OpenConnect in Docker (SOCKS5)

The stock Cisco client doesn't support split tunneling and doesn't play well alongside other VPNs / proxies. OpenConnect is protocol-compatible with AnyConnect and works better for this. For a bare-metal reference setup, see Mark4551124015/HKU-VPN.

This repo instead provides a Dockerized OpenConnect container that exposes a local SOCKS5 proxy on port 1080. Point any app at socks5://127.0.0.1:1080, or chain another VPN / proxy through it, e.g. to reach ChatGPT / Claude from a network where OpenConnect is the only way out.

Pick a variant

Script	Proxy backend	Notes
openconnect-setup.sh	microsocks	Lighter weight, SOCKS5 only
openconnect-gost-setup.sh	gost	Heavier, supports more protocols / chaining features

Container images referenced by these scripts are built from ma-wenqian/dockerfiles/openconnect.

Quick install (Linux / macOS)

# lighter option: OpenConnect + microsocks
curl -fsSL https://sh.mawenqian.com/openconnect-setup.sh | bash

# OpenConnect + gost
curl -fsSL https://sh.mawenqian.com/openconnect-gost-setup.sh | bash

Each script:

1. Creates an install directory (/opt/openconnect-head or /opt/openconnect-gost, overridable via INSTALL_DIR).
2. Drops a .env template (host / user / password / TOTP secret + optional local network routing) with chmod 600.
3. Writes a Dockerfile and docker-compose.yaml that build the proxy + OpenConnect image.

Start it

cd /opt/openconnect-head   # or /opt/openconnect-gost
$EDITOR .env               # fill in your real VPN details
docker compose up -d --build

The container reconnects automatically if the OpenConnect session drops (--force-dpd=30 + a restart loop), and exposes a health check that pings 1.1.1.1 through the tunnel.

Reaching it from other devices

To let other devices on your LAN use the proxy (not just the Docker host), set LOCAL_NETWORK / LOCAL_GATEWAY in .env. If it's only used from the host machine, leave those at their defaults.