8

I am currently working abroad and use my company's VPN for FTP and some browsing. This is a relatively slow connection and while it is suitable for those VPN necessities; much of my other internet usage can be done without the VPN at a much higher speed.

Is there a way to tell Safari and my FTP software to use the VPN and for all other connections to go directly to the internet.

I am currently using OSX's Network Prefs for running my VPN connection.

Ta

4 Answers 4

6

I would consider the use of VirtualBox/VMWare Player to run a small machine for your VPN connection requirements so you can leave your main internet connection of your computer free of customizations.

In this way, both connections are completely separated and you don't have to configure or customize your routing tables or worry about complex network configurations.

1

It looks like you know what network IPs and domain you are connecting to.

A way of achieving this would be to only use the VPN based on which IP/domain you are requesting.

You can do this by using the macOS built-in VPN with "Send all traffic through VPN" unchecked, and define routes.

For instance, if your FTP server is at 1.2.3.4, this command will make sure that traffic to 1.2.3.4 will use the VPN to access the internet:

/sbin/route -n add -net 1.2.3.4/32 -interface ppp0

Note: you can list all existing route with netstat -rn.

And if you have dynamic IPs behind DNS, you can use dig to retrieve the IP and add it to routes. (10.11.12.13 is the IP address your got from the VPN).

dig -b 10.11.12.13 +noall +answer ftp.company.example

There is also a hooking mechanism that will look at /etc/ppp/ip-up and execute it, that helps automate the above process. This bash script can create routes and lookup IP addresses for you automatically.

That's a rough example to give an idea of what can be done:

#!/bin/bash

# change name to whatever your VPN is named in Pref system
vpn_name="Company vpn" 

read_args() {
  # Example: ppp0 0 10.239.163.212 192.0.2.1 192.168.2.1
  iface=$1; shift 3
  remote_ip=$1; shift
}

log() {
  echo "$@" >&2
  echo "$@" 2>/dev/null >> /tmp/vpn-split-tunnel.log
}

get_vpn_iface() {
  /usr/sbin/scutil --nc status "$vpn_name" | grep InterfaceName | awk '{ print $3 }'
}

lookup_ips() {
  if [ "$MAC_OS_MAJOR_VER" -ge 11 ]; then
    xargs dig -b $remote_ip +noall +answer | grep 'IN\s\s*A' | awk '{ print $NF "/32" }'
  else
    xargs dig +noall +answer | grep 'IN\s\s*A' | awk '{ print $NF "/32" }'
  fi
}

init() {
  echo "" 2>/dev/null > /tmp/vpn-split-tunnel.log
  read_args "$@"
  vpn_iface=$(get_vpn_iface)

  if [[ "$iface" != "$vpn_iface" && -z "$DEBUG" ]]; then
    log "Interface $iface is not for the \"$vpn_name\" connection on interface $vpn_iface"
    exit
  fi
}

init "$@"

cmd=(/sbin/route -n add -net "1.2.3.4/32" -interface "$iface")
log ">> ${cmd[@]}" 
log $(${cmd[@]} 2>&1)
0

In the Advanced section of the VPN settings there is a setting that accomplishes what you want, with some possible caveats. It does what's described in another answer here, in that it sends internet traffic via your normal default gateway, and just adds a route to the VPN subnet to your routing table.

There may be some very specialized software to try to route based on application, but most routing is done by IP address, in other words, not 'Safari and FTP' but where you point Safari and your FTP client.

Here is the screen I'm talking about: VPN Options

I'm guessing if you go to system preferences, Network, choose your VPN connection, and press the Advanced button, you'll see that all your traffic is being sent over the VPN.

2
  • The OP will need to find out what his vpn gateway is, and what his company network (subnet) is. Then he will need to reset his default gateway to his local router, then set a static gateway for his VPN connection through his vpn adapter for his company network.
    – David
    Nov 3, 2013 at 1:17
  • That is the purpose of that checkbox, that's what it's for.
    – atroon
    Nov 8, 2013 at 21:00
0

This isn't exactly what you are looking for, but you can bypass the VPN's gateway so that anything outside the subnet will not use the VPN: How can I make the Windows VPN route selective traffic (by destination network)?.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .