OpenConnect VPN Server - SSL VPN for Remote Access

OpenConnect VPN Server (ocserv) is a modern SSL VPN server fully compatible with Cisco AnyConnect clients. It provides secure remote access over the SSL/TLS protocol, supports multiple authentication methods including two-factor authentication (2FA), and is a perfect fit for enterprise remote access scenarios.

Overview

Key Features

Advantages of OpenConnect:

Full compatibility with Cisco AnyConnect clients
SSL/TLS encryption (runs on port TCP 443)
Multiple authentication methods (local, RADIUS, 2FA)
Two-factor authentication with OTP (Time-based One-Time Password)
DTLS (Datagram TLS) for improved performance
HTTP security headers to protect the web interface
RADIUS accounting for session monitoring
Identity-based configuration (per-user/per-group settings)
Works through any firewall (TCP 443, HTTPS)
Cross-platform clients (Windows, macOS, Linux, iOS, Android)

OpenConnect vs other SSL VPNs:

Criterion	OpenConnect	OpenVPN	WireGuard
AnyConnect compatibility	Full	No	No
Performance	High (DTLS)	Medium	Very high
Built-in 2FA	Yes (OTP)	Via plugins	No
Firewall traversal	Excellent (443/tcp)	Good	Good
Enterprise readiness	Excellent	Good	Basic
Client simplicity	Excellent	Good	Excellent

When to Use OpenConnect

Ideal scenarios:

Enterprise remote access VPN for employees
Replacement for commercial Cisco AnyConnect
Two-factor authentication is required
Strict firewall restrictions (only 443/tcp is available)
Integration with RADIUS for centralized authentication
Accounting and auditing of VPN sessions
Reusing existing AnyConnect clients

Not recommended when:

You need maximum performance (use WireGuard)
Site-to-site tunnels (use IPsec or WireGuard)
Simple home scenarios (OpenVPN or WireGuard are simpler)

Architecture and Components

SSL/TLS and DTLS

OpenConnect uses two protocols:

TLS (TCP based):

Control channel and data transfer
Guaranteed delivery
Works across any network
Used for authentication

DTLS (UDP based):

Data transfer (after successful TLS authentication)
Lower latency, better performance
Automatic fallback to TLS when UDP has issues

Authentication Methods

OpenConnect supports several modes:

Local Password: Local users with passwords
RADIUS: Centralized authentication through a RADIUS server
Password + OTP: Two-factor authentication (password + one-time code)
OTP Only: One-time passwords only

SSL Certificate

OpenConnect requires an SSL certificate to operate:

Certificate options:

Self-signed certificates (for testing)
Let’s Encrypt (free, automatic renewal)
Corporate CA certificates
Commercial SSL certificates

Network Settings

Network settings for clients:

Client IP Pool: Pool of IP addresses for VPN clients
DNS Servers: DNS servers for clients
Split Tunneling: Route only specific traffic through the VPN
Full Tunneling: Route all client traffic through the VPN

Basic Configuration

Preparing SSL Certificates

Self-signed Certificates (testing)

# Create a CA
generate pki ca install openconnect-ca common-name "OpenConnect CA"

# Create a server certificate
generate pki certificate sign openconnect-ca install openconnect-server common-name "vpn.company.com"

commit
save

Let’s Encrypt Certificates (production)

# Install Certbot (run in operational mode)
sudo apt-get update
sudo apt-get install certbot

# Obtain a certificate (a DNS A record is required)
sudo certbot certonly --standalone -d vpn.company.com

# Certificates will be in /etc/letsencrypt/live/vpn.company.com/
# fullchain.pem - full certificate
# privkey.pem - private key

# Import into VyOS PKI
configure
set pki certificate openconnect-server certificate "$(cat /etc/letsencrypt/live/vpn.company.com/fullchain.pem)"
set pki certificate openconnect-server private key "$(cat /etc/letsencrypt/live/vpn.company.com/privkey.pem)"

commit
save

Automatic Let’s Encrypt renewal:

# Add to cron for automatic renewal
set system task-scheduler task renew-ssl executable path '/usr/bin/certbot renew --quiet'
set system task-scheduler task renew-ssl interval '7d'

commit

Minimal Configuration with Local Authentication

configure

# SSL certificates
set vpn openconnect ssl ca-certificate openconnect-ca
set vpn openconnect ssl certificate openconnect-server

# Local authentication
set vpn openconnect authentication mode local password
set vpn openconnect authentication local-users username alice password 'SecurePassword123!'
set vpn openconnect authentication local-users username bob password 'AnotherSecure456!'

# Network settings for clients
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# DNS servers for clients
set vpn openconnect network-settings name-server 8.8.8.8
set vpn openconnect network-settings name-server 1.1.1.1

commit
save

Verifying the Basic Configuration

# Check that the service is running
show vpn openconnect-server sessions

# System processes
show system processes openconnect

# Logs
show log vpn openconnect

Authentication

Local Authentication (Password)

The simplest method for small deployments.

configure

# Local authentication mode
set vpn openconnect authentication mode local password

# Adding users
set vpn openconnect authentication local-users username user1 password 'Pass123!@#'
set vpn openconnect authentication local-users username user2 password 'Secure789$%^'
set vpn openconnect authentication local-users username user3 password 'MyVPN2024&*('

# Optional: disable a user
set vpn openconnect authentication local-users username user3 disable

commit
save

Password recommendations:

At least 12 characters
A combination of letters, digits, and special characters
Regular password rotation (every 90 days)

Two-Factor Authentication (2FA OTP)

Significantly improves security by requiring a password plus a one-time code.

Password + OTP Mode

configure

# Enable 2FA (password + OTP)
set vpn openconnect authentication mode local password-otp

# Users with passwords
set vpn openconnect authentication local-users username alice password 'SecurePass123!'
set vpn openconnect authentication local-users username bob password 'BobPass456!'

# Generate OTP keys for users
# Run in operational mode:
exit
generate openconnect username alice otp-key hotp-time

# VyOS will print a QR code and a key such as:
# OTP Key: JBSWY3DPEHPK3PXP
# Use the QR code in the Google Authenticator or Authy app

OTP Key for a user:

configure
# Set the OTP key manually
set vpn openconnect authentication local-users username alice otp JBSWY3DPEHPK3PXP
set vpn openconnect authentication local-users username bob otp KRSXG5CTORHG6YLM

commit
save

OTP Only Mode

One-time codes only (no passwords).

configure

# OTP-only mode
set vpn openconnect authentication mode local otp

# User OTP keys
set vpn openconnect authentication local-users username alice otp JBSWY3DPEHPK3PXP
set vpn openconnect authentication local-users username bob otp KRSXG5CTORHG6YLM

commit
save

Configuring the client app:

Google Authenticator (iOS/Android):
- Install the app
- Scan the QR code from VyOS
- The app will generate 6-digit codes every 30 seconds
Microsoft Authenticator (iOS/Android):
- An alternative to Google Authenticator
- Works on the same principles
Authy (iOS/Android/Desktop):
- Cloud backup support
- Synchronization across devices

Connecting with 2FA:

Username: alice
Password: SecurePass123!123456
          ^^^^^^^^^^^^^^^^ ^^^^^^
          regular password OTP code

or in password-otp mode via AnyConnect:
Username: alice
Password: SecurePass123!
Second Password: 123456 (OTP code)

RADIUS Authentication

Centralized authentication through a RADIUS server.

configure

# RADIUS mode
set vpn openconnect authentication mode radius

# Primary RADIUS server
set vpn openconnect authentication radius server 192.168.1.10
set vpn openconnect authentication radius server 192.168.1.10 key 'SharedSecret123'
set vpn openconnect authentication radius server 192.168.1.10 port 1812

# Backup RADIUS server
set vpn openconnect authentication radius server 192.168.1.11
set vpn openconnect authentication radius server 192.168.1.11 key 'SharedSecret123'
set vpn openconnect authentication radius server 192.168.1.11 port 1812

# Timeout (optional)
set vpn openconnect authentication radius timeout 5

commit
save

RADIUS attributes:

OpenConnect sends:

User-Name: the user’s username
User-Password: the password
NAS-IP-Address: the VyOS IP address
NAS-Port-Type: Virtual
Service-Type: Framed-User
Framed-Protocol: PPP

FreeRADIUS configuration (on the RADIUS server):

# /etc/freeradius/clients.conf
client vyos-vpn {
    ipaddr = 192.168.1.1
    secret = SharedSecret123
    shortname = vyos
}

# /etc/freeradius/users
alice Cleartext-Password := "SecurePassword"
    Reply-Message = "Welcome to VPN"

bob Cleartext-Password := "BobPassword"

RADIUS Accounting

Monitoring VPN sessions through RADIUS accounting.

configure

# Enable RADIUS accounting
set vpn openconnect accounting mode radius

# RADIUS accounting server
set vpn openconnect accounting radius server 192.168.1.10
set vpn openconnect accounting radius server 192.168.1.10 key 'SharedSecret123'
set vpn openconnect accounting radius server 192.168.1.10 port 1813

# Backup accounting server
set vpn openconnect accounting radius server 192.168.1.11
set vpn openconnect accounting radius server 192.168.1.11 key 'SharedSecret123'
set vpn openconnect accounting radius server 192.168.1.11 port 1813

commit
save

RADIUS Accounting messages:

OpenConnect sends:

Accounting-Start: When a client connects
Interim-Update: Periodically (every N minutes)
Accounting-Stop: When a client disconnects

Accounting attributes:

Acct-Session-Id: Unique session ID
Acct-Input-Octets: Inbound traffic bytes
Acct-Output-Octets: Outbound traffic bytes
Acct-Session-Time: Session duration in seconds
Framed-IP-Address: The VPN client’s IP address

Network Settings

Client IP Pool

A pool of IP addresses for VPN clients.

configure

# IPv4 subnet for clients
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# IPv6 subnet (optional)
set vpn openconnect network-settings client-ipv6-pool prefix 2001:db8:100::/64
set vpn openconnect network-settings client-ipv6-pool mask 96

commit
save

IP address planning:

Use private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
Avoid overlap with existing networks
Account for the number of concurrent users
Leave room for growth

DNS and Domains

DNS servers for VPN clients.

configure

# DNS servers
set vpn openconnect network-settings name-server 192.168.1.1
set vpn openconnect network-settings name-server 8.8.8.8

# Search domain
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

commit
save

DNS options:

Internal DNS: To resolve corporate resources
Public DNS: Google (8.8.8.8), Cloudflare (1.1.1.1)
Filtering DNS: Cloudflare for Families (1.1.1.3), Quad9 (9.9.9.9)

Split Tunneling

Route only corporate traffic through the VPN.

configure

# Split-include: only specific networks go through the VPN
set vpn openconnect network-settings split-dns include-domains company.local
set vpn openconnect network-settings split-dns include-domains internal.local

# Routes through the VPN (not yet supported directly in VyOS, use identity-based)
# Alternative: configure via server options

commit
save

Split tunneling via custom options:

configure

# Push only specific routes (for split tunneling)
# This functionality is available via identity-based config or direct ocserv options

commit
save

Full Tunneling

All client traffic through the VPN.

By default OpenConnect is configured for full tunneling. Clients receive a default route through the VPN.

To set it explicitly:

configure

# Client IP pool (automatically enables full tunnel)
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# DNS for all queries
set vpn openconnect network-settings name-server 192.168.1.1

commit
save

NAT for VPN clients (if internet access is needed):

configure

# NAT for VPN clients
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 10.100.0.0/24
set nat source rule 100 translation address masquerade

commit
save

Identity-Based Configuration

Settings for individual users or groups.

Per-User Configuration

configure

# Static IP for a user
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# Configuration file for users
# (created through the shell, since VyOS has no direct CLI for it)

# For advanced per-user configuration, use files in /config/
# An example is in the "Advanced Configurations" section

commit
save

Group-Based Configuration

configure

# User groups are configured through RADIUS attributes or configuration files

commit
save

HTTP Security Headers

Protecting the OpenConnect web interface.

configure

# HTTP security headers
set vpn openconnect listen-ports 443

commit
save

Security headers (set automatically by ocserv):

X-Frame-Options: DENY - Protection against clickjacking
X-Content-Type-Options: nosniff - Protection against MIME type sniffing
Strict-Transport-Security - HSTS for HTTPS
Content-Security-Policy - CSP for protection against XSS

Firewall Configuration

Allowing traffic for the OpenConnect VPN.

configure

# Inbound traffic on the VPN port
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 443
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 description 'OpenConnect VPN'

# UDP for DTLS (optional, but recommended)
set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 destination port 443
set firewall ipv4 input filter rule 151 protocol udp
set firewall ipv4 input filter rule 151 description 'OpenConnect DTLS'

# Forward for VPN clients
set firewall ipv4 forward filter rule 250 action accept
set firewall ipv4 forward filter rule 250 source address 10.100.0.0/24
set firewall ipv4 forward filter rule 250 description 'OpenConnect clients'

# Optional: restrict VPN client access
set firewall ipv4 forward filter rule 251 action accept
set firewall ipv4 forward filter rule 251 source address 10.100.0.0/24
set firewall ipv4 forward filter rule 251 destination address 192.168.0.0/16
set firewall ipv4 forward filter rule 251 description 'VPN to corporate network'

commit
save

Configuration Examples

Example 1: Remote Access VPN for Yandex Cloud

Scenario: Company employees get secure access to resources in Yandex Cloud through an OpenConnect VPN with two-factor authentication.

Topology:

Internet
    |
    | (public IP)
    |
[VyOS OpenConnect VPN Server]
    | (internal IP)
    |
    |--- Yandex Cloud Internal Network (10.0.0.0/16)
          |
          |--- Web Server (10.0.1.10)
          |--- Database Server (10.0.2.20)
          |--- Application Server (10.0.3.30)

Requirements:

50 remote employees
Two-factor authentication (password + OTP)
Split tunneling (only Yandex Cloud traffic through the VPN)
Let’s Encrypt SSL certificate
RADIUS accounting for auditing

Configuration:

configure

# SSL certificates (Let's Encrypt)
# Obtain the certificate in advance via Certbot
set pki certificate yc-vpn-server certificate "$(cat /etc/letsencrypt/live/vpn.yandex-cloud.example.com/fullchain.pem)"
set pki certificate yc-vpn-server private key "$(cat /etc/letsencrypt/live/vpn.yandex-cloud.example.com/privkey.pem)"

set vpn openconnect ssl ca-certificate yc-vpn-server
set vpn openconnect ssl certificate yc-vpn-server

# Authentication: local with 2FA
set vpn openconnect authentication mode local password-otp

# Users with passwords and OTP
set vpn openconnect authentication local-users username admin password 'AdminSecure2024!'
set vpn openconnect authentication local-users username admin otp JBSWY3DPEHPK3PXP

set vpn openconnect authentication local-users username developer1 password 'DevPass123!@#'
set vpn openconnect authentication local-users username developer1 otp KRSXG5CTORHG6YLM

set vpn openconnect authentication local-users username manager1 password 'MgrPass456$%^'
set vpn openconnect authentication local-users username manager1 otp MFRGG2LFNFZXS4TP

# IP pool for clients (does not overlap with Yandex Cloud 10.0.0.0/16)
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# DNS servers (internal Yandex Cloud DNS + public)
set vpn openconnect network-settings name-server 10.0.0.2
set vpn openconnect network-settings name-server 8.8.8.8

# RADIUS accounting (optional)
set vpn openconnect accounting mode radius
set vpn openconnect accounting radius server 10.0.10.50
set vpn openconnect accounting radius server 10.0.10.50 key 'YandexCloudRADIUS2024'
set vpn openconnect accounting radius server 10.0.10.50 port 1813

# Port (TCP 443)
set vpn openconnect listen-ports 443

# Firewall: allow VPN traffic
set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 443
set firewall ipv4 input filter rule 150 protocol tcp
set firewall ipv4 input filter rule 150 description 'OpenConnect TCP'

set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 destination port 443
set firewall ipv4 input filter rule 151 protocol udp
set firewall ipv4 input filter rule 151 description 'OpenConnect DTLS'

# Forward for VPN clients to the Yandex Cloud network
set firewall ipv4 forward filter rule 250 action accept
set firewall ipv4 forward filter rule 250 source address 10.100.0.0/24
set firewall ipv4 forward filter rule 250 destination address 10.0.0.0/16
set firewall ipv4 forward filter rule 250 description 'VPN to Yandex Cloud'

# Block VPN client-to-client (security)
set firewall ipv4 forward filter rule 259 action drop
set firewall ipv4 forward filter rule 259 source address 10.100.0.0/24
set firewall ipv4 forward filter rule 259 destination address 10.100.0.0/24

# NAT for VPN client internet access (optional)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 10.100.0.0/24
set nat source rule 100 translation address masquerade

commit
save

Generating OTP keys for users:

# Run in operational mode for each user
generate openconnect username admin otp-key hotp-time
generate openconnect username developer1 otp-key hotp-time
generate openconnect username manager1 otp-key hotp-time

# Send the QR codes to users to set up Google Authenticator

Verification:

# Server status
show vpn openconnect-server sessions

# Connection logs
show log vpn openconnect

# RADIUS accounting (if configured)
# Check on the RADIUS server

Client configuration (Cisco AnyConnect):

Server: vpn.yandex-cloud.example.com
Username: developer1
Password: DevPass123!@#123456
          ^^^^^^^^^^^^^^ ^^^^^^
          password       OTP code

Example 2: SSL VPN for VK Cloud

Scenario: OpenConnect VPN for accessing VK Cloud resources with RADIUS authentication and full tunneling (all traffic through the VPN).

Topology:

Internet
    |
    | (public IP)
    |
[VyOS OpenConnect VPN Server] ---- [RADIUS Server]
    |                                  (192.168.10.50)
    | (internal IP)
    |
    |--- VK Cloud Network (192.168.0.0/16)
          |
          |--- Application Servers (192.168.10.0/24)
          |--- Database Cluster (192.168.20.0/24)
          |--- Storage (192.168.30.0/24)

Requirements:

100 users (RADIUS authentication)
Full tunneling (all traffic through the VPN)
RADIUS accounting
Self-signed certificates (internal use)
DNS filtering (Cloudflare for Families)

Configuration:

configure

# Generate self-signed certificates
# In operational mode:
exit
generate pki ca install vkcloud-vpn-ca common-name "VK Cloud VPN CA"
generate pki certificate sign vkcloud-vpn-ca install vkcloud-vpn-server common-name "vpn.vkcloud.local"

configure

# SSL configuration
set vpn openconnect ssl ca-certificate vkcloud-vpn-ca
set vpn openconnect ssl certificate vkcloud-vpn-server

# RADIUS authentication
set vpn openconnect authentication mode radius

# Primary RADIUS server
set vpn openconnect authentication radius server 192.168.10.50
set vpn openconnect authentication radius server 192.168.10.50 key 'VKCloudRADIUS2024SecretKey'
set vpn openconnect authentication radius server 192.168.10.50 port 1812

# Backup RADIUS server
set vpn openconnect authentication radius server 192.168.10.51
set vpn openconnect authentication radius server 192.168.10.51 key 'VKCloudRADIUS2024SecretKey'
set vpn openconnect authentication radius server 192.168.10.51 port 1812

# RADIUS timeout
set vpn openconnect authentication radius timeout 5

# RADIUS Accounting
set vpn openconnect accounting mode radius
set vpn openconnect accounting radius server 192.168.10.50
set vpn openconnect accounting radius server 192.168.10.50 key 'VKCloudRADIUS2024SecretKey'
set vpn openconnect accounting radius server 192.168.10.50 port 1813

set vpn openconnect accounting radius server 192.168.10.51
set vpn openconnect accounting radius server 192.168.10.51 key 'VKCloudRADIUS2024SecretKey'
set vpn openconnect accounting radius server 192.168.10.51 port 1813

# IP pool for clients
set vpn openconnect network-settings client-ip-settings subnet 10.200.0.0/24

# DNS servers (Cloudflare for Families - malware filtering)
set vpn openconnect network-settings name-server 1.1.1.3
set vpn openconnect network-settings name-server 1.0.0.3

# Port
set vpn openconnect listen-ports 443

# Firewall rules
set firewall ipv4 input filter rule 160 action accept
set firewall ipv4 input filter rule 160 destination port 443
set firewall ipv4 input filter rule 160 protocol tcp
set firewall ipv4 input filter rule 160 description 'OpenConnect SSL VPN'

set firewall ipv4 input filter rule 161 action accept
set firewall ipv4 input filter rule 161 destination port 443
set firewall ipv4 input filter rule 161 protocol udp
set firewall ipv4 input filter rule 161 description 'OpenConnect DTLS'

# Forward for VPN clients to the entire VK Cloud network
set firewall ipv4 forward filter rule 260 action accept
set firewall ipv4 forward filter rule 260 source address 10.200.0.0/24
set firewall ipv4 forward filter rule 260 description 'VPN clients to VK Cloud'

# NAT for full tunneling (internet through the VPN)
set nat source rule 110 outbound-interface name eth0
set nat source rule 110 source address 10.200.0.0/24
set nat source rule 110 translation address masquerade

commit
save

FreeRADIUS configuration (on RADIUS server 192.168.10.50):

# /etc/freeradius/3.0/clients.conf
client vkcloud-vpn {
    ipaddr = 192.168.10.1
    secret = VKCloudRADIUS2024SecretKey
    shortname = vyos-vpn
}

# /etc/freeradius/3.0/users
alice Cleartext-Password := "AliceSecure123"
    Reply-Message = "Welcome to VK Cloud VPN, Alice"

bob Cleartext-Password := "BobPassword456"
    Reply-Message = "Welcome to VK Cloud VPN, Bob"

charlie Cleartext-Password := "CharliePass789"
    Reply-Message = "Welcome to VK Cloud VPN, Charlie"

Verification:

# VPN sessions
show vpn openconnect-server sessions

# Accounting on the RADIUS server
radclient -x 192.168.10.50:1813 status VKCloudRADIUS2024SecretKey

Example 3: Enterprise VPN with 2FA for Corporate Access

Scenario: Corporate OpenConnect VPN with strict security requirements: mandatory 2FA, accounting, time-based access restrictions, and detailed logging.

Requirements:

Two-factor authentication (Password + OTP)
Let’s Encrypt SSL certificates
RADIUS accounting for monitoring
Split tunneling (corporate resources only)
Restricted access to specific network segments
Detailed logging and auditing

Configuration:

configure

# SSL certificates (Let's Encrypt)
set pki certificate corporate-vpn certificate "$(cat /etc/letsencrypt/live/vpn.corporation.com/fullchain.pem)"
set pki certificate corporate-vpn private key "$(cat /etc/letsencrypt/live/vpn.corporation.com/privkey.pem)"

set vpn openconnect ssl ca-certificate corporate-vpn
set vpn openconnect ssl certificate corporate-vpn

# 2FA authentication (Password + OTP)
set vpn openconnect authentication mode local password-otp

# Administrative users
set vpn openconnect authentication local-users username admin password 'Admin2FA2024!@#$'
set vpn openconnect authentication local-users username admin otp JBSWY3DPEHPK3PXP

# IT department
set vpn openconnect authentication local-users username it_user1 password 'ITSecure123!@#'
set vpn openconnect authentication local-users username it_user1 otp KRSXG5CTORHG6YLM

set vpn openconnect authentication local-users username it_user2 password 'ITSecure456$%^'
set vpn openconnect authentication local-users username it_user2 otp MFRGG2LFNFZXS4TP

# Finance department (restricted access)
set vpn openconnect authentication local-users username finance_user1 password 'FinPass789&*('
set vpn openconnect authentication local-users username finance_user1 otp GEZDGNBVGY3TQOJQ

# IP pool for VPN clients
set vpn openconnect network-settings client-ip-settings subnet 10.150.0.0/24

# DNS servers (internal corporate)
set vpn openconnect network-settings name-server 192.168.100.10
set vpn openconnect network-settings name-server 192.168.100.11

# RADIUS Accounting
set vpn openconnect accounting mode radius
set vpn openconnect accounting radius server 192.168.100.50
set vpn openconnect accounting radius server 192.168.100.50 key 'CorporateRADIUS2024'
set vpn openconnect accounting radius server 192.168.100.50 port 1813

# Port
set vpn openconnect listen-ports 443

# Firewall: inbound VPN traffic
set firewall ipv4 input filter rule 170 action accept
set firewall ipv4 input filter rule 170 destination port 443
set firewall ipv4 input filter rule 170 protocol tcp

set firewall ipv4 input filter rule 171 action accept
set firewall ipv4 input filter rule 171 destination port 443
set firewall ipv4 input filter rule 171 protocol udp

# Firewall: VPN clients to corporate servers
set firewall ipv4 forward filter rule 270 action accept
set firewall ipv4 forward filter rule 270 source address 10.150.0.0/24
set firewall ipv4 forward filter rule 270 destination address 192.168.100.0/24
set firewall ipv4 forward filter rule 270 description 'VPN to corporate servers'

# Firewall: VPN clients to applications
set firewall ipv4 forward filter rule 271 action accept
set firewall ipv4 forward filter rule 271 source address 10.150.0.0/24
set firewall ipv4 forward filter rule 271 destination address 192.168.200.0/24
set firewall ipv4 forward filter rule 271 description 'VPN to applications'

# Firewall: restrict finance department access
# (assumes the use of per-user firewall or RADIUS attributes)

# Block everything else from VPN clients
set firewall ipv4 forward filter rule 279 action drop
set firewall ipv4 forward filter rule 279 source address 10.150.0.0/24
set firewall ipv4 forward filter rule 279 description 'Block unauthorized VPN access'

# Logging
set system syslog global facility all level info

commit
save

Generating OTP keys:

generate openconnect username admin otp-key hotp-time
generate openconnect username it_user1 otp-key hotp-time
generate openconnect username it_user2 otp-key hotp-time
generate openconnect username finance_user1 otp-key hotp-time

Monitoring and auditing:

# Active sessions
show vpn openconnect-server sessions

# Authentication logs
show log | match openconnect

# RADIUS accounting records (on the RADIUS server)
tail -f /var/log/freeradius/radacct/192.168.100.1/detail-*

OpenConnect Clients

Cisco AnyConnect (Windows/macOS)

Installation:

Download the Cisco AnyConnect Secure Mobility Client
Install the client
Launch the application

Connecting:

1. Enter the server address: vpn.company.com
2. Click Connect
3. Enter Username: alice
4. Enter Password:
   - For password-otp: SecurePass123!123456
     (password + 6-digit OTP code)
   - For otp: 123456 (OTP code only)
5. Connected

Automatic configuration (AnyConnect profile):

Create a file named anyconnect-profile.xml:

<?xml version="1.0" encoding="UTF-8"?>
<AnyConnectProfile xmlns="http://schemas.xmlsoap.org/encoding/">
  <ServerList>
    <HostEntry>
      <HostName>Corporate VPN</HostName>
      <HostAddress>vpn.company.com</HostAddress>
    </HostEntry>
  </ServerList>
</AnyConnectProfile>

Import the profile into AnyConnect.

OpenConnect Client (Linux)

Installation:

# Ubuntu/Debian
sudo apt-get install openconnect network-manager-openconnect-gnome

# Fedora/RHEL
sudo dnf install openconnect NetworkManager-openconnect-gnome

# Arch Linux
sudo pacman -S openconnect networkmanager-openconnect

Connecting via CLI:

# Basic connection
sudo openconnect vpn.company.com

# With a username
sudo openconnect -u alice vpn.company.com

# With the password saved in a file (insecure!)
echo "SecurePass123!123456" | sudo openconnect -u alice --passwd-on-stdin vpn.company.com

# With custom options
sudo openconnect -u alice --authgroup=default vpn.company.com

Connecting via Network Manager (GUI):

Settings -> Network
Add VPN -> Cisco AnyConnect Compatible VPN (openconnect)
Gateway: vpn.company.com
Username: alice
Save -> Connect
Enter the password + OTP when prompted

Automatic connection script:

#!/bin/bash
# /usr/local/bin/vpn-connect.sh

USERNAME="alice"
SERVER="vpn.company.com"

# The OTP code will be requested interactively
echo "Enter password + OTP (e.g., SecurePass123!123456):"
sudo openconnect -u "$USERNAME" "$SERVER"

OpenConnect Client (macOS)

Installation via Homebrew:

brew install openconnect

# GUI client (optional)
brew install --cask openconnect-gui

Connecting:

# CLI
sudo openconnect -u alice vpn.company.com

# OpenConnect GUI
# Launch the OpenConnect GUI application
# Enter vpn.company.com and your credentials

Mobile Clients

iOS:

Cisco AnyConnect: Official client (App Store)
OpenConnect: Open-source client (limited functionality)

Android:

Cisco AnyConnect: Official client (Google Play)
OpenConnect for Android: Open-source alternative

Setup on mobile:

Install the app
Add a VPN connection
Server: vpn.company.com
Username: alice
Password: SecurePass123!123456
Connect

Advanced Configurations

Custom Port (not 443)

If port 443 is taken (for example, by an HTTPS service).

configure

# Use port 8443 instead of 443
set vpn openconnect listen-ports 8443

# Firewall
set firewall ipv4 input filter rule 152 action accept
set firewall ipv4 input filter rule 152 destination port 8443
set firewall ipv4 input filter rule 152 protocol tcp

commit
save

The client connects to:

Server: vpn.company.com:8443

Multiple IP Pools

Different IP pools for different user groups (requires identity-based configuration via files).

# Primary pool (default)
set vpn openconnect network-settings client-ip-settings subnet 10.100.0.0/24

# Additional pools are configured via /config/openconnect/ files
# (VyOS does not yet have a CLI for this)

MTU and MSS Settings

Optimization for networks with a non-standard MTU.

configure

# MTU setting (via direct ocserv options, if supported)
# By default OpenConnect uses MTU discovery

commit
save

Compression

OpenConnect supports LZS compression.

# Compression is enabled by default
# To disable it, you need to modify the ocserv configuration file directly

IPv6 Support

IPv6 support for VPN clients.

configure

# IPv6 pool for clients
set vpn openconnect network-settings client-ipv6-pool prefix 2001:db8:100::/64
set vpn openconnect network-settings client-ipv6-pool mask 96

# IPv6 DNS
# (configured via the main name-server if they support IPv6)

commit
save

Timeouts and Keepalive

Configuring session timeouts.

configure

# Idle timeout (automatic disconnect after inactivity)
# Configured through the ocserv configuration file

# DPD (Dead Peer Detection) is enabled by default

commit
save

Per-User Static IP

Static IP addresses for specific users.

# Through identity-based configuration in /config/openconnect/
# Create the file /config/openconnect/config-per-user/alice

# File contents (example):
# ipv4-network = 10.100.0.10/32
# routes = 192.168.1.0/24, 10.0.0.0/8

Monitoring and Diagnostics

Checking Server Status

# Active VPN sessions
show vpn openconnect-server sessions

# Detailed session information
show vpn openconnect-server sessions detail

Example output:

Username    Remote IP       VPN IP        Connected Since  RX/TX Bytes
--------    ---------       ------        ---------------  -----------
alice       203.0.113.50    10.100.0.10   Jan 15 09:30:21  125M / 89M
bob         198.51.100.25   10.100.0.11   Jan 15 11:15:45  45M / 23M
charlie     192.0.2.100     10.100.0.12   Jan 15 13:22:10  12M / 5M

Logs

# General OpenConnect log
show log vpn openconnect

# Last 50 lines
show log tail 50 | match openconnect

# Search for errors
show log | match "openconnect.*error"

# Search for authentication
show log | match "openconnect.*auth"

# Live log
monitor log | match openconnect

System Processes

# ocserv processes
show system processes openconnect

# Resource usage
show system resources

Network Statistics

# OpenConnect interfaces
show interfaces

# Detailed statistics
show interfaces detail | match vpns

# Routing table (VPN routes)
show ip route

RADIUS Status

# Check connectivity to the RADIUS server
# (run on VyOS)
ping 192.168.1.10

# Check the RADIUS port (from the client)
nc -zv 192.168.1.10 1812

# RADIUS accounting logs (on the RADIUS server)
tail -f /var/log/freeradius/radius.log

Troubleshooting

Client Cannot Connect

Problem: “Connection failed” or “Connection timeout”.

Diagnostics:

# Check the firewall
show firewall ipv4 input filter

# Check that the port is open
sudo netstat -tlnp | grep 443

# Check the logs
show log | match openconnect | tail 20

# Check the SSL certificates
show pki certificate openconnect-server

Solution:

Make sure the firewall rules allow TCP 443:

set firewall ipv4 input filter rule 150 action accept
set firewall ipv4 input filter rule 150 destination port 443
set firewall ipv4 input filter rule 150 protocol tcp
commit

Check the SSL certificate (whether it has expired):

show pki certificate openconnect-server
# Check the "Valid until" field

Check that the OpenConnect service is running:
```
show vpn openconnect-server sessions
```

Authentication Fails

Problem: “Authentication failed” or “Invalid username/password”.

Diagnostics:

# Check the users
show configuration commands | match openconnect.*username

# Check the OTP keys
show configuration commands | match openconnect.*otp

# Authentication logs
show log | match "auth.*failed"

Solution for local authentication:

# Reset a user's password
configure
set vpn openconnect authentication local-users username alice password 'NewSecurePass123!'
commit

Solution for RADIUS:

# Check connectivity to RADIUS
ping 192.168.1.10

# Check the RADIUS shared secret
show configuration commands | match radius.*key

# Test RADIUS (from the RADIUS server)
radtest alice SecurePassword 192.168.1.1 0 SharedSecret123

Solution for 2FA OTP:

# Regenerate the OTP key
exit
generate openconnect username alice otp-key hotp-time

# Update the key in the configuration
configure
set vpn openconnect authentication local-users username alice otp NEW_KEY
commit

Connected but No Connectivity

Problem: The VPN is connected, the client received an IP, but there is no access to the internal network.

Diagnostics:

# Check that the client received an IP
show vpn openconnect-server sessions

# Check routing
show ip route

# Check firewall forward
show firewall ipv4 forward filter

# Ping from VyOS to the client
ping 10.100.0.10 source-address 192.168.1.1

Solution:

configure

# Add firewall forward rules
set firewall ipv4 forward filter rule 250 action accept
set firewall ipv4 forward filter rule 250 source address 10.100.0.0/24
set firewall ipv4 forward filter rule 250 description 'VPN clients'

# Check NAT (if internet access is needed)
set nat source rule 100 outbound-interface name eth0
set nat source rule 100 source address 10.100.0.0/24
set nat source rule 100 translation address masquerade

commit

DNS Does Not Work

Problem: Clients cannot resolve names.

Solution:

configure

# Check the DNS servers
show configuration commands | match openconnect.*name-server

# Add public DNS
set vpn openconnect network-settings name-server 8.8.8.8
set vpn openconnect network-settings name-server 1.1.1.1

commit

Poor Performance

Problem: Slow speed over the VPN.

Diagnostics:

# Check CPU/Memory
show system resources

# Network statistics
show interfaces statistics

Solution:

# MTU optimization (on the client)
# In AnyConnect: Settings -> Preferences -> MTU = 1400

# Check that DTLS is working (UDP 443 is open)
set firewall ipv4 input filter rule 151 action accept
set firewall ipv4 input filter rule 151 destination port 443
set firewall ipv4 input filter rule 151 protocol udp
commit

# Hardware offload (if supported)
set system acceleration options

RADIUS Timeout

Problem: “RADIUS server timeout” in the logs.

Solution:

configure

# Increase the timeout
set vpn openconnect authentication radius timeout 10

# Add a backup RADIUS server
set vpn openconnect authentication radius server 192.168.1.11
set vpn openconnect authentication radius server 192.168.1.11 key 'SharedSecret'
set vpn openconnect authentication radius server 192.168.1.11 port 1812

commit

SSL Certificate Errors

Problem: “SSL certificate verification failed” on the client.

Solution for self-signed certificates:

# On the client, disable certificate verification:
# OpenConnect CLI:
sudo openconnect --no-cert-check vpn.company.com

# AnyConnect:
# Settings -> Preferences -> Untrusted Server Warning -> Unblock

Solution for production (use Let’s Encrypt):

# Obtain a valid certificate
sudo certbot certonly --standalone -d vpn.company.com

# Import into VyOS
configure
set pki certificate openconnect-server certificate "$(cat /etc/letsencrypt/live/vpn.company.com/fullchain.pem)"
set pki certificate openconnect-server private key "$(cat /etc/letsencrypt/live/vpn.company.com/privkey.pem)"
commit

Security

Security Recommendations

Use strong passwords:
- At least 12 characters
- A combination of letters, digits, and special characters
- Regular password rotation

Mandatory 2FA for production:

set vpn openconnect authentication mode local password-otp

Use Let’s Encrypt certificates:
- Automatic renewal
- Trusted by clients
- Free
RADIUS for centralized authentication:
- A single user database
- Accounting and auditing
- The option to integrate with AD/LDAP

Firewall restrictions:

# Rate limiting for the VPN port
set firewall ipv4 input filter rule 150 recent count 10
set firewall ipv4 input filter rule 150 recent time minute 1

Log all connections:

set system syslog global facility all level info

Regular updates:
```
# Update VyOS
add system image latest
```

IP whitelist (where possible):

# Allow the VPN only from specific IPs
set firewall ipv4 input filter rule 150 source address 203.0.113.0/24

Protection Against Attacks

DDoS protection:

configure

# Connection rate limiting
set firewall ipv4 input filter rule 150 recent count 5
set firewall ipv4 input filter rule 150 recent time second 10

# SYN flood protection
set firewall ipv4 input filter rule 149 action drop
set firewall ipv4 input filter rule 149 protocol tcp
set firewall ipv4 input filter rule 149 tcp flags syn
set firewall ipv4 input filter rule 149 recent count 20
set firewall ipv4 input filter rule 149 recent time second 1

commit

Brute-force protection (via fail2ban on VyOS):

# Install fail2ban (operational mode)
sudo apt-get install fail2ban

# fail2ban configuration for OpenConnect
# /etc/fail2ban/jail.local
[openconnect]
enabled = true
port = 443
filter = openconnect
logpath = /var/log/messages
maxretry = 5
bantime = 3600
findtime = 600

Auditing and Compliance

Logging for compliance:

configure

# Syslog to a remote server
set system syslog host 192.168.1.100 facility all level info
set system syslog host 192.168.1.100 port 514

# RADIUS accounting for auditing
set vpn openconnect accounting mode radius
set vpn openconnect accounting radius server 192.168.1.50
set vpn openconnect accounting radius server 192.168.1.50 key 'AuditSecret'
set vpn openconnect accounting radius server 192.168.1.50 port 1813

commit

Regular user audits:

# List of active users
show configuration commands | match openconnect.*username

# Connection history (from the logs)
show log | match "openconnect.*connected"

Integration with Other Services

OpenConnect + LDAP/Active Directory

Integration through RADIUS as a proxy to AD.

FreeRADIUS with LDAP (on the RADIUS server):

# /etc/freeradius/3.0/mods-enabled/ldap
ldap {
    server = "ldap.company.com"
    identity = "cn=radius,dc=company,dc=com"
    password = "RadiusLDAPPassword"
    base_dn = "ou=users,dc=company,dc=com"

    filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"

    user {
        base_dn = "${..base_dn}"
        filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})"
    }
}

VyOS configuration:

configure
set vpn openconnect authentication mode radius
set vpn openconnect authentication radius server 192.168.1.10 key 'Secret'
commit

OpenConnect + Monitoring

Monitoring the VPN through Prometheus/Grafana.

Node Exporter on VyOS:

# Install node_exporter
sudo apt-get install prometheus-node-exporter

# Firewall for Prometheus
set firewall ipv4 input filter rule 180 action accept
set firewall ipv4 input filter rule 180 source address 192.168.1.200
set firewall ipv4 input filter rule 180 destination port 9100
set firewall ipv4 input filter rule 180 protocol tcp

Custom OpenConnect metrics:

#!/bin/bash
# /usr/local/bin/openconnect_exporter.sh

# Number of active sessions
SESSIONS=$(occtl show users | grep -c "Username:")
echo "openconnect_sessions $SESSIONS"

# Output the metrics

OpenConnect + Backup VPN

OpenConnect as a backup for IPsec.

configure

# Primary: IPsec
set vpn ipsec...

# Backup: OpenConnect
set vpn openconnect...

# Routing with priorities (via dynamic routing or monitoring scripts)

commit

Best Practices

Always use 2FA for production environments
Let’s Encrypt certificates instead of self-signed ones
RADIUS accounting for auditing and compliance
Split tunneling when a full tunnel is not required (saves bandwidth)
Firewall rules to restrict VPN client access
Rate limiting on the VPN port to protect against DDoS
Regular audits of users and sessions
Configuration backups before making changes
Monitoring of active sessions and resources
Documentation of access and configurations
Regular updates of VyOS and OpenConnect
Testing before applying in production
Disaster recovery plan for the VPN service
OTP key rotation when employees change
Logging to a remote syslog to preserve the audit trail

Migration from Other VPNs

From Cisco AnyConnect to OpenConnect

Advantages of migration:

An open-source solution (no licenses)
Full compatibility with existing clients
More flexibility in configuration
Lower cost of ownership

Migration plan:

Set up OpenConnect in parallel with Cisco AnyConnect
Use the same IP address pool (or a new one, if possible)
Migrate users in phases (by department)
Trial period (both VPNs run)
Full migration after successful tests
Decommission Cisco AnyConnect

From OpenVPN to OpenConnect

Reasons to migrate:

Compatibility with AnyConnect clients is needed
Built-in 2FA (OTP) is required
Simpler for users (Cisco AnyConnect is familiar to many)

Plan:

Install OpenConnect on a new port (or a new server)
Create the same users
Distribute connection instructions
Grace period (both VPNs run)
Migrate users
Decommission OpenVPN

Conclusion

OpenConnect VPN Server is a powerful, secure, and flexible solution for enterprise remote access VPN, especially suited for:

Enterprise environments with security and auditing requirements
Replacing commercial Cisco AnyConnect with an open-source solution
Two-factor authentication for critical access
Integration with RADIUS/LDAP/AD for centralized user management
Strict firewall restrictions (operating on TCP 443 only)
Cross-platform clients with a unified interface

VyOS provides full OpenConnect support with all enterprise features: local authentication, RADIUS, 2FA OTP, SSL certificates, RADIUS accounting, and identity-based configuration.

For maximum performance of site-to-site tunnels, consider WireGuard or IPsec, and for simple remote access scenarios, OpenVPN. OpenConnect is ideal when you need a balance between security, compatibility, and enterprise features.

Related material

WireGuard on VyOS - modern high-performance VPN
IPsec on VyOS - enterprise-grade site-to-site VPN
OpenVPN on VyOS - SSL VPN with TLS for remote access
L2TP/IPsec on VyOS - VPN for Windows and macOS clients

Reviewed by OpenNix LLC · Last updated on 30 July 2026

L2TP/IPsec VPN WireGuard VPN on VyOS - Setup and Examples