Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The target VPN server I want to connect to allows connections only from one IP address.

When I am at my office (the network public IP is trusted on the VPN server) everything is OK, but I figured that when I am at home I could do the following:

  1. Connect to office VPN (using built in windows VPN client)

    When I do it I have 2 active network interfaces:

    • home network
    • office network (VPN)
  2. Connect to target VPN (using custom VPN client)

    If the VPN server sees my office IP, it should let me in.

Unfortunately, I get rejected. The strange thing is, I made it work this way:

  1. I connect to VPN at my office
  2. I start a bridged virtual machine
  3. I connect to target VPN in the virtual machine

    and it works.

Probably, all virtual machine traffic is routed through the office VPN connection.

My question is, how can I make it work without the virtual machine?

system: Windows XP VPN client: Check Point VPN-1 Connection settings: IKE over TCP, Force UDP encapsulation

share|improve this question
What's the system (Windows 7 / Window Vista / GNU/Linux / FreeBSD ...)? What VPN (L2PT/IPSec, OpenVPN)? How started (by NetworkManager...)? – Maciej Piechotka Aug 9 '10 at 20:44
Probably only the traffic to the office's subnet is routed through VPN. Can you run a "tracert IP-of-target-VPN-Server" while connected to the office-vpn? – agporwfnz29 Sep 14 '10 at 11:23

Since you're using Windows XP, we'll work with Windows commands.

From the Command Prompt on your workstation, type route print - you should get something like this:

IPv4 Route Table
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...08 00 27 c3 52 ca ...... AMD PCNET Family PCI Ethernet Adapter
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
     20      1     20     20     20     20      1
Default Gateway:
Persistent Routes:

You can get additional documentation on the route command here:

What you can do is set a route for your connection to the VPN service. Let's say you are on the network, and you have a gateway on your office network at configured to access the VPN service on the network. You would use "route add" like this:

route ADD MASK

Your routing table should now reflect that change, and all traffic to the range will now be sent over to the office gateway.

The route add change will only persist across reboots if you add it with the -p flag:

route -p ADD MASK
share|improve this answer

It much depends on scripts on server & system etc. But the base of system would be something like: dev eth0  proto kernel  scope link
parent.vpn.server via dev eth0 dev ppp0  proto kernel  scope link
child.vpn.server via dev ppp1  proto kernel  scope link  


  • eth0 is local interface with address from network ( gateway)
  • ppp0 is point-to-point interface to parent (home) server and address from network ( gateway)
  • ppp1 is point-to-point interface to child (work) server and address from network ( gateway)

Please note that:

  • Network cannot overlap
  • Routing table may need to be set 'manually' (by script etc.). I've gave iproute2 format of sample routing table.
  • Interface names can vary.
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .