Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My home PC has a VPN connection to my office. The office network is firewalled, with a secure zone on 192.168.0.* and a DMZ on 10.0.0.*

From outside, www.mycompany.com routes to a public IP - say 1.2.3.4. Our firewall NATs that to 10.0.0.4. From within the office LAN, we use DNS records on our domain controllers to resolve www.mycompany.com straight to 10.0.0.4, because we can't route to the public interface of our own firewall.

When I connect the VPN from home, I get a 192.168.0.* IP assigned via DHCP, but because I'm not using the VPN as my default gateway, I can't route to 10.0.0.* addresses unless I manually add a route.

I've created a persistent route to pass traffic for the 10.0.0.* subnet via the default gateway on the secure firewall zone:

route add -p 10.0.0.0 mask 255.255.255.0 192.168.0.1

Here's the problem. When I reboot, the route still appears in the routing table - fine. If I then connect the VPN, the route appears, but doesn't work - I can't route to anything on the 10.0.0.0 subnet. BUT, if I remove and then re-add the route AFTER the VPN is connected, it works fine.

I have no idea why this is the case. The before/after configuration is IDENTICAL - same IP, same route table - but if I create route then connect, it fails; if I connect the VPN and then create the route, it succeeds.

Looking for any tips as to how I can either stabilize the configuration, or automatically create the route when the VPN connects?

share|improve this question
add comment

1 Answer 1

up vote 5 down vote accepted

Honestly, there's a few bits as to why this wouldn't work properly. But lets skip that for now.

Rather than adding an arbitrary route to an IP address, try adding the route with the "interface" specified.

i.e. when connected to the VPN if you do a:

route print

and look for the "Interface" in the list, it should have a number assigned to the VPN interface.

 19...00 0e 2e 65 ca 61 ......Realtek RTL8139/810x Family Fast Ethernet NIC
 12...00 26 55 44 95 3c ......Broadcom NetXtreme Gigabit Ethernet
 28...00 00 00 00 00 00 ......MyVPN Interface Thingie
  1...........................Software Loopback Interface 1
 13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 11...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter

in my example... #28 is my vpn. So, when you add the route... do this:

route add -p 10.0.0.0 mask 255.255.255.0 192.168.0.1 if 28

What this should do for you is add the route... only when that interface is up. It will still sit in the "persistent routes" ... but won't actually be added to the routing table until that interface is up... and it gets removed again when the interface goes down.

share|improve this answer
    
Your solution works perfectly - thanks! - but I'd love to know what the "few bits" are - routing's one of those things I've always hacked until it works but never really looked at in depth - got a link to a relevant resource that'll explain what I'm doing wrong@? –  Dylan Beattie Apr 29 '11 at 18:23
    
In essence... the "few bits" relate to the way routes are chosen. As this route existed prior to the VPN being active, it automatically assumes that the interface it should use to connect to that subnet is another network interface. (probably your local LAN or WIFI connection) This won't change until you delete & re-add the route. By pre-defining what interface it should use, it won't try & add it until that interface is online. Just be glad you didn't get into metric-hell. (which is a whole other subject) –  TheCompWiz Apr 29 '11 at 19:15
    
What's "metric hell"? I have my persistent route set to have 3 as its metric, but it shows up as 28 in the routing table. –  Gabe Dec 6 '13 at 5:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.