OpenConnect


OpenConnect is an open-source software application for connecting to virtual private networks, which implement secure point-to-point connections.
It was originally written as an open-source replacement for Cisco's proprietary AnyConnect SSL VPN client, which is supported by several Cisco routers., the OpenConnect project also offers an AnyConnect-compatible server, ocserv, and thus offers a full client-server VPN solution.
The OpenConnect client added support for Juniper Networks' SSL VPN in version 7.05,. A fork then developed support for Palo Alto Networks' GlobalProtect VPN, which was included in the version 8.00 release.

Protocols

Cisco AnyConnect VPNs utilize TLS to authenticate and configure routing, then DTLS to efficiently encrypt and transport the tunneled VPN traffic, and can fall back to TLS-based transport where firewalls block UDP-based traffic. The DTLS protocol used by Cisco AnyConnect servers was based on a non-standard, pre-release draft of DTLS 1.0, until support for the DTLS 1.2 standard was added in 2018.
OpenConnect and ocserv implement an extended version of the AnyConnect VPN protocol, within an open-source project unaffiliated with Cisco. Both OpenConnect and ocserv strive to maintain seamless backwards-compatibility with Cisco AnyConnect servers and clients.
The OpenConnect client also implements Juniper and GlobalProtect VPN protocols. These have a very similar structure to the AnyConnect protocol: they authenticate and configure routing over TLS, except that they use ESP for efficient, encrypted transport of tunneled traffic, but they too can fall back to TLS-based transport.

Architecture

The OpenConnect client is written primarily in C, and it contains much of the infrastructure necessary to add additional VPN protocols operating in a similar flow, and to connect to them via a common user interface:
OpenConnect is available on Solaris, Linux, OpenBSD, FreeBSD, MacOS, and has graphical user interface clients for Windows, GNOME, and KDE. A graphical client for OpenConnect is also available for Android devices,
and it has been integrated into router firmware packages such as OpenWrt.