9.21-3

Security update — upgrading is recommended. The image moves to Alpine 3.24.2 and picks up OpenSSL 3.5.9 and curl 8.22.0, both security releases. It also adds TTL_SET, the TTL / hop-limit normalization knob shared with the sibling cascade images.

📥 Pull this release

docker pull azinchen/openconnect-client:9.21-3
docker pull ghcr.io/azinchen/openconnect-client:9.21-3

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

No action required — no existing variables or defaults changed. TTL_SET is off unless set. TTL_INC is a reserved name: setting it stops the container at startup (see below).

✨ Features

• TTL / hop-limit normalization (TTL_SET). TTL_SET=<1-255> rewrites the IPv4 TTL — and the IPv6 hop-limit unless IPV6_MODE=off — of everything leaving through the tunnel: forwarded gateway clients, containers in network_mode: service:vpn and the container's own traffic. The VPN server sees exactly this value regardless of how many hops a packet crossed before, and every hop behind this container (the VPN server, further cascade gates, the internet path) disappears from a client traceroute. The rule lives in its own table (inet vpn_ttl), is installed once at boot and survives reconnects. An invalid value, or a rule the kernel refuses, aborts container start instead of running with the topology exposed. Same variable and semantics as in ocserv-server, nordvpn and nordvpn-wg. TTL_INC (hiding this node itself) is reserved for a later phase and is refused at startup rather than silently ignored. See Gateway Mode — TTL normalization. (#34)

📦 Package Updates

• Bump Alpine Linux 3.24.1 → 3.24.2 — security release: fixes all known high and medium severity OpenSSL vulnerabilities for the branch, plus other security and bug fixes (announcement) (#24)
• Bump openssl 3.5.7-r0 → 3.5.9-r0 — two upstream security patch releases, 3.5.8 (most severe CVE: Moderate) and 3.5.9 (most severe CVE: High). The image uses the openssl tool only to compute the server certificate pin; openconnect itself is built against GnuTLS (#17, #31)
• Bump curl 8.21.0-r0 → 8.22.0-r0 — 8.22.0 fixes nine CVEs affecting 8.21.0; curl runs the health-check probe (#20)
• Bump bind-tools 9.20.26-r0 → 9.20.29-r0 (#20, #29)
• Bump ca-certificates 20260611-r0 → 20260909-r0 and tzdata 2026c-r0 → 2026d-r0 (#23)
• Bump xz 5.8.3-r0 → 5.8.4-r0 — build stage only, not in the final image; 5.8.4 fixes an invalid memory access in liblzma (GHSA-5qpq-xqfv-j9pg) (#20)

📖 Documentation

• README: environment variables are grouped by feature, one variable per row, with links to the matching wiki pages. (#35)
• README: badge block matching the sibling images — release, build, stars, Docker pulls, image size, multi-arch. (#33)

🔧 CI/CD Updates

• Bump github/codeql-action from 4.37.3 to 4.38.2 (#11, #13, #14, #16, #18, #22, #27, #30)
• Bump super-linter/super-linter from 8.7.0 to 9.0.0 (#32)
• Bump docker/setup-buildx-action from 4.2.0 to 4.4.1 (#15, #26)
• Bump docker/setup-qemu-action from 4.2.0 to 4.4.0 (#21, #28)
• Bump docker/build-push-action from 7.3.0 to 7.4.0 (#25)
• Bump anchore/scan-action from 7.4.0 to 7.4.2 (#19)
• Bump docker/login-action from 4.5.1 to 4.6.0 (#12)

🧩 Component versions

Component	Version
OpenConnect	9.21 (GnuTLS build)
Alpine Linux	3.24.2
s6-overlay	3.2.3.2

Contributors

@azinchen, @dependabot

Full Changelog: 9.21-2...9.21-3

9.21-2

Bug-fix release: full-tunnel sessions no longer route the connection to the VPN server into its own tunnel — previously such a session came up, carried no data and died in a DPD reconnect loop. Upgrading is recommended for anyone running full-tunnel (the default, no SPLIT_TUNNEL).

📥 Pull this release

docker pull azinchen/openconnect-client:9.21-2
docker pull ghcr.io/azinchen/openconnect-client:9.21-2

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

No action required — no variables or defaults changed.

🐛 Fixes

• Full-tunnel routing loop. The half-default routes (0.0.0.0/1 + 128.0.0.0/1, and the IPv6 pair) are more specific than default, so they also captured openconnect's own CSTP/DTLS connection to the server: the tunnel came up but RX stayed at 0 and the session died on DPD timeout. The vpnc-script now pins the server's address as a host route via the real uplink before installing tunnel routes — with onlink, so it also works when the uplink subnet is published as a gatewayed route (e.g. a Docker network whose return route is installed via the gateway), and with a dev-only fallback for gateway-less point-to-point uplinks. A failed pin now logs a [vpnc] warning instead of failing silently. Split-include setups where the server fell outside the tunneled prefixes were unaffected. The Troubleshooting and Network Diagnostics wiki pages now show how to tell this apart from the look-alike path-MTU symptom (ip route get <server-ip>). (#9, #10)

🧩 Component versions

Component	Version
OpenConnect	9.21 (GnuTLS build)
Alpine Linux	3.24.1
s6-overlay	3.2.3.2

Contributors

@azinchen

Full Changelog: 9.21-1...9.21-2

9.21-1

Gateway configuration is now named consistently with the sibling nordvpn / nordvpn-wg images (FORWARD_FROM — action required for gateway-mode users, see below), and the container now clamps the MSS of its own control connection, fixing dead tunnels on reduced-MTU paths (VPS PMTUD black holes, PPPoE).

📥 Pull this release

docker pull azinchen/openconnect-client:9.21-1
docker pull ghcr.io/azinchen/openconnect-client:9.21-1

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

Gateway mode: GATEWAY_NETWORK / GATEWAY_NETWORK6 are renamed to FORWARD_FROM / FORWARD_FROM6 to match the sibling VPN-client images. The old names are removed with no fallback — update your compose files before upgrading, or the variables are silently ignored and the gateway falls back to its default (the container's own eth0 subnets). All other setups: no action required.

✨ Features

• Control-connection MSS clamp. The TCP session carrying the tunnel is now clamped to the path MTU automatically (a no-op on plain 1500 links), and a new MSS variable (e.g. MSS=1300) forces a hard cap in both directions for paths where PMTUD is broken — a VPS behind a black hole, PPPoE, tunnelled uplinks. Previously such a session would authenticate but carry no data and die on DPD timeout. Documented across the wiki (Configuration Reference, Troubleshooting, Security Model). (#8)
• FORWARD_FROM / FORWARD_FROM6 rename (see upgrade notes); gateway docs updated, including the previously undocumented GATEWAY_DNS=forward mode in the README. (#4)

📦 Package Updates

• Bump s6-overlay 3.2.3.0 → 3.2.3.2 (#3)
• Bump bind-tools 9.20.24-r0 → 9.20.26-r0 (#5)

🔧 CI/CD Updates

• Bump docker/login-action 4.4.0 → 4.5.1 (#7)
• Bump github/codeql-action 4.37.2 → 4.37.3 (#6)

🧩 Component versions

Component	Version
OpenConnect	9.21 (GnuTLS build)
Alpine Linux	3.24.1
s6-overlay	3.2.3.2

Contributors

@azinchen, @dependabot

Full Changelog: 9.21-0...9.21-1

9.21-0

Initial release of openconnect-client — an OpenConnect VPN client in a Docker container that routes other containers' traffic through an ocserv / Cisco AnyConnect-compatible server, with a dual-stack fail-closed kill switch. It is the companion client to ocserv-server.

📥 Pull this release

docker pull azinchen/openconnect-client:9.21-0
docker pull ghcr.io/azinchen/openconnect-client:9.21-0

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

First release — no action required.

✨ Highlights

• Fail-closed kill switch — a single dual-family nftables inet table drops both IPv4 and IPv6 by default; the firewall is installed before openconnect may start and is never removed on disconnect, so nothing leaves eth0 except the VPN endpoint and explicitly whitelisted local networks.
• openconnect built from source with GnuTLS — the only backend that speaks ocserv's PSK-NEGOTIATE DTLS (the distro's OpenSSL build cannot), so the UDP data channel actually establishes against ocserv; trimmed feature set for a ~30 % smaller image.
• Shared-netns forwarding — route any container through the tunnel with network_mode: service:vpn.
• Gateway mode — NAT gateway for other-netns containers and LAN hosts (macvlan/routed), with daemon-free DNS interception: GATEWAY_DNS=redirect (tunnel resolvers), local (co-located AdGuard/Pi-hole), forward (external resolver over eth0), or off.
• Full dual-stack IPv4 + IPv6 — connect over either family; tunnel, route, firewall and NAT both.
• Ordered failover — ;-separated URL list with automatic advance; camouflage secret carried in the URL and redacted in all logs.
• Supervised reconnect with exponential backoff, DNS re-resolution and atomic firewall updates on every reconnect; opt-in Docker health check.

Full documentation is in the project wiki.

🧩 Component versions

Component	Version
OpenConnect	9.21 (GnuTLS build)
Alpine Linux	3.24.1
s6-overlay	3.2.3.0

Contributors

@azinchen