ericwastakenondocker/openconnect-proxy repository overview

⁠OpenConnect Proxy Docker Container

This is a Docker containerized version of Openconnect and OCProxy that establishes a SOCKS5 proxy through a VPN. The container requires specific environment variables to be set before running. Below are the steps to launch this container using both Docker CLI and Docker Compose.

For more information on OpenConnect and OCProxy, visit the following links:

• https://www.infradead.org/openconnect/⁠
• https://github.com/cernekee/ocproxy⁠

⁠Image Variants

There are two Docker image variants:

• ericwastakenondocker/openconnect-proxy:latest is the plain username/password image. Use this for normal OpenConnect password, Duo push, or OTP-style flows where OpenConnect can authenticate from stdin.
• ericwastakenondocker/openconnect-proxy:latest-saml is the GlobalProtect SAML image. Use this when AUTH_MODE=saml and the VPN requires browser-based SAML authentication.

Versioned tags follow the same pattern:

ericwastakenondocker/openconnect-proxy:<version>
ericwastakenondocker/openconnect-proxy:<version>-saml

The SAML image is much larger because it includes the browser/noVNC/Xvfb/WebKit stack needed to complete SAML login. If you do not need SAML, use the plain image.

Set IMAGE in each VPN profile so the selected image is explicit.

For a plain username/password profile:

IMAGE=ericwastakenondocker/openconnect-proxy:latest
AUTH_MODE=password

For a GlobalProtect SAML profile:

IMAGE=ericwastakenondocker/openconnect-proxy:latest-saml
AUTH_MODE=saml

⁠Environment Variables

Before running the container, you need to define the following environment variables:

• IMAGE
• USERNAME
• PASSWORD
• HOST
• FINGERPRINT
• FINGERPRINT_2 (optional)
• AUTHGROUP
• PROTOCOL
• PROXY_PORT
• AUTH_MODE (optional, defaults to password; use saml for GlobalProtect SAML)
• SAML_AUTH_PORT (required for AUTH_MODE=saml)
• SAML_MODE (optional, defaults to portal. Supports automatic gateway discovery.)
• SAML_CLIENTOS (optional, defaults to Windows)
• SAML_USER_AGENT (optional; spoofs a browser User-Agent for Duo/Okta checks)
• SAML_NO_VERIFY (optional, defaults to true; only affects gp-saml-gui portal discovery)
• SAML_AUTH_ONLY (optional, defaults to false; only for local SAML mock testing)

See the example .env file provided in the GitHub repo for more information. (See the bottom of this page for the link.)

⁠Running with Docker CLI

To run the container using the Docker CLI, use the following command (assuming you have a vpn1.env file with the needed environment variables):

docker run -d \
  --name vpn_service_1 \
  --env-file vpn1.env \
  -p 8222:8222 \
  ericwastakenondocker/openconnect-proxy:latest

Be sure you expose the same port in the -p 8222:8222 argument in the command line as you entered in the PROXY_PORT variable in your vpn1.env file.

⁠Managing Profiles with the Helper Script

The GitHub repo includes x-start-vpn.sh, a helper for choosing and starting VPN profiles without typing the full Docker Compose command each time.

The script looks for VPN profile .env files in the project directory and in ./vpn-profiles, shows which profiles are already running, warns about duplicate PROXY_PORT conflicts, and only offers profiles that can be started safely.

Run it from the project directory:

./x-start-vpn.sh

After you select a profile, the script shows the equivalent Docker Compose command so you can run it manually in the future. It uses the profile file name as the Compose project namespace. For example, vpn-profiles/vpn1.env becomes project vpn1:

docker compose --env-file "vpn-profiles/vpn1.env" -p "vpn1" up -d

The -p flag is the Docker Compose project name. It is not strictly required for a single VPN profile, but it is recommended when using multiple profiles because it keeps each profile in its own Compose namespace.

For a GlobalProtect SAML profile, set AUTH_MODE=saml and a unique SAML_AUTH_PORT in the profile. The helper automatically adds the SAML Compose override, checks both the proxy port and browser-login port for conflicts, shows the image it will use, and prints the equivalent manual command.

⁠Running with Docker Compose

To run the container using Docker Compose, create a docker-compose.yml file in your project directory (assuming you have a vpn1.env file with the needed environment variables):

services:
  vpn_service_1:
    image: "${IMAGE:-ericwastakenondocker/openconnect-proxy:latest}"
    container_name: "vpn_service_port_${PROXY_PORT}"
    ports:
      - "${PROXY_PORT}:${PROXY_PORT}"
    environment:
      AUTH_MODE: "${AUTH_MODE:-password}"
      USERNAME: "${USERNAME}"
      PASSWORD: "${PASSWORD:-}"
      PASSWORD_PATH: "${PASSWORD_PATH:-}"
      HOST: "${HOST}"
      FINGERPRINT: "${FINGERPRINT}"
      FINGERPRINT_2: "${FINGERPRINT_2:-}"
      AUTHGROUP: "${AUTHGROUP}"
      PROTOCOL: "${PROTOCOL}"
      PROXY_PORT: "${PROXY_PORT}"
      SAML_AUTH_PORT: "${SAML_AUTH_PORT:-8080}"
      SAML_CLIENTOS: "${SAML_CLIENTOS:-Windows}"
      SAML_USER_AGENT: "${SAML_USER_AGENT:-}"
      SAML_MODE: "${SAML_MODE:-portal}"
      SAML_NO_VERIFY: "${SAML_NO_VERIFY:-true}"
      SAML_AUTH_ONLY: "${SAML_AUTH_ONLY:-false}"

Ensure you have your profile env file in the same directory as docker-compose.yml or under vpn-profiles.

To start the service with Docker Compose, run:

docker compose --env-file "vpn-profiles/vpn1.env" -p "vpn1" up -d

For a SAML profile, include the SAML override file so the browser-login port is exposed:

docker compose -f docker-compose.yml -f docker-compose.saml.yml --env-file "vpn-profiles/vpn1.env" -p "vpn1" up -d

For manual Docker Compose usage, --env-file is required unless the variables are already exported in your shell or stored in Compose's default .env file. The -p project name is optional for one profile, but required if you want multiple profiles to run side by side cleanly. The -d flag is optional; it runs the service in the background.

⁠GlobalProtect SAML Authentication

SAML mode is for GlobalProtect (PROTOCOL=gp) portals or gateways that require browser authentication. The image includes Smart Discovery logic that automatically detects if SAML is required at the Portal or Gateway level.

Set AUTH_MODE=saml, choose a unique SAML_AUTH_PORT, and open the printed noVNC URL, usually http://localhost:<SAML_AUTH_PORT>/. Complete the browser login there. After gp-saml-gui captures the SAML cookie, the container starts OpenConnect.

Use SAML_MODE=portal first (it's the default and handles discovery). SAML_USER_AGENT defaults to a standard Chrome browser string to bypass OS checks from Duo/Okta.

The default Docker image is the smaller password-mode image. SAML profiles must use a SAML-capable image, such as ericwastakenondocker/openconnect-proxy:latest-saml or a local test image like openconnect-proxy:saml-test.

⁠Additional Commands

To stop the container:

docker-compose down

To view the logs:

docker-compose logs

⁠Usage Notes

• Ensure Docker and Docker Compose are installed on your machine.
• Adapt environment variables according to your needs.
• Ensure ports in the DOCKER CLI and docker-compose.yml match the PROXY_PORT variable!
• You can have multiple .env files and multiple services in the docker-compose.yml file to run multiple VPN connections. Be sure to select different ports for the PROXY_PORT variable in each .env file and service so you can use them simultaneously.

⁠GitHub

See the GitHub repo for more information including how to for and build your own version.

https://github.com/ericwastaken/openconnect-proxy⁠