Update: I now need a solution to this problem ASAP. I sort of understand that I could probably set something up in iptables for NAT and port forwarding but I really don't know enough about the tool or its syntax to come up with my own rules.

  • I have a machine with a static IP on my local network: (A Hyper-V VM running Debian 10)
  • The machine runs Cisco AnyConnect to connect to my work VPN.
    This VPN client sets up a 2nd network interface so that I have two:
    eth0 (my LAN), and cscotun0
  • I want to be able to put into the RDP client on my personal desktop and have it connect through the VM to the remote desktop at my work.

The only question I really need answered:

How can I route TCP & UDP connections on port 3389 from my personal desktop, though the VM, to the remote system at work?

I'm guessing that the VM needs to "masquerade" the RDP connection as if were coming from the VPN client which gets a dynamic IP on the work network, so I know that I need NAT. Is the masquerade tool also necessary for that?

Original Question:

I need to use RDP over a Cisco AnyConnect full-tunnel VPN for work from home.

The IT department at my work hasn't configured the VPN server to support split-tunnel for just RDP, and I may find myself needing other network services at work anyways so I would like to work around using a full-tunnel connection. However, I don't want to use AnyConnect VPN client on my personal computer since I am under the impression that would route all of my internet traffic through the VPN as well.

I have set up a Debian 10 virtual machine that is running the VPN client. I want to have this VM masquerade as the remote RDP server on my LAN. That way I could avoid running the VPN client on my personal computer and just connect with the RDP client to the VM, which then forwards the RDP connection over the VPN to the actual RDP server.

So, how can I accomplish this?

I only have administrative access to:

  • My Windows 10 desktop at home.
  • My "proxy" VM
  • My home router
  • My Windows 10 desktop at work. (Although IT can block/undo any changes I make if they are a security risk)

I am currently using a combination of VNC and RDP to hop through the VM for remote desktop, but it is limited in resolution by the VM hypervisor and combining the disadvantages of both protocols.

  • Does your "proxy" VM use Cisco AnyConnect or does it use OpenConnect?
    – user1686
    Mar 7, 2020 at 18:42
  • @user1686, I have a shell script called anyconnect-linux64-4.6.01103-core-vpn-webdeploy-k9.sh that my work provides to set up Cisco AnyConnect on linux. 100% certain the client is "AnyConnect".
    – Romen
    Mar 7, 2020 at 18:44

1 Answer 1


If your VM has access to both networks (your local network and the corporate network via VPN), then use socat to establish a bidirectional "tunnel" between your VM and the corporate RDP server:

socat tcp4-listen:3389,reuseaddr tcp:remote-addr:3389

This will open port 3389 on your VM and any traffic that arrives there will be tunneled to the remote-addr:3389.

Socat also supports UDP.

Socat exits after connection is terminated, so to make sure it is always there, make a script that runs this command in an endless loop:


while true
    socat tcp4-listen:3389,reuseaddr tcp:remote-addr:3389

In this way you can specify as an RDP server on your personal desktop and the traffic will be tunneled to the corporate server.

  • And with such a simple one-liner I'm up and running. Thank you so much!
    – Romen
    Mar 16, 2020 at 18:08
  • And you've probably circumvented any security policy your company has set up.
    – Marki
    Mar 20, 2020 at 14:04
  • The quality of this connection is low, since there is no UDP. I tried UDP connection but UDP process is killed, I randomly tried ignoreeof as well fork neither worked
    – Mohit
    Mar 4, 2022 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.