mbant's technical notes

I've been chatting around a bit and discovered that the fact that "vpnc doesn't work" is a myth - at least in my case.

Using vpnc doesn't only work, it's also a lot more convenient, because you don't have to keep upgrading manually.

If you're using Ubuntu, all you have to do is install the package vpnc. After that, Ubuntu will take care of the upgrades.

All you need is a conf file for vpnc which tells you how to connect. Luckily, vpnc provides a translate script which converts a PCF file into a vpnc conf file, it's called pcf2vpnc. In my case, it's in /usr/share/vpnc, so I ran

$ /usr/share/vpnc/pcf2vpnc vpn-v1.pcf

and the output is the ready conf file. Save that as /etc/vpnc/YourVPN.conf (you need to do that with root-privileges, i.e. use sudo) and you can start the whole thing with

$ sudo vpnc YourVPN

To terminate vpn connection, run

$ sudo vpnc-disconnect

to restore routing.

PCF files usually use crypted group passwords. You can decrypt them at this website: http://www.unix-ag.uni-kl.de/~massar/bin/cisco-decode

http://www.penlug.org/twiki/bin/view/Main/CiscoVpn is a pretty outdated site on vpnc, but can give some insight.


This is already a lot better than the cisco client, but there's more good news: vpnc integrates into network-manager, and there's a KDE gui called kvpnc. As soon as I'm up to date on those, I'll finish the trilogy and hopefully we're back to the world where ordinary people can use VPN from their laptops.

Getting VPN to work with Ubuntu was a real headache. Most instructions on the web were a disaster and I had to pick loads of stuff together from all over the place.

I wanted to get my laptop to use the wireless network of the University of Karlsruhe, Germany (Dukath). Apparently, the open source versions don't work and you need the Cisco one.
These instructions will thus be using the university network as an example, but might work for others, too.

1) Download the client. I got it from here: http://www.rz.uni-karlsruhe.de/rd/vpn.php . If you're on another network, I recommend searching for cisco VPN client linux and downloading the latest version.

2) The file you downloaded is a tar.gz file. Extract this file:

$ tar zxf vpnclient-linux-4.8.00.0490-k9.tar.gz

You will get a new directory, vpnclient. Go to this directory.

3) Patch the client. This seems to be a Ubuntu problem. Get http://tuxx-home.at/projects/cisco-vpnclient/vpnclient-linux-2.6.22.diff and copy it into the same vpnclient directory. Apply the patch by going into the directory and run

$ patch < vpnclient-linux-2.6.22.diff

I got this advice from http://www.longren.org/2007/05/17/how-to-cisco-vpn-client-on-ubuntu-704-feisty-fawn/ , thanks for the hint.

4) Install. Now the patch is installed, this is simple:

$ sudo ./vpn_install

5) Install the PCF files. The page where I downloaded the VPN client also offered two PCF files for download (vpn-split-v1.pcf and vpn-v1.pcf). Download them and do

$ sudo cp vpn-split-v1.pcf vpn-v1.pcf /etc/opt/cisco-vpnclient/Profiles/

This directory is a new one which was created during the vpn_install script.

6) Install the root certificate. Get the certificate from the same place you got the PCF files. In the Karlsruhe case, this file is called dfnpca-02.der. Run

$ cisco_cert_mgr -R -op install

And enter the certificate filename when asked for it.

Note this certificate thing might not be necessary, or there might be a user certificate (which means you have to do -U instead of -R).

7) Start the vpn client by running

$ sudo /etc/init.d/vpnclient_init start

This is not necessary if you restart the computer before doing the next step. But it doesn't do any harm, either.


Now, assuming you have an active network connection (e.g. in the Karlsruhe university library), you can run

$ sudo vpnclient connect vpn-v1

And the VPN client should connect. The VPN profile (i.e., what you have to write after 'connect') is the same as the PCF file name without the .pcf. In the Karlsruhe case, the one that's called vpn-split-v1 is for external connections, where you want to use university-internal stuff from a normal internet connection. Inside the university, you want the other one.

If you do this inside a shell (like xterm, konsole or whatever), the vpn client stays active until you signal it's end (with Ctrl-C) or run sudo vpnclient disconnect from another console.

9) Keep the client up to date. Sorry, but this nightmare is not yet over. Everytime you update your kernel, you have to re-install the client. I can't confirm this, but I think the other steps do not need repeating.



Is this the famous ubuntu usability? Seriously, this needs easing up. I'm not exactly a newbie to this stuff, but it took me ages to figure out.