Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have two network cards. If I connect to a network using VPN then to access other websites I have to pass through a proxy server.

Is it possible to use my other network card to connect to the Internet directly without passing through the proxy?

share|improve this question
1  
I guess by connection to the internet you mean websites in particular. In that case you would need firewall that can route packets based on port/protocol or zones. Its easy to do with linux unfortunately i cant help with windows but i think its worth to take a look at the windows firewall of windows 7 as it supports zone based configuration for each interface. Maybe some windows expert will explain that :) –  matthias krull Jul 30 '10 at 13:51
    
thanks i will try this –  Rohit Banga Jul 31 '10 at 10:49

2 Answers 2

What you are asking is called "Split DNS" or "Split Tunneling". The VPN appliance must support this OR you can manually enter the IP address and hostname information into your hosts file.

From How to set up a split-tunnel VPN in Windows Vista:

You also asked about split tunneling, so let's take a moment to explain that concept before walking through the process of creating a VPN connection. By default, when you create a VPN connection, Windows funnels all of the communications from your computer through the VPN. So, if you're logged into a corporate VPN from home to check your email, all of the other Web surfing you're doing on your computer is also being run through your corporate network. This is the default behavior because, from the company's point of view, it's the safest way and ensures all traffic is protected regardless of the destination.

You might not want this behavior, however, for a couple of reasons. First, it allows your company to inspect all of your personal Web traffic while connected to the VPN. Second, it will likely slow down your access to the Web, as everything must first be sent through the VPN.

Split tunneling, on the other hand, configures the VPN connection so that only traffic headed to computers on the corporate network is sent through the VPN connection. Other traffic leaving your computer goes out through your normal network connection.

Follow these steps to set up a VPN connection in Windows Vista that uses split tunneling:

  1. From the Control Panel, choose "Network & Internet."
  2. Click "View Network Status and Tasks."
  3. Click "Manage Network Connections."
  4. Right-click on your VPN connection and select "Properties."
  5. Select the "Networking" tab.
  6. Highlight "Internet Protocol Version 4 (TCP/IP v4)."
  7. Click "Properties."
  8. Click "Advanced."
  9. Uncheck the "Use default gateway on remote network" box.
  10. Click "OK" three times to close the windows you opened.

From that point forward, only traffic destined for your corporate network will be sent through the VPN. All other traffic will use the local network.

EDIT1

The information that the Cisco VPN client is used wasn't in the original post, and it basically changes everything and much complicates any final solution.

The biggest problem is that the VPN server must have been configured to allow split tunneling. Otherwise, it just sandbags you in your computer.

Second, you can attempt to configure according to the Cisco article Configuring Cisco VPN Client 3.5 and the Cisco Integrated Client to Secure Nonencrypted Traffic While Using Split Tunneling.

However, I can recommend from my experience one solution that solves the problem without any additional configuration. This solution is simply to install and call the Cisco VPN client from a virtual machine. Even if the Cisco client then attempts to sandbag you in, it will only sandbag the virtual machine, rather than your computer. Your own computer stays free and able to use the Internet, while the VPN is used from the virtual machine.

EDIT2

The Cisco VPN client creates a tunnel, which can be voluntary or compulsory. The type of the tunnel is dictated by the administrator of the VPN server to which you connect. The compulsory tunnel will cut off all access to any external computer, including the LAN, and is what I called the "sandbox".

For more information, see Compulsory Tunneling in the following articles.

If you wish to become an expert in everything VPN, a good book is most recommended, since there is just too much information.

share|improve this answer
    
i am using cisco vpn client to connect. It was pre-configured. I can see the host name, user name for the connection. but the password is not visible. If I connect using the client I need to specify my own user name and password also. –  Rohit Banga Jul 25 '10 at 10:21
    
there is no option "Use default gateway on remote network" in the Cisco VPN adapter that I am using. However there is a list in which the default gateway to the network has been specified with a metric of 1. Can I use this in some way? –  Rohit Banga Jul 25 '10 at 12:01
1  
@iamrohitbanga: See my edit. –  harrymc Jul 25 '10 at 13:01
    
yes that should work ... but for the sake of curiosity is it possible to implement Patkos's solution. I want to change the routing table entries systematically to achieve this. Another thing that I have in mind is that if I install a proxy server on my pc, then can I not direct all traffic from a particular browser through the server. –  Rohit Banga Jul 25 '10 at 13:33
    
@iamrohitbanga: If there is no option "Use default gateway on remote network", then probably this site places you in the sandbox, so you can't have both connections on the same computer. –  harrymc Jul 25 '10 at 15:06

Yes, it can be done, but depending on your current configuration the answer may vary. So I need some extra information:

  1. Your operating system
  2. The output of the command route -n (if you are on Linux) or route print (if you are on Windows) both before and after you connect to the VPN, and when you are connected to the Internet over your second network card
  3. If you are not connected to the VPN, can you use that line to navigate on the Internet?
  4. Also, please give the output of ifconfig (Linux) or ipconfig /all (Windows).

Thanks.

share|improve this answer
    
I am working on Windows 7. I can connect to the internet when not connected through VPN. After connecting through VPN, I have to route my requests through a proxy to connect to external sites. I was thinking of running a proxy server on my PC which routes packets through the other Internet card. Is there a better solution? How can the output of route command help in finding a solution. Could you please point me to some documentation? –  Rohit Banga Jul 23 '10 at 5:04
1  
All of your communications are made based on the routing table of your system. Most probably, when you connect to the VPN, the VPN server, through your VPN client, injects a new rule with a default gateway from your VPN network. The result is that all your communication will go through the VPN (which is by the way just another network interface). Now, if you know what IP classes/addresses are you accessing over the VPN, you can simply remove default gateway from route, add your usual Internet gateway as default and add another route for VPN communication. It's all about 3-4 commands. –  Patkos Csaba Jul 23 '10 at 7:03
    
Ah ... I forgot ... here is the MS documentation for route: microsoft.com/resources/documentation/windows/xp/all/proddocs/… –  Patkos Csaba Jul 23 '10 at 7:04
    
the gateway is changed for a lot of routing table entries –  Rohit Banga Jul 23 '10 at 17:32
    
I see an entry that makes a NAT address on the network a gateway for destination 0.0.0.0 with metric 21. The addresses on the network use 10.x NAT range. Can I drop this rule and state that all 10.x traffic be routed through this gateway and rest through my other interface. what commands should i use? –  Rohit Banga Jul 23 '10 at 17:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.