Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I log into a slow VPN with only a 15k/s connection, when I try to go to or some other site to download something, is everything getting routed through that other network? (so my max speed for all downloads is 15k/s?) Or are only the DNS requests getting routed and I can still get my normal download speeds I would have been able to before logging into the router?

share|improve this question
up vote 15 down vote accepted

It depends on the vpn configuration. To check how it is in your case check your default gateway:

Windows (in command prompt):

route print

Linux (in console)

netstat -nr

Look for network destination (win) or default (linux). If it set to your local subnet gateway - not entire traffic is going through vpn. Any other case - all traffic through vpn.

share|improve this answer
netstat -nr seems to work for OS X too. – RelaXNow Oct 10 '11 at 18:54

On Windows, the default configuration is to send all traffic down the VPN connection (the tunnel), even if it is destined for sites external to the private network. Opening a VPN session without sending all traffic through the VPN tunnel is called "split tunneling" and while possible, carries security risks. With split tunneling, the remote machine is simultaneously connected directly to the Internet and to the private network, so any security breach in the remote machine is a security breach in the private network. IOW, a compromised remote machine provides a path into the private network that bypasses the private network's firewall. This doesn't happen when all traffic from the remote machine is sent via the VPN tunnel.

share|improve this answer
This threat possibility is true of any OS, not just Windows. For clarity. – JoelAZ Oct 25 '14 at 6:03

If your using Windows Networking to connect to VPN, go to the connection properties, select the networking tab, select TCP/IP properties, click Advanced, un-check "Use default gateway on remote network" to stop all network trafic (that doesn't involve to remote network, i.e. web browsing) from going through the VPN.

share|improve this answer

I use corporate Aventail VPN, with same "trouble".

All network traffic/control goes true several network Filter drivers, like in my case "Packet Scheduler Miniport", "Odyssey Network Agent Miniport", "McAfee NDIS Filter Miniport", etc. And to addition there is an "Aventail VPN Filter" driver under hidden devices in Non-Plug and Play drivers section, could be found in Device Manager.

Seems to me Aventail VPN Filter's aim is to sniff all network traffic and forward trough the VPN tunnel/connection/interface.

Just disable it, than you will get back the control on route table. At last you can add default gateway to your home network, and a persistant route to the corporate network.

Wikipedia about Filter Driver: Filter drivers are optional drivers that add value to or modify the behavior of a device and may be non-device drivers. A filter driver can also service one or more devices. Upper level filter drivers sit above the primary driver for the device (the function driver), while lower level filter drivers sit below the function driver and above the bus driver.

share|improve this answer

It depends on the VPN, your operating system, the client, etc. For instance, a SonicWall VPN will only route data for which it is set up for.

Your operating system routes also need to be set up for the routes to work. If you provide your VPN software, we might be able to assist more.

share|improve this answer

Here is my script for dialling HyperRas/Aventail and setting back default gateway to the original local network.

@echo off
::Your VPN network parameters
set _vpnnetwork=
set _vpnmask=

::GET Current Default Gateway IP
for /f "tokens=3" %%G IN ('route print^| find "Default Gateway"') DO (set _originalgw=%%G)

ngdial HyperRas -gui -prompt -status -icon

::Wait for Hyperras background config / sleep emulation for about 10 sec
:: reserved for Network Interconnect Device Benchmark Testing [RFC5735]
ping -w 10000 -n 1

::GET New RAS Default Gateway IP
for /f "tokens=3" %%G IN ('route print^| find "Default Gateway"') DO (set _rasgw=%%G)

::Set RAS route to corporate network
route add %_vpnnetwork% mask %_vpnmask% %_rasgw%

::Set Default Gateway to original
route add mask %_originalgw%
share|improve this answer
This doesn't answer the question. – KronoS Nov 4 '12 at 19:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.