4 ms·
No, they actually block them by actively inserting their own routes at a higher priority and inserting firewall rules. You can fool around with LD_PRELOAD to n
by tyingq 4y ago
No, they actually block them by actively inserting their own routes at a higher priority and inserting firewall rules. You can fool around with LD_PRELOAD to neuter their functions that do this and get everything working end-to-end. They are blocking things that would otherwise be NATed and work just fine.
There's also workarounds for Windows using Powershell scripts and "Set-NetIPInterface -InterfaceMetric 6000" to lower the priority of the AnyConnect internal routes that break docker, or using wsl-vpnkit (as DockerDesktop does).
- chrisweekly 4y agoHave you written any of this up in more detail, or have relevant links to share?
- Hikikomori 4y agoOnly if you configure them to do so. I created our Globalprotect solution and we use docker extensively without issues. It just sets a default route (0/1 and 128/1) and users just need to NAT from the docker network for it to work.
- tyingq 4y agoWell, "you" being the entity that controls the head end of the VPN, which controls settings not (always) tweakable by the end user.