How can I make the Windows VPN route selective traffic (by destination network)?

Question

I want to use a Windows VPN but only for a particular network, so that it doesn't take over my entire network connection.

e.g., Instead of the VPN becoming the default route, make it only the route for 192.168.123.0/24

(I can see that there is a solution for this for Ubuntu in this question, but sometimes I have to do this on Windows too)

Can this be automated so that whenever I connect to the VPN it does this?

Answer 1

You can turn off taking over your entire connection by going to the properties of the VPN, Networking tab, "Internet Protocol (TCP/IP)" properties, Advanced, untick "Use default gateway on remote network". This may or may not leave a route to 192.168.123.0/24 depending on the VPN server's setup. If it doesn't, you'll have to manually add the route each time, although you could put it in a batch file.

In order to manually add the route, run (as administrator):

route -p add 192.168.0.12 mask 255.255.255.255 10.100.100.254

This example will make a persistent (it's not necessary to run the command after a reboot) route to the IP 192.168.0.12 through the VPN gateway 10.100.100.254.

More about this at http://technet.microsoft.com/en-us/library/bb878117.aspx

Answer 2

I successfully used @TRS-80's technique to achieve this.

I work from home and have to VPN onto the corporate network for my email (I hate webmail!!).

At the same time, I need to be constantly surfing for info and also need youtube for my background music... Now you definitely don't want to stream youtube off a VPN since that makes it sound like a Robot Singing!!! :)

All I did was follow @TRS-80:

properties of the VPN, Networking tab, "Internet Protocol (TCP/IP)" properties, Advanced, untick "Use default gateway on remote network"

and then did my own:

under DNS tab, tick "register this connections addresses in DNS"

All works seamlessly!

Answer 3

Granted this answer does not reflect your request but i use a VM specifically for this purpose. That way only the network inside the VM is restricted by the routes.

You may find some better answers by other people but at least this may give you something to consider as it an easy solution after the VM has been created.

Answer 4

A little old but I found a way to do this using another machine. I have a laptop where I set up the VPN connection and on there I have FreeProxy set up with Socks5..

Then I set up firefox on my client machine to use the laptop's proxy server.. the result is that if I use FireFox or anything that's set up to use that Socks5 proxy, it will use the VPN, otherwise it uses standard routing..

Answer 5

Anyway, this is not possible under Windows. Or at least there is no easy way: I went through three pages of results searching for 'vpn "only some traffic"'. Using Windows, you just have to get another machine where you can run the VPN on. Or a virtual one...

It seems strange that something as easily explainable as this is so difficult to achieve. How difficult could it be to just route traffic from one program to the VPN interface and all the other programs to the default NIC interface? Why would we need to set up a whole virtual machine for that? And with Linux it's possible but its solution is not very elegant either.

It's very much sought after too: I came across dozens of threads on the same subject. So I only hope someone realises the ludicrousness of this and do something about it. (In Windows 8!)

Answer 6

If you use the CMAK and setup a routing file that the client can download... windows will download the routing file & adjust routes as appropriate. There are options to remove the default route... and add various static routes & such. This is known as a split-tunnel btw.

There is a good how-to here: http://blogs.technet.com/b/rrasblog/archive/2007/06/11/split-tunnelling-using-cmak.aspx

Answer 7

if you have both IPV4 and IPV6 you have to uncheck the "Use default gateway on remote network" in both places, even if you only use IPV4

Answer 8

You can use something like netcatcher - just add all the routes you need one time and forget it. It will automatically add and delete routes when you connect or disconnect your VPN session. If your VPN IP address is dynamically obtained (DHCP) netcatcher will catch it and update the routes right way.

Answer 9

from russian forum: http://forum.ixbt.com/topic.cgi?id=14:43549

save as file (ex: vpn_route.vbs) and after vpn connected execute command

cscript vpn_route.vbs

vpn_route.vbs:

strComputer = "."
strMACAddress = "MAC of VPN interface here (example 00:45:55:00:00:00)"
strTarget = "route target here (example 192.168.123.0)"
strMask = "mask here (example 255.255.255.0)"
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colItems = objWMIService.ExecQuery _
    ("Select * From Win32_NetworkAdapterConfiguration Where MACAddress = '" & strMACAddress & "'")
For Each objItem in colItems
strIP = objItem.IPAddress(0)
Next
Set objShell = CreateObject("WScript.Shell")
objShell.Run "route add " & strTarget & " mask " & strMask & " " & strIP

Answer 10

Didn't find here free solution for my needs. And I have written it by myself.

If you want to work with some VPN servers with dynamic client and server IP, you can try free tool http://www.latestbit.com/winvpnhelper