Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to get a working environment connecting to a Cisco VPN using IPsec on a Mac running Mac OS X v10.5 (Leopard).

When I'm connected to the VPN, I can connect just fine to other machines in the network, and other machines can connect back to my Mac using the VPN-assigned IP address (for example, over SSH). However, the Mac itself cannot connect to that IP address. This is important for this environment because for certain development work I do I need a common IP address that can be reached from both my Mac and other machines in the network.

Using the Cisco-written VPN client, a successful connection is made, and all traffic is routed through the VPN (as required by the VPN itself). I've tried looking at routing tables, but the Cisco VPN client doesn't seem to actually change the routing tables. Also, ifconfig does not show the new IP address in any interface - but I can find it in the VPN client application. I'm not quite sure how it manages to route traffic without changing the routing tables, but perhaps that's besides the point.

I've also tried the Shrew VPN Client. I managed to build the source for 10.5 and get it running. It also connects fine, but it exhibits the same symptoms. This VPN client does change the routing tables and ifconfig shows the IP address under the tap0 interface. However, I'm still not able to get the routing tables set up correctly to be able to connect to the VPN-assigned local IP address.

Here's an example of the routing tables (with some unimportant stuff stripped out):

Not connected to VPN:

Destination        Gateway            Flags    Refs      Use  Netif Expire
default          UGSc       12       27    en0
127                UCS         0        0    lo0          UH         50    69556    lo0
192.168.1          link#4             UCS         8        0    en0        0:1f:90:5c:b2:e5   UHLW       10      744    en0   1188          UHS         1      768    lo0

Connected to the VPN (with IP address

    Destination        Gateway            Flags    Refs      Use  Netif Expire
default        UGSc       14       46   tap0
127                UCS         0        0    lo0          UH         49    68374    lo0
172.25.187/24      link#12            UC          2        0   tap0      82:1e:79:f7:7:6a   UHLW        6        0    lo0     ff:ff:ff:ff:ff:ff  UHLWb       3       23   tap0
192.168.1          link#4             UCS         8        0    en0          UHS         0      750    lo0

And important bits of ifconfig:

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1 
        inet netmask 0xff000000 
        inet6 ::1 prefixlen 128 
        inet6 fe80::225:4bff:fe9c:df3a%en0 prefixlen 64 scopeid 0x4 
        inet netmask 0xffffff00 broadcast
        ether 00:25:4b:9c:df:3a 
        media: autoselect (100baseTX <full-duplex,flow-control>) status: active
        supported media: none autoselect 10baseT/UTP <half-duplex> 10baseT/UTP <full-duplex> 10baseT/UTP <full-duplex,flow-control> 10baseT/UTP <full-duplex,hw-loopback> 100baseTX <half-duplex> 100baseTX <full-duplex> 100baseTX <full-duplex,flow-control> 100baseTX <full-duplex,hw-loopback> 1000baseT <full-duplex> 1000baseT <full-duplex,flow-control> 1000baseT <full-duplex,hw-loopback>
        lladdr 00:25:4b:ff:fe:9c:df:3a 
        media: autoselect <full-duplex> status: inactive
        supported media: autoselect <full-duplex>
        inet netmask 0xffffff00 broadcast
        ether 82:1e:79:f7:07:6a 
        open (pid 7916)

I tried various things with the routes, but nothing I've tried has gotten it to let me connect to from my Mac.

I've also tried messing with ipfw to forward all IP traffic sent to to, but I am not experienced with it so maybe I did that wrong.

How do I fix this problem?

share|improve this question
up vote 0 down vote accepted

I think you want a host route for gateway on lo0. You should be able to do something like this...

sudo route add -host

...but be sure to look at the route(8) man page, especially the parts about -interface and -ifscope.

I'm a little afraid, though, that messing with the route for will break your VPN connectivity, at least with the client that messes with your routing tables.

By the way, the Cisco VPN client loads an NKE (Network Kernel Extension -- a networking-specific Kernel EXTension or kext) or two that handle the VPN magic right in your kernel without messing with the route table. Unfortunately this means that Cisco has code running in your kernel, so if it's buggy, it can panic your entire system.

share|improve this answer
Thanks, especially for the info about Cisco using NKE's. I tried adding the route you suggested, and it appears as expected in the routing table, but my connection to the local vpn-assigned address still fails. I also tried sudo route add -host -interface tap0 and -interface lo0, neither of which worked either. The ifscope option seems to be new in snow leopard, and not available in leopard. – David Heitzman Jul 13 '11 at 13:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.