Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Tunnelblick for Mac, and I was wondering if it's possible to only limit VPN traffic to be routed for certain domains / or if there's a different way to limit it. It slows down the rest of my connections pretty bad, but I feel like it shouldn't just be an all or nothing solution.

share|improve this question

migrated from May 10 '11 at 15:19

This question came from our site for system and network administrators.

VPN connections are located at the IP or TCP layer of the network stack. Domains are located at the application level. In consequence a VPN client such as tunnelblick cannot limit the traffic based on domains, as that concept is meaningless at the network level where tunnelblick works.

In order to do this you would have to look into using proxies, which can inspect the packets at the application layer and then make decisions on how to handle them.

Generally a slowdown would indicate that too much traffic is flowing over the VPN connection. This can happen if the VPN server is configured to route all traffic through the VPN instead of just the networks that you connect to. If you can post your routing table here, while connected to the VPN, then I can tell you more.

share|improve this answer
lol wolfie how do I get you the routing table? not sure what the command is.. :) – MrMaksimize May 10 '11 at 16:42
A command to view your route table is netstat -r -n, the command to manipulate the table is route. – Zoredache May 10 '11 at 16:55

the limitation should be done as network routes, and your administrator should mention the subnets that should be routed via the VPN connection in the server's configuration.

You can always change your the routing table using the route command.

share|improve this answer

VPN access are amid at the IP or TCP band of the arrangement stack.

Domains are amid at the appliance level. In aftereffect a VPN applicant such as tunnelblick cannot absolute the cartage based on domains, as that concept is absurd at the arrangement akin area tunnelblick works.

In adjustment to do this you would accept to attending into appliance proxies, which can audit the packets at the appliance band and again accomplish decisions on how to handle them.

share|improve this answer

I don't believe there is a built-in mechanism in tunnelblick for doing this. You may be able to achieve some rate limiting using 'ipfw' using the destination networks to distinguish between VPNs or globally on VPN traffic. eg throttle bandwidth with ipfw

There is also an app called Speed Limit which may be of some use though I haven't used it for VPN traffic before.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .