how to re-do it. (but thats something i can live with) ;)

Re: [Announce] OpenConnect (-GUI) VPN client
 

mmmm, a bit lost on the possible reason for the non-starting openconnect. I haven't seen this odd behaviour yet.

When it happens, can you provide me here a full log from the xterm, using the --verbose parameter as well?
I can then have a look (positive thinking) if I can see something weird.

If not, I might have to take it upstream, to the openconnect devs, fur further investigation.

Thanks for testing and glad you like it so far. With all the storms around Nokia/Microsoft/Meego now, we can only try to make our N900 as good as possible and prolong it's life, as I don't think there's a real alternative yet :)

Re: [Announce] OpenConnect (-GUI) VPN client
 

hi it is me again.
openconnect was working fine for me (for months!), but then i closed the gui and after a restart my internet was gone; there was no internet (connecting went fine) neither via wlan / vpn nor 3g.
so i reflashed and restored my settings which led to that error again.

now after a new flash without restoring settings openconnect gives the dead peer error you wrote about above (which is really strange cause i havent seen that error before).

so i cannot connect to the internet via the vpn. is there a workaround to get internet? btw thanks for your great work!

here is my log with verbose:

Re: [Announce] OpenConnect (-GUI) VPN client
 

Damn!
Internet's broken again!
First my config: newly flashed device, pr1.3 with Titan's Kernel.
Programs installed: rootsh; openconnect and the belonging gui.

First i tried the version the repositories gave me (gui was without free option and openconnect itself 2.12). Gave me the message above (previous post).
The actual versions of the gui (the one missing the --no-cert-check option) and openconnect gave me the same result.

And now my internet is completely messed up. So i cannot enter any websites, even xterm fails to ping anything. And openconnect as well.

The only thing i did was trying to get internet access via vpn and from time to time shut the vpn-connection down by closing xterm and connecting to 3g.

and now i cannot even use wifi nor 2g / 3g to get internet access. (although it connects pretty fine, but i am not getting any data)

any help appreciated!

Re: [Announce] OpenConnect (-GUI) VPN client
 

funny this happens to you after a reflash to PR1.3. I also had to flash last week Mon, as I was on a Frankenstein PR1.2 - PR1.3 - CSSU - custom mix and I had a problem with the Qt libs and PySafe. Funny enough only that one :D

Anyway, after a clean reflash and restore (reinstall all applications, incl. OpenConnect), I again can use PySafe and I can still use the VPN via OpenConnect.

I took the repository versions, as I wanted to stay as close to the repositories as possible, for now, to ease the pain when having to re-flash.

But all works fine. Apart from some HTTPS authentication issues in a java application AFTER the vpn connects but that must be an IBM/SSL/JVM thing as it started happening way before my reflash.

I did notice before that the OpenConnect process was quite unhappy and sometimes killing network access when not properly closed. Requiriing a reboot. After a few times up/down it also became more unstable. I was a light user myself, as it was merely an emergency access, when there was no laptop around.

In terms of routing, I also always wanted to connect to the Internet OUTSIDE the vpn, as it was a lot faster. But I can see the need to go through the VPN when being in an restrictive country (Eg. China or other political restricted countries).

I'm on the bench since today, so I can devote some time to it, before I find a new project somewhere. I'll have to fix my SB development environment though as I messed it up big time trying to get an environment capable of compiling Chromium ... :(

To be Continued.

Re: [Announce] OpenConnect (-GUI) VPN client
 

Check /etc/resolv.conf for proper entries. Often times, this file isn't updated when connecting or disconnecting to/from the tunnel node and is left with internal hosts.

Re: [Announce] OpenConnect (-GUI) VPN client
 

@ hawaii
thanks for the idea; i got (of course, now i have got no problems in connecting):
(opened via vi)

@ Netweaver
wonderful, it would be good if you could investigate that error. :)

and i checked today: got the same error with openconnect (2.25 from squeeze repo i think) and easy debian running on my phone; so it may be a problem related to my uni's vpn and not openconnect?

Re: [Announce] OpenConnect (-GUI) VPN client
 

I get exactly the same error with my uni's (Uni Magdeburg) vpn.
I will try the same version of openconnect on my laptop today to see if it is a problem of the vpn.

Re: [Announce] OpenConnect (-GUI) VPN client
 

Ok, I get the same error on my notebook with all versions of openconnect i tested, it must be a problem of the vpn.

Re: [Announce] OpenConnect (-GUI) VPN client
 

thx for trying it; did you try openconnect 3.x as well?
how long are you havin that error? cause my openconnect stopped working after a few weeks past semesterstart.

i'll write my "zeik" today :D

Re: [Announce] OpenConnect (-GUI) VPN client
 

good luck with talking to your uni VPN admins ... My IBM access VPN using OpenConnect still works fine. Touch wood...

And I'm back on a project, not a lot of bench time was granted this time. I guess I should be grateful for my utilization...

Re: [Announce] OpenConnect (-GUI) VPN client
 

I tested the newest version (3.02) and the one from the extras repo (2.26) on my laptop. The error was the same for the two versions.