169 lines
6.6 KiB
Markdown
169 lines
6.6 KiB
Markdown
# Rego-Tunnel Linux VPN Bridge
|
|
|
|
This app runs a Linux VM (Ubuntu) inside a Docker container with Cisco Secure Client VPN, providing transparent access to VPN-protected resources (IBM i at 10.35.33.230) from the local network.
|
|
|
|
## Architecture
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────────────────────────────┐
|
|
│ Linux Host (192.168.0.150) │
|
|
│ │
|
|
│ Bridge: br-vpn-linux (172.31.1.1/24) │
|
|
└─────────────────────────────────────────────────────────────────────────┘
|
|
│
|
|
▼
|
|
┌─────────────────────────────────────────────────────────────────────────┐
|
|
│ Container: rego-tunnel-linux (172.31.1.10) │
|
|
│ │
|
|
│ qemux/qemu running Ubuntu VM │
|
|
│ Port 8007 → Web console (noVNC) │
|
|
│ Port 2222 → SSH to VM │
|
|
│ │
|
|
│ Internal bridge: 172.32.1.1/24 │
|
|
└─────────────────────────────────────────────────────────────────────────┘
|
|
│
|
|
▼
|
|
┌─────────────────────────────────────────────────────────────────────────┐
|
|
│ Ubuntu VM (172.32.1.20) │
|
|
│ │
|
|
│ Cisco Secure Client VPN: connected to corporate network │
|
|
│ VPN IP: 10.215.x.x │
|
|
│ │
|
|
│ cisco-vpn.sh: │
|
|
│ - Auto-login to Cisco via xdotool │
|
|
│ - TOTP authentication (oathtool) │
|
|
│ - iptables forwarding for target IP │
|
|
└─────────────────────────────────────────────────────────────────────────┘
|
|
│
|
|
▼
|
|
┌─────────────────────────────────────────────────────────────────────────┐
|
|
│ IBM i (10.35.33.230) │
|
|
│ Via Cisco VPN tunnel │
|
|
└─────────────────────────────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Installation
|
|
|
|
### Step 1: Install the app via Runtipi
|
|
|
|
1. Go to Runtipi App Store
|
|
2. Install "Rego Tunnel Linux"
|
|
3. Configure RAM, CPU, and disk size
|
|
|
|
### Step 2: Set up the VM
|
|
|
|
1. Open the web console at port 8007
|
|
2. Complete Ubuntu installation (use Ubuntu Server for faster boot)
|
|
3. After installation, open a terminal
|
|
|
|
### Step 3: Install Cisco Secure Client
|
|
|
|
```bash
|
|
# Mount the shared folder (contains Cisco installation)
|
|
sudo mkdir -p /mnt/shared
|
|
sudo mount -t 9p shared /mnt/shared -o trans=virtio
|
|
|
|
# Run the install script
|
|
sudo bash /mnt/shared/install-cisco.sh
|
|
```
|
|
|
|
### Step 4: Connect VPN
|
|
|
|
```bash
|
|
# Run the VPN automation script
|
|
~/cisco-vpn.sh
|
|
```
|
|
|
|
The script will:
|
|
1. Start the Cisco VPN agent
|
|
2. Launch the VPN UI
|
|
3. Auto-type credentials and TOTP
|
|
4. Set up IP forwarding for the target
|
|
|
|
## Files
|
|
|
|
### vpn_scripts/secureclient/
|
|
Complete Cisco Secure Client installation.
|
|
|
|
### vpn_scripts/cisco-vpn.sh
|
|
Automated VPN login script:
|
|
- Starts vpnagentd if not running
|
|
- Launches vpnui
|
|
- Uses xdotool to type credentials
|
|
- Generates TOTP codes with oathtool
|
|
- Sets up iptables forwarding
|
|
|
|
### vpn_scripts/install-cisco.sh
|
|
One-time setup script to install Cisco Secure Client in the VM.
|
|
|
|
## Configuration
|
|
|
|
### VPN Credentials
|
|
Edit `~/cisco-vpn.sh` and update:
|
|
```bash
|
|
EMAIL="your-email@company.com"
|
|
PASSWORD="your-password"
|
|
TOTP_SECRET="your-totp-secret"
|
|
VPN_HOST="vpn.company.com"
|
|
TARGET_IP="10.x.x.x"
|
|
```
|
|
|
|
### Network Configuration
|
|
|
|
Add route on your laptop:
|
|
```cmd
|
|
route add 172.31.1.0 mask 255.255.255.0 192.168.0.150 -p
|
|
```
|
|
|
|
## User Config
|
|
|
|
Create `/etc/runtipi/user-config/runtipi/rego-tunnel-linux/docker-compose.yml`:
|
|
|
|
```yaml
|
|
networks:
|
|
vpn_static-linux:
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.bridge.name: "br-vpn-linux"
|
|
ipam:
|
|
config:
|
|
- subnet: 172.31.1.0/24
|
|
|
|
services:
|
|
rego-tunnel-linux:
|
|
sysctls:
|
|
- net.ipv4.conf.all.rp_filter=0
|
|
- net.ipv4.conf.default.rp_filter=0
|
|
cap_add:
|
|
- NET_ADMIN
|
|
environment:
|
|
- VM_NET_IP=172.32.1.20
|
|
networks:
|
|
vpn_static-linux:
|
|
ipv4_address: 172.31.1.10
|
|
```
|
|
|
|
## Troubleshooting
|
|
|
|
### VPN UI doesn't start
|
|
- Ensure vpnagentd is running: `systemctl status cisco-vpnagentd`
|
|
- Check for missing libraries: `ldd /opt/cisco/secureclient/bin/vpnui`
|
|
|
|
### TOTP codes failing
|
|
- Sync time: `sudo timedatectl set-ntp true`
|
|
- Verify TOTP secret is correct
|
|
|
|
### Can't reach target IP
|
|
- Check if VPN is connected: `ip addr show cscotun0`
|
|
- Verify iptables rules: `sudo iptables -L -n`
|
|
|
|
## Comparison: Windows vs Linux
|
|
|
|
| Feature | Windows VM | Linux VM |
|
|
|---------|-----------|----------|
|
|
| Image | dockurr/windows | qemux/qemu |
|
|
| Boot time | ~3-5 min | ~1-2 min |
|
|
| RAM usage | ~2GB min | ~512MB min |
|
|
| Disk usage | ~15GB | ~5GB |
|
|
| Automation | DevTools/WebSocket | xdotool |
|