VPN connection does not change the default routing on clients

Question

Level 1

0 points

VPN connection does not change the default routing on clients

I run Mac OS X server 10.5.7 with VPN configured for L2TP
MacBook Pro client can connect to VPN without any problems, but the client traffic is not redirected via the vpn after the client is connected to the VPN.

I run netstat -r on the client before the vpn connection and after the vpn connecton.
the default route stays the same.
The client routing table is not modified in any way but the VPN connection.

I tried adding Network Routing Definition but they have not effects since the default gateway stays the same all the time and is never changed to the vpn tunnel.

the Apple VPN doc says"
Important Notes About VPN Routing Definitions
Â If no routing definitions are added, traffic is routed through the VPN connection by
default.
Â If routing definitions are added, the VPN connection is no longer set as the default
route, and traffic destined for addresses not specifically declared as a private route
will not go over the VPN connection.
Â DNS lookups go over the VPN connection regardless of the routes that are set.
Â Definitions are unordered. They only apply the description that most closely matches
the packet being routed.
"
But it is not working.
The traffic does not get routed through the VPN connection by default.

So the result is that the clients connects to the vpn without any problems but the vpn is useless since the client routing ins unchanged after the vpn connection is estabished ?

What should i do to fix this issue ?

MacBook Pro / Mac Pro, Mac OS X (10.5.7)

Posted on Jul 24, 2009 8:10 AM

Reply

Answer 1

Aug 1, 2009 3:04 AM in response to ecolombel

In Network config on each client you can alter the service order for "interfaces" and drag the VPN "interface" (PPTP and/or L2TP) above AirPort and Ethernet interfaces.

That way the VPN connection is the default when up.

The routing definitions in the server VPN settings is used but the OS X VPN client can be set to override the setting of the default beeing through the VPN.

If using no routing definitions is equal to having it set to private 0.0.0.0/0.0.0.0 (default route through the VPN).

I think most people want a split tunnel setup where the default is straight out through their local gw/router and only traffic for the remote LAN is sent through the VPN tunnel.

Also, having or beeing part of the same LAN IP-range on each/both sides will mean trouble. So people using (especially if using VPN) 192.168.0.0/24 or 192.168.1.0/24 on the server side LAN is in my opinion lazy.

The DNS you add to the routing definitions must be reachable through the VPN
As OS X server needs a working DNS for many services choosing the server (or other "local" to the server LAN DNS) is the best choice.

Reply