9.21-2

Bug-fix release: full-tunnel sessions no longer route the connection to the VPN server into its own tunnel — previously such a session came up, carried no data and died in a DPD reconnect loop. Upgrading is recommended for anyone running full-tunnel (the default, no SPLIT_TUNNEL).

📥 Pull this release

docker pull azinchen/openconnect-client:9.21-2
docker pull ghcr.io/azinchen/openconnect-client:9.21-2

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

No action required — no variables or defaults changed.

🐛 Fixes

• Full-tunnel routing loop. The half-default routes (0.0.0.0/1 + 128.0.0.0/1, and the IPv6 pair) are more specific than default, so they also captured openconnect's own CSTP/DTLS connection to the server: the tunnel came up but RX stayed at 0 and the session died on DPD timeout. The vpnc-script now pins the server's address as a host route via the real uplink before installing tunnel routes — with onlink, so it also works when the uplink subnet is published as a gatewayed route (e.g. a Docker network whose return route is installed via the gateway), and with a dev-only fallback for gateway-less point-to-point uplinks. A failed pin now logs a [vpnc] warning instead of failing silently. Split-include setups where the server fell outside the tunneled prefixes were unaffected. The Troubleshooting and Network Diagnostics wiki pages now show how to tell this apart from the look-alike path-MTU symptom (ip route get <server-ip>). (#9, #10)

🧩 Component versions

Component	Version
OpenConnect	9.21 (GnuTLS build)
Alpine Linux	3.24.1
s6-overlay	3.2.3.2

Contributors

@azinchen

Full Changelog: 9.21-1...9.21-2