OpenConnect VPN client.
Description: VPN client compatible with Cisco AnyConnect SSL VPN
Keywords: OpenConnect, AnyConnect, Cisco, VPN, SSLVPN, SSL VPN

Home Features Getting Started Mailing List / Help Contribute Protocols VPN Server

OpenConnect VPN client

Building vpnc-script Connecting Manual

# Building OpenConnect

Unless you need to test the very latest version, you should not need to build OpenConnect for yourself. See the packages page for information about your operating system or distribution. If there is none, then you can file a bug or enhancement request asking for one.

## Requirements

To build OpenConnect from its source code, you will need the following libraries and tools installed:

- `libxml2`
- `zlib`
- Either `OpenSSL` or `GnuTLS` (v3.2.10+)
- `pkg-config`

And optionally also:

- `p11-kit` (for PKCS#11 support)
- `libp11` (also needed for PKCS#11 support if using OpenSSL)
- `libproxy`
- `trousers` (for TPMv1 support if using GnuTLS)
- `libtasn1` and either `tss2-esys` or `IBM's TPM 2.0 TSS`. (for TPMv2 support if using GnuTLS)
- `libstoken` (for SecurID software token support)
- `libpskc` (for RFC6030 PSKC file storage of HOTP/TOTP keys)
- `libpcsclite` (for Yubikey hardware HOTP/HOTP support)

OpenConnect supports the use of HTTP and SOCKS proxies to connect to the AnyConnect service, even without using libproxy. You may wish to use libproxy if you want OpenConnect to automatically use the appropriate proxies for your environment, without having to manually give it the `--proxy` argument on the command line.

## Install vpnc-script

OpenConnect should be given a default vpnc-script for network configuration (routing and DNS) at compile-time. This can be overridden at runtime (with `--script`).

The `configure` script will check whether either `/etc/vpnc/vpnc-script` or `/usr/share/vpnc-scripts/vpnc-script` exists and can be executed, and will fail if not. If you don't already have a copy then you should install one. It might be in a separate `vpnc-script` package for your operating system, it might be part of their `vpnc` package, and there's one linked from the vpnc-script page, if you need to download it manually. Install it as `/etc/vpnc/vpnc-script`.

If you do not want to OpenConnect to use a vpnc-script from one of these standard locations, you can configure OpenConnect to use a different location by default. When running the `./configure` script in the instructions below, you can append an argument such as `--with-vpnc-script=/where/I/put/vpnc-script` to its command line. Note that the path you give will not be checked; the script doesn't have to be present when you build OpenConnect. But of course OpenConnect won't work very well without it, so you'll still have to install it later.

## Building OpenConnect

If you checked the source code out from git rather from a release tarball then run this command first to prepare the build system:

- `./autogen.sh`

Then to build it, run the following commands:

- `./configure`
- `make`
- `make install` (If you want to install it)

Note that OpenConnect will attempt to use the GnuTLS library by default. If you want it to use OpenSSL instead, then add `--without-gnutls` to the `./configure` command above.

If compilation fails, please make sure you have a working compiler and the development packages for all the required libraries mentioned above. If it still doesn't build, please send the full output in a plain-text mail to the mailing list.

## Test suite

The included test suite can be run as `make check`.

It depends on the following programs and libraries being available:

- ocserv
- socket_wrapper
- uid_wrapper

## Test suite

The included test suite can be run as `make check`.

It depends on the following programs and libraries being available:

- ocserv
- socket_wrapper
- uid_wrapper

## TUN/TAP driver

### Mac OS

Mac OS X users with OS X 10.6 or older, or using OpenConnect 6.00 or older, will also need to install the Mac OS X tun/tap driver. Newer versions of OpenConnect will use the `utun` device on OS X which does not require additional kernel modules to be installed.

Solaris/OpenIndiana users will need the Solaris TAP driver. Note that for IPv6 support, the Solaris tun/tap driver from 16th Nov 2009 or newer is required.

### Windows

On Windows, OpenConnect uses the TAP-Windows driver from OpenVPN (version 9.9 or later; requires Windows 2003 or newer). This driver is only available for the 32-bit and 64-bit x86 architectures.

OpenConnect v9.00 also contains experimental support for the Wintun layer-3 driver from Wireguard (requires Windows 7 or newer). This is a more modern driver, and supports 32-bit and 64-bit ARM architectures as well, however it does not yet appear to be fully stable (see issue #338). OpenConnect v9.00 will only attempt to use Wintun if TAP-Windows is unavailable.