OpenConnect, tunX and NAT

[ogogon]

Colleagues, please tell me how I can most correctly implement my task.

There is a certain router that supports several corporate VPNs built using different technologies. Most of them form tun-type interfaces to establish a connection.
These interfaces live their own lives; some of them can be disconnected for some time and then connected in a different sequence. At the same time, tun-device numbers may change.

One of these tunnels is formed by the OpenConnect client. He also lives his own life. His number may also change.
As I understand it, OpenConnect does not have its own mechanism for creating NAT, and I will have to use the NAT of the PF firewall used in this machine.

How can I correctly link the tunnel interface that OpenConnect creates with the NAT functionality of PF so that they always find each other, given that the tunnel number can change?

Thanks in advance,
Ogogon.

 

[covacat]

most of the vpn servers can run an external script when a client connects / disconnects and can pass various info via env or command line
you may use that if available to add/remove rules from the fw

 

[ogogon]

most of the vpn servers can run an external script when a client connects / disconnects and can pass various info via env or command line
you may use that if available to add/remove rules from the fw

Thanks for the tip. There really is a macro that gets, among other things, the name of its tunnel. How can this be elegantly integrated with the rules in pf.conf? (It is assumed that there is not only the inclusion of NAT, but also a certain number of adjustments.) And then how to remove this?

 

[covacat]

usually you have an if_up script and an if_down script where you setup / cleanup firewall rules, routes, etc
i never used openconnect but it works for pptpd, openvpn, mpd5
i dont know anything about pf but with ipfw you can insert/delete rules without a conf file
i assume this is possible with pf too

 

[ogogon]

Thank you. By the way, I now delved into this issue and it turned out that OpenConnect launches a very large script that has a fairly developed hook mechanism. Unfortunately, all this is described very sparingly. But these are the hooks I will use.