0

currently engaged in live competitive red vs blue team exercises in an enterprise style Windows AD environment. My device runs a modern Debian Linux OS.

cscotun0
We typically connect to the lab/domain directly via ethernet, however I've discovered I can also connect via Cisco AnyConnect VPN, which might prove useful. When connected to this VPN, I can perform most operations as if I'm connected directly to the LAN. This tunnel's network interface is designated cscotun0.

tun0
I already use a consumer class (subscription based) VPN service for everyday privacy. This service can also assign a new IP address and/or geolocation on demand, etc. amongst other desirable functionality. This VPN is OpenVPN based. This tunnel's network interface is designated tun0.

The Problem
The problem is (I think) I'd like to route the cscotun0 traffic through my regular tun0 tunnel. Effectively I want to obscure my actual IP & geolocation (and be able to change my apparent IP & geolocation on the fly), while keeping my web browsing and other unrelated web traffic out of band (through tun0 but separate from cscotun0). Only traffic pertaining to the labs domain should go through the lab's VPN. Perhaps I can manage this with iptables or similar?

Like this:

enter image description here


Troubleshooting Details
The Cisco authentication appears to be performed over HTTP (succesfully) via tun0, but then cscotun0 is established and it seems ALL my network traffic tries do go through the new tunnel (according to tcpdump), and get lost in limbo; my web browser stops working, limited lab connectivity, and so on. Everything works fine when I use just one or the other, but then I lose the desired additional functionality that the other provides.

4
  • if i read this right?you just want to double hop so to speak.From one vpn connect to another vpn and then to the internet? – yeah_well Nov 30 '20 at 7:48
  • @VipulNair no, does the diagram help? – voices Nov 30 '20 at 9:02
  • ohh you want specific(lab) traffic to go through cstun0 and other normal traffic to go through tun0? – yeah_well Nov 30 '20 at 9:16
  • @VipulNair sure. if traffic is destined for the labs internal network, it must use the labs VPN. all other traffic has no business on the labs internal network. – voices Nov 30 '20 at 11:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.