Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Or my expectations are wrong.

I expect that checking the "Send all traffic over VPN connection" will send not only browser http and https traffic over my VPN connection, but also helpd, terminal, misc. application, and well, ALL traffic. This is not true. By watching network activity, it appears traffic is going through both the VPN and default connection.

Is there an error in the system, which I can correct? Is my expectation wrong?

share|improve this question
    
I believe there is a bug in OS X. I setup another VPN at another IP address and then configured my system to connect to it. The prior connection was deleted. Despite what the system shows, I now see traffic going to addresses that are not the VPN service's address, PLUS, traffic is going to the prior (deleted) VPN address! My point for using a VPN is security while traveling. It seems we cannot trust OS X's VPN service. –  Michael Prescott Jun 15 '12 at 14:26
    
Seems reasonable to assume that most people trusting OS X's VPN settings aren't aware of the leakage. Not much of a VPN if you're "leaking". Perhaps this is related, but given the volume of traffic I see I think it's more than just a "DNS Leak". dnsleaktest.com/what-is-a-dns-leak.html –  Michael Prescott Feb 11 at 23:04
add comment

3 Answers

The thread A simple fix for a 'Send all traffic over VPN' issue says :

In setting up a VPN on my OS X Server at the office, I was having trouble getting the OS X client option "Send all traffic over VPN" to actually do what it says. In fact, the setting appeared to change nothing on my client machine. After much googling and searching the Apple Discussion forums, I couldn't find anything specific to my issue, so I wanted to reveal the solution here for others to enjoy.

Simply go to your Network Preferences, open your Network Port Configurations, and drag the VPN entry to the top of the list.

This seems to force all TCP/IP traffic over the VPN no matter what the "Send all traffic over VPN" setting is, but only when you are connected to a VPN. I don't think this is an ideal solution, but at least it allows me to tunnel all my traffic while traveling.

share|improve this answer
add comment

I haven't tested specifically, but if you're looking at the network throughput, you're seeing what I'd expect.

Suppose, for example, you transfer 100MB from some random internet server. The server's packets are transferred entirely over the VPN connection, so you'll see 100MB of traffic going over the VPN interface. But the VPN connection itself is routed over the default interface, so you'll see maybe 110MB (100MB + overhead) going over the default interface.

share|improve this answer
    
I see traffic going from the system to both the VPN IP address and the final destination's IP. I expect to see traffic going back and forth between the VPN IP address only. Is this wrong? –  Michael Prescott Jun 14 '12 at 12:57
    
How are you looking at the traffic? –  Gordon Davisson Jun 14 '12 at 14:51
    
Little Snitch and Charles Proxy, plus I can verify in router logs. –  Michael Prescott Jun 14 '12 at 15:20
    
Try using tcpdump or wireshark instead. I've been using OS X VPN's for quite some time and I know for certain that what you think you're seeing is not what you're seeing. –  bahamat Jun 18 '12 at 23:46
add comment

Routing should not depend on the service. Routing table is used to figure out what path to take to reach a certain host/network. You cannot route certain services (using one set of ports & protocols) to use one route while other services to use another route. Even if I don't know something, it will be not so common.

What is possible, however, is that split tunnel is used. It heavily depends on how router is configured and what VPN software you are using (whether it allows overrides). In most cases network administrators don't like split tunneling and (as you'd like) route all the traffic through VPN prohibiting any overrides (unless another VPN client is used :-) ). While it is more secure, it is a pain to work and let's say stream music at the same time.

You can use traceroute command to see what path traffic is taking for a particular destination.

You can try to change default gateway and direct all traffic into VPN once connection is established. However this would depend on whether there is a route to the internet on the other site for VPN connections as it may know local network only.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.