RWTH OpenConnect Tools

Fish-shell commands for the central RWTH Aachen and IHF VPN gateways, with full-tunnel and server-managed split-tunnel modes. An optional ihf-drive workflow connects the IHF split tunnel and opens a user-configured SMB share.

The scripts use OpenConnect only. Cisco Secure Client is not required.

Features

• ihf-vpn and rwth-vpn with --full and --split
• Server-provided split routes—no hard-coded route deletion or replacement
• Route verification after every connection, with automatic disconnect on a policy mismatch
• Clean shutdown through ihf-stop and rwth-stop
• Optional, per-user ihf-drive configuration with no credentials in Git
• PID and mode tracking so an existing connection can be reused or switched
• Credential files must be owned by the current user and use mode 600 or 400

Requirements

Linux with:

• Fish 3.6 or newer
• OpenConnect
• a vpnc-script compatible routing script (normally installed with OpenConnect or a vpnc/vpnc-scripts package)
• Bash 4 or newer for the optional drive helper
• ip from iproute2, sudo, ps, getent, awk, and standard GNU/Linux core utilities

Optional ihf-drive dependencies:

• GVfs with SMB support (gio and usually a gvfs-smb package)
• Thunar
• flock, getent, and timeout
• xdotool for automatic Thunar-window tracking on X11; without it, cleanup falls back to an Enter prompt

Example package commands:

# Arch Linux
sudo pacman -S fish openconnect vpnc gvfs-smb thunar xdotool

# Debian/Ubuntu (package names can vary by release)
sudo apt install fish openconnect vpnc-scripts iproute2 gvfs-backends thunar xdotool

The static and isolated per-user installation tests run on current Arch Linux during development and on the latest Ubuntu GitHub Actions runner. Other GNU/Linux distributions with the requirements above should work, but package names and desktop integration can differ.

Install

Clone the repository, then run:

fish install.fish

The installer copies the commands into the current user's home directory and, when no VPN config exists yet, prompts for that user's RWTH VPN account. The password is written only to ~/.config/openconnect/rwth-vpn.conf with mode 600.

To install without configuring credentials:

fish install.fish --no-credentials

To interactively create the optional drive configuration too:

fish install.fish --with-drive

Open a new Fish shell after installation:

exec fish

Quick usage

# IHF: all traffic through VPN (default)
ihf-vpn

# IHF: only IHF/RWTH destinations through VPN
ihf-vpn --split

# Central RWTH equivalents
rwth-vpn --full
rwth-vpn --split

# Check connection state
ihf-vpn --status
rwth-vpn --status

# Disconnect cleanly
ihf-stop
rwth-stop

OpenConnect asks for the current MFA/TOTP code during login. It reads the VPN username and password from the private local configuration.

IHF drive for different users

ihf-drive never contains a person's username, password, folder, or share. Each user creates ~/.config/ihf-openconnect-tools/ihf-drive.conf from config/ihf-drive.conf.example.

Examples:

# User who wants the root of an assigned share
IHF_DRIVE_SERVER_HOST=fileserver.example.invalid
IHF_DRIVE_SERVER_IP=192.0.2.10
IHF_DRIVE_SHARE=public
IHF_DRIVE_USER=ab123456
IHF_DRIVE_PASSWORD='their-own-smb-password'
IHF_DRIVE_FOLDER=

# Another user who wants a nested team folder
IHF_DRIVE_SERVER_HOST=department-files.example.invalid
IHF_DRIVE_SERVER_IP=192.0.2.20
IHF_DRIVE_SHARE=projects
IHF_DRIVE_USER=cd654321
IHF_DRIVE_PASSWORD='their-own-smb-password'
IHF_DRIVE_FOLDER=team-blue

Then:

chmod 600 ~/.config/ihf-openconnect-tools/ihf-drive.conf
ihf-drive

The drive command starts ihf-vpn --split only when the configured server is not already routed through ihfvpn. It can also show status or unmount without opening Thunar:

ihf-drive --status
ihf-drive --unmount
ihf-drive --disconnect

See docs/USAGE.md for every command and configuration path, and docs/TROUBLESHOOTING.md for diagnostics.

RWTH documents OpenConnect as an unsupported fallback. Gateway changes can therefore require updates to these scripts.

This is an unofficial community project and is not affiliated with or supported by RWTH Aachen University, IHF, Cisco, or the OpenConnect project.

References:

• RWTH VPN modules and client overview
• RWTH Linux VPN guide and split/full definitions
• RWTH VPN FAQ, including the OpenConnect fallback
• OpenConnect manual

Uninstall

fish uninstall.fish

Credentials are preserved by default. To remove them as well:

fish uninstall.fish --purge

License

GPL-3.0-only. See LICENSE.