Get connected to the cross-border network in three minutes

Search the App Store for "Cisco Secure Client" and install it (available in China).

Open Cisco → Settings → "External Control" → set it to "Enabled". Skip this and the one-tap certificate import silently fails! One-time setup.

Register with your email (you'll automatically get 24 hours free), then sign in here.

Open the "Connection Info" page and, as prompted, first create a new connection in Secure Client; when iOS asks to allow the configuration, approve it and enter your device passcode (not your account password).

Back on "Connection Info", tap "One-tap import" to finish the import (nothing happens? External Control is probably off); keep the connection Certificate on Automatic or pick the one you imported.

Flip the switch in Secure Client. If the first attempt fails, that is normal — tap it once more and it connects password-free; an "Untrusted Server" prompt is expected, just tap Continue.

Download "Cisco Secure Client" from the Connection Info page / Download Center (Google Play is often unreachable in mainland China — use our download). If Android warns about "unknown sources", allow this source. For permanent password-free use, or if Cisco will not install, switch to OpenConnect on the same page.

Open Cisco → menu / Settings → "External Control" → set it to "Enabled". It is off by default, and without it tapping a line on the website does nothing at all — the number-one Android pitfall. One-time setup.

Register with your email (24 hours free) and sign in here.

Back on the "Connection Info" page, just tap the line you want → Cisco launches with your username and password filled in automatically; approve the first-time connection prompt and you are online (Android always uses Global).

On Chinese-brand phones, exempt Cisco from battery optimization / allow background running; on Samsung turn off "Smart network switch" — otherwise it drops once the screen is off.

Do you still have another acceleration app running? Quit it completely (not just "disconnect" — close it from the background). Android allows only one such app at a time, and it hijacks name resolution so the connection fails instantly.

From the Connection Info page / Download Center get AnyLink (account & password, fastest to set up) or Cisco Secure Client (certificate, password-free); OpenConnect-GUI is also available.

Sign in here, open "Connection Info", pick Global / PAC, and copy both the server address and the Secret.

In AnyLink fill in, in order: Host (server address), Secret, Username (email) and Password (connection password). ⚠️ The Secret is required — leave it out and the connection fails; this is the number-one desktop pitfall.

Click connect. AnyLink remembers the password, so later reconnects are one click.

Use Cisco Secure Client instead: on "Connection Info" expand "Advanced · certificate" and download the .p12 → double-click to import (store location "Current User", certificate store "Personal"; just press Enter at the password prompt) → paste the certificate address into Cisco (it is not the same as the server address) and connect without a password.

From the Connection Info page / Download Center get AnyLink (account & password, Apple Silicon only) or Cisco Secure Client (certificate, password-free, works on both Intel and Apple Silicon); an OpenConnect GUI (Apple Silicon only) is also available.

Sign in, open "Connection Info", pick Global / PAC, and copy both the server address and the Secret.

In AnyLink fill in, in order: Host (server address), Secret, Username (email) and Password (connection password). ⚠️ The Secret is required — leave it out and the connection fails.

Use Cisco Secure Client: on "Connection Info" expand "Advanced · certificate", download the .p12 → double-click to import it into the login keychain (just press Enter at the password prompt) → paste the certificate address into Cisco. The openconnect CLI also works.

openconnect ships in the official repositories of every mainstream distribution — pick the line for your system:On RHEL / Rocky / AlmaLinux enable EPEL first. Run openconnect --version to confirm.

Sign in and open "Connection Info". Note four things: Username (your registered email), Connection password (not your website login password), Secret, and the server address of the line you want (it looks like somestring.domain:port). The Global / PAC choice is stored on your account — after switching, disconnect and reconnect once for it to take effect.

The command line needs the full address including the suffix: append the Secret to the server address to form https://SERVER-ADDRESS/?SECRET. ⚠️ Leave the suffix off and the server refuses the request outright, which simply looks like "cannot connect". Shortcut: on "Connection Info" expand "Advanced · certificate" — the certificate address there already carries the suffix. Replace the two placeholders below with your own values:Enter your connection password when prompted. ⚠️ Wrap the whole address in quotes — the ? is a shell wildcard, and without quotes zsh fails with no matches found before the command even runs.

In the foreground press Ctrl + C to disconnect. ⚠️ Never use kill -9 — only a clean exit restores your routing and name-resolution settings.
To run it in the background:Note this leaves the password in your shell history; use read -s into a variable if that matters to you.

On "Connection Info" expand "Advanced · certificate" → download the .p12 → run:Normally you will not be asked for a passphrase. If you do see Enter PKCS#12 pass phrase:, just press Enter (the passphrase is empty) — both behaviours are normal. The download link is valid for 30 minutes; the certificate itself also expires, after which you download a fresh one from the same page.

① Refused immediately by the server → the /?SECRET suffix is missing or was copied wrong;
② Terminal says no matches found or the address is mangled → you forgot the quotes;
③ Permission error / cannot create the network device → add sudo;
④ Shows connected but nothing loads → some minimal systems lack the companion network-configuration script; installing from your distribution's official repository normally includes it;
⑤ Want a different line → swap in another address from "Connection Info"; everything else stays the same.

OpenWrt officially recommends 16MB storage / 128MB RAM or better; 16/64 is the absolute minimum, and 4/32 devices lost support long ago — RAM is the harder limit. SSH into the router and run:24.10 and earlier use opkg, 25.12 and later use apk. The two command sets are not interchangeable.

Pick the set that matches the previous step:ca-bundle is the system root-certificate store; most firmware already includes it, and without it you get "cannot verify server certificate". ⚠️ Do not use apk upgrade to bulk-upgrade packages — OpenWrt explicitly warns this can brick the device because of incomplete dependency data.

Run these one by one (the interface is named occ; replace the placeholders with values from "Connection Info"):⚠️ Two things you must not skip: ① the address must start with https:// and keep the trailing /?SECRET — miss either half and it will not connect; ② the interface 'wan' line is required — it pins a dedicated route to the server itself over your broadband port, without which a single drop leaves you unable to reconnect.
You can also use LuCI (install luci-proto-openconnect, then service rpcd restart), but that form has no field for line ⑥, so you would return to the command line anyway.

Add the interface to the existing wan zone (it already enables outbound address translation and MSS clamping, both prerequisites for LAN devices):⚠️ Classic symptom of skipping this: the router itself is online, but every phone and laptop on the LAN is dead. If you insist on a separate zone you must add masq='1', mtu_fix='1' and a lan→zone forwarding rule — all three (mtu_fix is the one that fixes "small pages load, large files and image-heavy sites stall").

Nothing to configure for name resolution: once connected, the resolver addresses pushed by the line are written into the system automatically and picked up by the router. Apply the configuration:The interface starts automatically at boot; a firmware upgrade preserves the configuration.

Four commands cover most cases:The three most common problems: ① the log shows the server refusing you → the address is missing the https:// prefix or the trailing /?SECRET; ② "cannot verify server certificate" → install ca-bundle, and make sure you have not entered any server-certificate fingerprint (that disables the system trust chain, and since our certificate is renewed automatically, a pinned fingerprint breaks on renewal day); ③ unstable line or large transfers stalling → force plain TCP: uci set network.occ.no_dtls='1'; uci commit network; ifup occ.