---
name: "ocproxy"
section: "1"
platform: "linux"
package: "ocproxy"
version: "1.60-1+b3"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/ocproxy"
---

# ocproxy(1)

lwip based proxy for openconnect

## NAME

ocproxy - lwip based proxy for openconnect

## SYNOPSIS

**ocproxy** \[*options*\]

## DESCRIPTION

This manual page documents briefly the **ocproxy** command.

**ocproxy** is a program that provides a SOCKS and port-forwarding proxy when used in conjunction with **openconnect**(1). When using ocproxy, OpenConnect only handles network activity that the user specifically asks to proxy, so the VPN tunnel no longer "hijacks" all network traffic on the host.

**ocproxy** accomplishes this by running a lwIP network stack in userland, so the OS kernel is no longer directly handling packets sent to and from the VPN connection.

## BASIC USAGE

**ocproxy** should be invoked directly from OpenConnect or another VPN program; a file descriptor number is passed through the **VPNFD** environment variable to tell **ocproxy** how to send and receive VPN traffic.  For example:

openconnect --script-tun --script "ocproxy -D 11080 -L2222:unix-host:22" vpn.example.com

Commonly used options include:

- **-D, --dynfw** \[*bind\_address*:\]*port*

  Start up a SOCKS5 server on TCP port *port* to dynamically forward application-level traffic over the VPN proxy.  This is intended to resemble the **-D** option to [**ssh**(1)](/ssh/1.md).  If *bind\_address* is unspecified, **ocproxy** will bind to the loopback interface by default unless **--allow-remote** is used.

- **-L, --localfw** *port:host:hostport*

  Bind to port local TCP port *port*, and forward incoming connections to *host:hostport* on the VPN.  *host* can be a DNS name or a dotted-quad IP address.  If the VPN supplied a default DNS domain name or **--domain** was specified on the command line, unqualified hostnames may be used.  This is intended to resemble the **-L** option to [**ssh**(1)](/ssh/1.md).

- **-g, --allow-remote**

  Local listening sockets opened by the **--dynfw** and **--localfw** options, by default, will be bound to the loopback interface only (127.0.0.1) so they are only available on the local machine.  If **--allow-remote** is specified, the sockets will be bound to **INADDR\_ANY** (0.0.0.0) instead, and other hosts may connect to them.  This is intended to resemble the **-g** option to [**ssh**(1)](/ssh/1.md).

- **-k, --keepalive** *interval*

  Send a TCP keepalive packet every *interval* seconds on each open connection, on the VPN side.  This can help avoid idle timeouts, both on the VPN gateway and on any stateful firewalls in between the two ends.

## ADVANCED USAGE

These options may be useful for debugging **ocproxy** or diagnosing problems:

- **-v, --verbose**

  Enable verbose debugging output.

- **-T, --tcpdump**

  Write a log of all TCP or UDP packets traversing the VPN to */tmp/tcpdump*. The format largely mirrors the output of the [tcpdump(8)](/tcpdump/8.md) utility.

**ocproxy** will normally retrieve IP configuration parameters through environment variables provided by OpenConnect.  These options may be used to override the autodetected parameters:

- **-I, --ip** *local\_ip*

  Use *local\_ip* for the VPN side IP address.  Example: 192.168.5.20. This is normally set through the **INTERNAL\_IP4\_ADDRESS** environment variable.

- **-M, --mtu** *mtu\_bytes*

  Use *mtu\_bytes* as the maximum transmit unit on the VPN interface; it generally depends on DTLS and UDP packet overhead.  Example: 1300.  This is normally set through the **INTERNAL\_IP4\_MTU** environment variable.

- **-d, --dns** *dns\_ip*

  Send all VPN side DNS queries to server *dns\_ip*.  Example: 192.168.5.2. This is normally set through the **INTERNAL\_IP4\_DNS** environment variable.

- **-o, --domain** *domain*

  Use *domain* as the default DNS domain, for unqualified hostnames. This is normally set through the **CISCO\_DEF\_DOMAIN** environment variable.

## SEE ALSO

[**vpnns**(1)](/vpnns/1.md), [**openconnect**(8)](/openconnect/8.md), [**ssh**(1)](/ssh/1.md)

*http://savannah.nongnu.org/projects/lwip/*