VPN overrides default route

Question

Level 1

17 points

VPN overrides default route

I noticed my VPN connections overrides the default route set by my WiFi connection. With an active VPN I can browse my office network but not the WWW.

When I type in terminal …

sudo route delete default

sudo route add -net default 192.168.2.1

sudo route add -net 192.168.178.0 192.168.178.201

… I can access (via VPN) my office network and can still browse in the WWW.

Is there any way I can prevent to override the default route when establishing a VPN connection (IPSec Cisco via Network > Add VPN)?

Maybe I can create an AppleScript or something like that?

192.168.2.1 = local network (home)

192.168.178.1 = remote network (office)

192.168.178.201 = remote virtual client IP

iMac, Mac OS X (10.7.2), 27", i7, 256 SSD, 8GB, 1GB graphic

Posted on Mar 14, 2012 1:33 PM

Reply

Answer 1

Mar 14, 2012 2:06 PM in response to suntrop

Nothing you can do about it. You would need to talk to your network administrators and ask them why they don't allow web acces or split tunnelling.

Reply

Answer 2

suntrop Author

Level 1

17 points

Mar 14, 2012 2:09 PM in response to Templeton Peck

I am the administrator :-) Where do I activate split tunnelling? BTW … I don't want to use VPN for email, browser etc. Only to access via Finder my office files.

Reply

Answer 3

ke3z

Level 1

35 points

Mar 14, 2012 2:11 PM in response to suntrop

The Advanced button of the VPN config shows a screen with a checkbox for "Send all traffic over VPN connection". Is that unchecked?

Reply

Answer 4

suntrop Author

Level 1

17 points

Mar 14, 2012 2:16 PM in response to ke3z

I think this check box is only for L2TP IPSec not IPSec Cisco. The Advanced tab only has DNS and Proxy settings

Reply

Answer 5

Mar 14, 2012 2:16 PM in response to suntrop

Where do I activate split tunnelling

That would depend on what kind of VPN concentrator you guys use.

Reply

Answer 6

suntrop Author

Level 1

17 points

Mar 14, 2012 2:21 PM in response to Templeton Peck

That would depend on what kind of VPN concentrator you guys use.

… built in VPN via IPSec Cisco

Reply

Answer 7

Mar 14, 2012 2:24 PM in response to suntrop

No, I mean the VPN server at your office, not the client running on your Mac.

Reply

Answer 8

suntrop Author

Level 1

17 points

Mar 14, 2012 2:28 PM in response to Templeton Peck

Sorry. I am using a router by AVM

http://www.avm.de/en/service/manuals/FRITZBox/Manual_FRITZBox_Fon_WLAN_7270.pdf

(Page 161)

Reply

Answer 9

Apr 9, 2012 1:37 PM in response to suntrop

Are you any closer to a solution for this problem? I am currently struggling with this as well.

Reply

Answer 10

suntrop Author

Level 1

17 points

Apr 9, 2012 1:47 PM in response to Magnus8513

Google has more to offer than Apples discussion boards ;-)

http://phaq.phunsites.net/2011/12/29/vpninit-applescript-override-and-restore-de fault-vpn-routes-on-os-x/

Reply

Answer 11

Apr 9, 2012 2:06 PM in response to suntrop

suntrop wrote:

Google has more to offer than Apples discussion boards ;-)

http://phaq.phunsites.net/2011/12/29/vpninit-applescript-override-and-restore-de fault-vpn-routes-on-os-x/

Why would you even come here asking for help with a Friztbox anyway? You should have contact the maker of the router or your network admins for info on how to enable split tunneling.

Reply

Answer 12

Apr 9, 2012 2:22 PM in response to Templeton Peck

I would ask here, since all other (not apple) clients work with the identical config on the server side.

Reply

Answer 13

suntrop Author

Level 1

17 points

Apr 10, 2012 10:33 AM in response to Templeton Peck

Why would you even come here asking for help with a Friztbox anyway? You should have contact the maker of the router or your network admins for info on how to enable split tunneling.

I wasn't asking for help about my Fritzbox. I didn't know where to start and thought Apple's forums maybe a good starting point. You told me "Nothing you can do about it.". I found a solution I can do it without touching the Fritzbox config. I tought a forum is to help others not to tell them "there's no way" or go and ask the maker.

Anyway, next time I will not consider to ask here. Sorry for bothering you.

Reply

Answer 14

chethan

Level 1

0 points

May 21, 2013 2:05 PM in response to suntrop

@suntrop - this was very helpful. Was having the same problem with my University's VPN, and I agree completely, it's not a problem with the VPN hardware/software, it's a routing issue on the OS X side. No reason we should be locked to having all traffic run through the VPN.

Anyway, thanks for the helpful post and links!

Reply

Answer 15

suntrop Author

Level 1

17 points

May 22, 2013 1:19 AM in response to chethan

Thanks for feedback. Glad this topic still help others. On my latest OS X I think this issue is fixed by Apple.

Reply