currently engaged in live competitive red vs blue team exercises in an enterprise style Windows AD environment. My device runs a modern Debian Linux OS.
cscotun0
We typically connect to the lab/domain directly via ethernet, however I've discovered I can also connect via Cisco AnyConnect VPN, which might prove useful. When connected to this VPN, I can perform most operations as if I'm connected directly to the LAN. This tunnel's network interface is designated cscotun0.
tun0
I already use a consumer class (subscription based) VPN service for everyday privacy. This service can also assign a new IP address and/or geolocation on demand, etc. amongst other desirable functionality. This VPN is OpenVPN based. This tunnel's network interface is designated tun0.
The Problem
The problem is (I think) I'd like to route the cscotun0 traffic through my regular tun0 tunnel. Effectively I want to obscure my actual IP & geolocation (and be able to change my apparent IP & geolocation on the fly), while keeping my web browsing and other unrelated web traffic out of band (through tun0 but separate from cscotun0). Only traffic pertaining to the labs domain should go through the lab's VPN. Perhaps I can manage this with iptables or similar?
Like this:
Troubleshooting Details
The Cisco authentication appears to be performed over HTTP (succesfully) via tun0, but then cscotun0 is established and it seems ALL my network traffic tries do go through the new tunnel (according to tcpdump), and get lost in limbo; my web browser stops working, limited lab connectivity, and so on. Everything works fine when I use just one or the other, but then I lose the desired additional functionality that the other provides.
