NAME

       ocproxy - lwip based proxy for openconnect

SYNOPSIS

       ocproxy [options]

DESCRIPTION

       This manual page documents briefly the ocproxy command.

       ocproxy  is  a  program  that  provides  a  SOCKS  and  port-forwarding proxy when used in
       conjunction with openconnect(1).  When using ocproxy,  OpenConnect  only  handles  network
       activity  that  the user specifically asks to proxy, so the VPN tunnel no longer "hijacks"
       all network traffic on the host.

       ocproxy accomplishes this by running a lwIP network stack in userland, so the OS kernel is
       no longer directly handling packets sent to and from the VPN connection.

BASIC USAGE

       ocproxy  should  be  invoked  directly  from  OpenConnect  or  another VPN program; a file
       descriptor number is passed through the VPNFD environment variable to tell ocproxy how  to
       send and receive VPN traffic.  For example:

              openconnect   --script-tun   --script   "ocproxy   -D   11080  -L2222:unix-host:22"
              vpn.example.com

       Commonly used options include:

       -D, --dynfw port
              Start up a SOCKS5 server on TCP port port to dynamically forward  application-level
              traffic over the VPN proxy.  This is intended to resemble the -D option to ssh(1).

       -L, --localfw port:host:hostport
              Bind to port local TCP port port, and forward incoming connections to host:hostport
              on the VPN.  host can be a DNS name or  a  dotted-quad  IP  address.   If  the  VPN
              supplied  a  default DNS domain name or --domain was specified on the command line,
              unqualified hostnames may be used.  This is intended to resemble the -L  option  to
              ssh(1).

       -g, --allow-remote
              Local  listening  sockets  opened by the --dynfw and --localfw options, by default,
              will be bound to the loopback interface only (127.0.0.1) so they are only available
              on the local machine.  If --allow-remote is specified, the sockets will be bound to
              INADDR_ANY (0.0.0.0) instead, and  other  hosts  may  connect  to  them.   This  is
              intended to resemble the -g option to ssh(1).

       -k, --keepalive interval
              Send  a TCP keepalive packet every interval seconds on each open connection, on the
              VPN side.  This can help avoid idle timeouts, both on the VPN gateway  and  on  any
              stateful firewalls in between the two ends.

ADVANCED USAGE

       These options may be useful for debugging ocproxy or diagnosing problems:

       -v, --verbose
              Enable verbose debugging output.

       -T, --tcpdump
              Write  a  log  of  all  TCP or UDP packets traversing the VPN to /tmp/tcpdump.  The
              format largely mirrors the output of the tcpdump(8) utility.

       ocproxy will normally retrieve IP configuration parameters through  environment  variables
       provided  by  OpenConnect.   These  options  may  be  used  to  override  the autodetected
       parameters:

       -I, --ip local_ip
              Use local_ip for the VPN side IP address.  Example: 192.168.5.20.  This is normally
              set through the INTERNAL_IP4_ADDRESS environment variable.

       -M, --mtu mtu_bytes
              Use  mtu_bytes  as  the  maximum  transmit  unit on the VPN interface; it generally
              depends on DTLS and UDP packet overhead.  Example:  1300.   This  is  normally  set
              through the INTERNAL_IP4_MTU environment variable.

       -d, --dns dns_ip
              Send  all  VPN  side  DNS queries to server dns_ip.  Example: 192.168.5.2.  This is
              normally set through the INTERNAL_IP4_DNS environment variable.

       -o, --domain domain
              Use domain as the default DNS domain, for unqualified hostnames.  This is  normally
              set through the CISCO_DEF_DOMAIN environment variable.

SEE ALSO

       openconnect(1), ssh(1)

       http://savannah.nongnu.org/projects/lwip/

                                        November 20, 2012                              OCPROXY(1)