Français  English 

OpenConnect / Cisco AnyConnect

OpenConnect is an extremely high-performance and lightweight VPN server that also features full compatibility with the official Cisco AnyConnect clients. The protocol is built on top of standards like HTTP, TLS, and DTLS, and it's one of the most popular and widely used VPN technologies. Due to its use among large multi-national corporations, it often means that at the protocol level, it is seldom targetted for censorship.

• Platforms
  • Certificates
  • Windows
  • macOS
  • OpenConnect GUI
  • OpenConnect CLI
  • Linux
  • Android
  • iOS

Server and client Certificates (macOS, Android)

Client certificates are a mechanism by which clients can authenticate themselves securely with the server.

1. Your OpenConnect server issues its own server certificate. This is used by your device's client software (such as AnyConnect for iOS) to securely identify the VPN server. Download this server's certificate.
   • ca.crt
2. Each device you wish to configure needs a client certificate in addition to the server certificate above. A client certificate is used to securely identify and authenticate your device to the VPN server. Two devices can't use the same client certificate and be logged in at the same time (one client certificate per device). Each client certificate is protected by a password, which will be needed to unlock it once you import it into your device.
   • brother-various.p12, password: where.actress.lazy
   • shallow-exotic.p12, password: task.federal.fetch
   • uncle-task.p12, password: worth.attitude.decline
   • script-pizza.p12, password: board.peasant.orchard
   • rely-inherit.p12, password: clown.have.tip

Windows

1. Download the OpenConnect GUI installer.
2. Run the OpenConnect GUI installer.
3. Complete the TAP-Windows Setup Wizard.
   • Choose the default options, and allow the TAP driver from the OpenVPN project to be installed.
4. Launch the OpenConnect application.
5. Click the Edit icon (gear) and select 'New profile advanced'.
6. Enter streisand-demo-site for the Name.
7. Enter 52.15.254.140:4443 for the Gateway.
8. Enter streisand for the Username and click Save.
9. Click Connect.
10. A prompt will appear during the initial connection asking you to trust the server's certificate. Click The information is accurate and the server will be automatically verified for all future connections.
11. Enter snake.endorse.fame.mystery.prefer for the Password and click OK.
12. Click No when the Windows prompt appears asking Do you want to allow your PC to be discoverable....
13. The current beta version of the OpenConnect GUI does not support automatically changing the DNS settings. In order to avoid DNS leaks, the following steps must be performed:
    1. Right-click on the Windows Start Button.
    2. Click Network Connections.
    3. Right-click on the device that you are using to connect (Ethernet or Wi-Fi) and click Properties.
    4. Double-click Internet Protocol Version 4 (TCP/IPv4).
    5. Select Use the following DNS server addresses and enter:
       • 8.8.8.8
       • 8.8.4.4
    6. Click OK.
    7. Click OK to close the connection properties.
14. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.

macOS

OpenConnect GUI

1. Download the OpenConnect GUI installer.
2. Run the OpenConnect GUI installer.
3. Launch the OpenConnect application.
4. Click the Edit icon (gear) and select 'New profile advanced'.
5. Enter streisand-demo-site for the Name.
6. Enter 52.15.254.140:4443 for the Gateway.
7. Enter streisand for the Username and click Save.
8. Click Connect.
9. A prompt will appear during the initial connection asking you to trust the server's certificate. Click The information is accurate and the server will be automatically verified for all future connections.
10. Enter snake.endorse.fame.mystery.prefer for the Password and click OK.
11. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.

OpenConnect CLI

1. Install Homebrew, if you haven't already.

2. Install OpenConnect using Homebrew:

   brew install openconnect

   • If installing Homebrew is not an option, you can also download and compile the OpenConnect source code.
3. Download the server certificate file, and a client certificate file from the list above.
4. Place the downloaded server certificate and a selected client certificate into a separate folder (e.g. streisand-demo-site-openconnect), open your Terminal, and cd to that directory.

5. Run OpenConnect:

   sudo openconnect --cafile ca.crt --certificate your-client-certificate.p12 --key-password 'your-client-certificate-password' --pfs 52.15.254.140:4443

6. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.

Linux

1. Install the OpenConnect plugin for NetworkManager.

   sudo apt-get install network-manager-openconnect-gnome

2. Download the server certificate file:
   • ca.crt
3. Open your System Settings.
4. Click the Network icon.
5. Click the + button in the lower-left of the window.
6. Select VPN from the Interface drop-down and click Create.
7. Select Cisco AnyConnect Compatible VPN (openconnect) and click Create.
8. Enter streisand-demo-site for the Connection name.
9. Enter 52.15.254.140:4443 for the Gateway.
10. Select the ca.crt file that you just downloaded for the CA Certificate.
11. Click Save.
12. Select the VPN in the left-hand menu, and flip the switch to ON. You can also enable/disable the VPN by clicking on the WiFi/Network icon in the menu bar, scrolling to VPN Connections, and clicking on its name.
13. Enter streisand for the Username and click Login.
14. Enter snake.endorse.fame.mystery.prefer for the Password, check Save passwords, and click Login.
15. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.

Android

1. Download Cisco AnyConnect from Google Play.
2. Launch the application.
3. Tap OK to accept the "Supplemental End User License Agreement for AnyConnect® Secure Mobility Client vx.x and other VPN-related Software".
4. Tap the menu icon and select Settings.
5. Uncheck the Block Untrusted Servers option.
   • The server certificate will be imported during the initial login and automatically verified for all future connections.
6. Tap the back button.
7. Tap Connection and then tap Add New VPN Connection....
8. Tap Description and enter streisand-demo-site.
9. Tap Server Address and enter 52.15.254.140:4443.
10. Tap Advanced Preferences.
11. Tap Certificate.
    • Each profile can be downloaded on the device itself using the links above, or copied from your computer via USB.
12. Check the Download folder if you downloaded the file directly to the device. This is where Chrome places its files, for example.
13. Tap Import, tap File System, and select a client certificate file from the list above that you transferred.
14. Enter your client certificate password when the Password prompt is displayed, and tap Connect.
15. You'll see a checkmark next to the newly imported certificate. Tap the back button.
16. Tap Done twice to save the connection.
17. Tap the back button to return to the main screen. You should see streisand-demo-site in the Connection section.
18. Slide the AnyConnect VPN switch On.
19. Tap Details when the Security Warning is displayed.
20. Tap Import and Continue when the Certificate Summary is displayed.
21. Tap Connect on the group selection screen. The correct default has already been chosen.
22. If this is your first time using AnyConnect, you will need to accept the Connection Request dialog that Android displays.
23. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.

Prompted for username?

Some users have reported that their Android AnyConnect clients prompt for a username and password. This is a known bug we don't understand. See the list of Streisand AnyConnect open issues. If you're affected, you could help us understand the bug by reporting your details using the issue list's New issue button's template. Fixes are gratefully accepted too.

If you're affected, you can use this workaround:

1. When prompted for a user, enter streisand
2. When prompted for a password, use snake.endorse.fame.mystery.prefer

iOS

Note: When using AnyConnect for the first time, you may be prompted for a password prior to being connected. Enter streisand for the username, snake.endorse.fame.mystery.prefer for the password and continue. Subsequent connections will not prompt you again.

Note: Only one AnyConnect profile can be configured at any give time. To remove an existing profile, go to Settings -> General -> Profile, tap on the profile you wish to remove, then tap on Remove Profile.

1. Transfer a .mobileconfig file for each device you wish to configure:
   • brother-various.mobileconfig
   • shallow-exotic.mobileconfig
   • uncle-task.mobileconfig
   • script-pizza.mobileconfig
   • rely-inherit.mobileconfig
   • The profile can be emailed to your device (simply tap the attachment), transferred via the Apple Configurator utility, or downloaded directly by viewing these instructions on the device itself.
2. Follow the on-screen instructions.

3. You will be prompted to enter your device password or pin.

4. Download Cisco AnyConnect from the App Store.

5. Launch the application.
6. Tap OK to enable the software when the dialog box appears.
7. Tap Settings.
8. Turn off the Block Untrusted Servers switch.
   • The server certificate will be imported during the initial login and automatically verified for all future connections.
9. Tap Home.
10. Slide the AnyConnect VPN switch on.
11. Tap Details when the Security Warning is displayed.
12. Tap Import in the top-right corner.
13. Tap Connect on the group selection screen. The correct default has already been chosen.
14. You should be good to go! You can verify that your traffic is being routed properly by looking up your IP address on DuckDuckGo. It should say Your public IP address is 52.15.254.140.