I will use systemd oneshot-service to do this. To share SNX connection you will have to configure SNAT dynamically after connection (and disconnection). # ipv4/ipv6 Simple & Safe Firewall # you can find examples in /usr/share/nftables/ flush ruleset You can download SNX installer from your company’s VPN portal: Within a particular LAN and I would have to create and delete routeĪnd change DNS servers every time manually. Why WireGuard? I could just use IP forwarding and NAT tweaks, but it would only work

At client-side use only one simple route: 10.0.0.0/8.

Use WireGuard tunnels to share VPN connection.

Completely isolate Checkpoint SNX inside Linux VM.So I had an idea: it would be nice to just share Checkpoint VPN connection with other computers. Trying to reach corporate resources, I cannot reach the Internet without corporate proxy and vice versa. In my case, the company decided that split tunneling isn’t secure. There is no way to somehow reconfigure this. Gateways like this are pushing settings from the server including routes, usually The shitty quality of Linux solution itself wasn’t the main reason to isolate it. The distros they consider relevant in 2021: Ubuntu 17.04, Fedora 18, openSUSE 12.2. Sounds okay on paper, right?īut as you know, proprietary software has something in common: the quality of Linux support generally sucks. In case of Linux we have to use whateverĬalled Checkpoint SSL Network Extender or just Checkpoint SNX.Īs far as I got, it encapsulates traffic into HTTPS connection between you and My company uses Checkpoint products as a VPN solution. Checkpoint SNX adventure: isolating the proprietary in it own box Checkpoint SNX adventure: isolating the proprietary in it own box

Checkpoint vpn download