Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm having trouble understanding how my VPN client works, and how to set up my routing tables to do what I would like.

Here is the output BEFORE connecting to my vpn

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.3.0     *               255.255.255.0   U     303    0        0 wlan0

AFTER connecting to my vpn

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         XXX.XXX.XXX.XXX  128.0.0.0       UG    1      0        0 ppp0
default         192.168.3.1     0.0.0.0         UG    303    0        0 wlan0
1.1.1.1         *               255.255.255.255 UH    0      0        0 ppp0
vpn.domain.tld  192.168.3.1     255.255.255.255 UGH   1      0        0 wlan0
128.0.0.0       XXX.XXX.XXX.XXX  128.0.0.0       UG    1      0        0 ppp0
192.168.3.1     192.168.3.121   255.255.255.255 UGH   1      0        0 wlan0

ifconfig reports

ppp0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST>  mtu 1379  metric 1
    inet XXX.XXX.XXX.XXX  netmask 255.255.255.255  destination 1.1.1.1
    ppp  txqueuelen 100  (Point-to-Point Protocol)
    RX packets 25  bytes 14115 (13.7 KiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 51  bytes 7076 (6.9 KiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

wlan0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500  metric 1
    inet 192.168.3.121  netmask 255.255.255.0  broadcast 192.168.3.255
    inet6 fe80::ca3a:35ff:fec1:9095  prefixlen 64  scopeid 0x20<link>
    ether c8:3a:35:c1:90:95  txqueuelen 1000  (Ethernet)
    RX packets 499060  bytes 549032226 (523.5 MiB)
    RX errors 0  dropped 0  overruns 0  frame 0
    TX packets 385300  bytes 77733269 (74.1 MiB)
    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

I'd like ONLY the traffic going to XXX.XXX.XXX.XXX (Class B IP) to go to the VPN. All other traffic, naturally go to wlan0.

Sorry if this is a duplicate. Any advice would be helpful.

Note: the XXX.XXX.XXX.XXX value is the same in each instance noted.

share|improve this question
    
Have you tried to change the routing table with the route or ip command? –  hfs Feb 13 '12 at 17:10
    
yes, the biggest problem is the vpn client resets the routing tables every 10 seconds (or shorter) –  emdog4 Feb 13 '12 at 21:05
    
On a Linux host I know exactly how I'd fix this: modify the system call so that once a knock sequence is given, the same knock sequence must continue to be given or the system call pretends to work, then modify the route command to give the same system call. Unfortunately I got to this page when looking for a solution for Windows. –  Joshua Feb 7 at 18:24

1 Answer 1

I found a nice little tutorial here:

http://www.gentoo.org/doc/en/vpnc-howto.xml#doc_chap7

I had the same issue that you did: I had two default routes. Unfortunately, I have a Juniper VPN that exits as soon as you mess with the default route.

But, the way I understand it, you can remove the default VPN route with this command:

 sudo route del default gw XXX.XXX.XXX.XXX

Then, you can add the specific subnet routing with this:

sudo route add -net XXX.XXX.XXX.XXX netmask 255.255.255.0 dev tun0

You may need to adjust your netmask to match the network you are going for. The "tun0" is the device of the VPN. You can use ifconfig to see which device your vpn added.

Just FYI, I believe this technique is called split tunneling. From what I understand, the vpn administrator can either allow or disallow the split tunneling. The Juniper VPN seems to do a good job of enforcing this decision, and I can't see a way to override it.

share|improve this answer
    
Thanks for this tip, I have tried this. Unfortunately for me as well, F5 vpn does a good job enforcing this "split tunneling" =( –  emdog4 May 13 '12 at 18:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.