Internet access fails on Fedora after disconnecting Cisco AnyConnect because the VPN client modifies the default routing table and does not always restore it correctly. The solution involves manually restoring the original gateway or using NetworkManager’s built-in split-tunneling features to prevent persistent route conflicts.
Understanding the Routing Table Conflict
When you connect to a Cisco AnyConnect VPN, the client typically adds specific routes for corporate networks and often changes your default gateway to point through the virtual adapter. This ensures all traffic flows through the secure tunnel. However, upon disconnection, the operating system should revert these settings. On Fedora, especially with newer versions of NetworkManager, this rollback process can fail due to race conditions or improper cleanup of the routing rules. The primary symptom is that packets intended for the public internet are either dropped or routed incorrectly because the system still believes the VPN interface is the primary path. You may also notice that local network resources become inaccessible if the VPN removed your local subnet routes. This behavior is distinct from DNS issues, where you can ping IP addresses but cannot resolve domain names. If you suspect a similar issue in other environments, such as WSL2, you might find relevant context in our guide on WSL2 unable to connect to IP address (not DNS) on Cisco Anyconnect VPN, although the underlying mechanism differs slightly between Linux and Windows subsystems. To diagnose this, open a terminal and runip route show. Look at the line starting with default. If it points to an IP address associated with your VPN interface (often named something like tun0 or anyconnect) rather than your physical network interface (like eth0 or wlan0), the rollback has failed.
Identifying Your Network Interfaces
Before making changes, identify your active physical interface. Use the commandip link show or nmcli device status. Physical interfaces usually have names like enp3s0, wlp2s0, or eth0. The VPN interface will be virtual. Do not assume the interface name is dco0 or any other specific identifier; always verify it dynamically.
Restoring the Default Gateway Manually
If the automatic restoration fails, you must manually correct the routing table. This requires knowing the IP address of your router or gateway on the local network. You can usually find this by checking your connection details in the NetworkManager applet or by runningip route show | grep default while connected to Wi-Fi or Ethernet without the VPN active.
Once you have the gateway IP, execute the following steps to reset the routing table. Replace <gateway_ip> with your actual router IP and <interface_name> with your physical interface.
sudo ip route del default
sudo ip route add default via dev 8.8.8.8. If the ping succeeds, the routing issue is resolved. Note that you may need to flush the DNS cache if you still experience resolution errors, which can be done by restarting the systemd-resolved service with sudo systemctl restart systemd-resolved.
Configuring Split Tunneling in NetworkManager
A more robust long-term solution is to configure NetworkManager to handle the VPN connection differently, preventing it from hijacking the default route entirely. This is known as split tunneling. Instead of sending all traffic through the VPN, only traffic destined for corporate subnets goes through the tunnel, while general internet traffic remains on your local network. To enable this, you need to edit the connection profile for your AnyConnect VPN. First, list your connections usingnmcli connection show. Identify the name of your VPN connection. Then, modify the IPv4 settings to disable "Use this network connection only for resources on its network" or ensure that the "Default Route" option is unchecked.
In the graphical NetworkManager applet, go to the VPN connection settings, navigate to the IPv4 tab, and look for the routing options. Ensure that "Automatic" is selected for the method, but uncheck the box labeled "Use this connection only for resources on its network." This forces NetworkManager to keep the local default route intact even when the VPN is active. When you disconnect, there is no conflicting route to remove, eliminating the post-disconnection internet outage.
Verifying the Configuration
After changing the settings, reconnect to the VPN. Runip route show again. You should see specific routes for your corporate network pointing to the VPN interface, but the default route should still point to your local gateway. This confirms that split tunneling is working correctly. If you encounter issues with internal resource access, refer to troubleshooting guides for specific protocols, though standard TCP/IP routing should remain stable. For users dealing with different VPN technologies like WireGuard, the principles of route management are similar, as seen in discussions about Troubleshooting WireGuard Client-to-Client Communication Issues.
Preventing Future Conflicts with Firewall Rules
Sometimes, firewall configurations persist even after the VPN disconnects. While generic firewall advice is rarely the root cause of routing failures, it is worth ensuring that your firewall is not blocking traffic on the loopback or virtual interfaces. On Fedora, firewalld is the default tool. You can check the status withsudo firewall-cmd --state.
If you suspect firewall interference, you can temporarily stop the firewall to test connectivity: sudo systemctl stop firewalld. If internet access returns, the issue lies within firewall zones or services. However, do not leave the firewall disabled. Instead, review the zones assigned to your network interfaces. Ensure that your primary interface is in the public or home zone, which allows established connections. Avoid adding custom rules that explicitly block or redirect traffic based on interface names unless absolutely necessary. Automating these fixes with cron jobs is bad practice because network states change dynamically; manual intervention or proper configuration of NetworkManager profiles is the correct approach.
Frequently Asked Questions
Why does my DNS work but I have no internet?
This indicates that your routing table is likely correct, but there is a deeper packet filtering issue. Check if your firewall is blocking outbound traffic on port 443 or 80. Also, verify that your DNS resolver is reachable by pinging its IP address directly.
How do I find my current default gateway?
Run the command ip route show | grep default in your terminal. The output will show the IP address of the gateway that handles your internet traffic. It is listed next to the word "via".
Can I use Netplan to fix this issue?
No, Netplan is primarily used for configuring network interfaces on Ubuntu Server and cloud instances. Fedora uses NetworkManager by default, so you should manage your VPN settings through NMCLI or the graphical applet instead.
What if the VPN interface disappears completely?
If the interface vanishes, the kernel module may have crashed. Restarting the NetworkManager service with sudo systemctl restart NetworkManager will reload the network stack and reinitialize all interfaces, including the VPN adapter.
Is it safe to delete the default route manually?
Yes, it is safe provided you immediately replace it with the correct local gateway. Deleting it without adding a new one will result in a complete loss of internet connectivity until a new default route is established.