Set linux routing tables to route F5 vpn and internet traffic

Question

I'm having trouble understanding how my VPN client works, and how to set up my routing tables to do what I would like.

Here is the output BEFORE connecting to my vpn

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.3.0     *               255.255.255.0   U     303    0        0 wlan0

AFTER connecting to my vpn

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         XXX.XXX.XXX.XXX  128.0.0.0       UG    1      0        0 ppp0
default         192.168.3.1     0.0.0.0         UG    303    0        0 wlan0
1.1.1.1         *               255.255.255.255 UH    0      0        0 ppp0
vpn.domain.tld  192.168.3.1     255.255.255.255 UGH   1      0        0 wlan0
128.0.0.0       XXX.XXX.XXX.XXX  128.0.0.0       UG    1      0        0 ppp0
192.168.3.1     192.168.3.121   255.255.255.255 UGH   1      0        0 wlan0

ifconfig reports

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1379  metric 1
    inet XXX.XXX.XXX.XXX  netmask 255.255.255.255  destination 1.1.1.1
    ppp  txqueuelen 100  (Point-to-Point Protocol)
    RX packets 25  bytes 14115 (13.7 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 51  bytes 7076 (6.9 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500  metric 1
    inet 192.168.3.121  netmask 255.255.255.0  broadcast 192.168.3.255
    inet6 fe80::ca3a:35ff:fec1:9095  prefixlen 64  scopeid 0x20<link>
    ether c8:3a:35:c1:90:95  txqueuelen 1000  (Ethernet)
    RX packets 499060  bytes 549032226 (523.5 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 385300  bytes 77733269 (74.1 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I'd like ONLY the traffic going to XXX.XXX.XXX.XXX (Class B IP) to go to the VPN. All other traffic, naturally go to wlan0.

Sorry if this is a duplicate. Any advice would be helpful.

Note: the XXX.XXX.XXX.XXX value is the same in each instance noted.

Answer 1

I found a nice little tutorial here:

http://www.gentoo.org/doc/en/vpnc-howto.xml#doc_chap7

I had the same issue that you did: I had two default routes. Unfortunately, I have a Juniper VPN that exits as soon as you mess with the default route.

But, the way I understand it, you can remove the default VPN route with this command:

 sudo route del default gw XXX.XXX.XXX.XXX

Then, you can add the specific subnet routing with this:

sudo route add -net XXX.XXX.XXX.XXX netmask 255.255.255.0 dev tun0

You may need to adjust your netmask to match the network you are going for. The "tun0" is the device of the VPN. You can use ifconfig to see which device your vpn added.

Just FYI, I believe this technique is called split tunneling. From what I understand, the vpn administrator can either allow or disallow the split tunneling. The Juniper VPN seems to do a good job of enforcing this decision, and I can't see a way to override it.