8

Or my expectations are wrong.

I expect that checking the "Send all traffic over VPN connection" will send not only browser http and https traffic over my VPN connection, but also helpd, terminal, misc. application, and well, ALL traffic. This is not true. By watching network activity, it appears traffic is going through both the VPN and default connection.

Is there an error in the system, which I can correct? Is my expectation wrong?

2
  • I believe there is a bug in OS X. I setup another VPN at another IP address and then configured my system to connect to it. The prior connection was deleted. Despite what the system shows, I now see traffic going to addresses that are not the VPN service's address, PLUS, traffic is going to the prior (deleted) VPN address! My point for using a VPN is security while traveling. It seems we cannot trust OS X's VPN service. Jun 15, 2012 at 14:26
  • Seems reasonable to assume that most people trusting OS X's VPN settings aren't aware of the leakage. Not much of a VPN if you're "leaking". Perhaps this is related, but given the volume of traffic I see I think it's more than just a "DNS Leak". dnsleaktest.com/what-is-a-dns-leak.html Feb 11, 2014 at 23:04

4 Answers 4

14

The thread A simple fix for a 'Send all traffic over VPN' issue says :

In setting up a VPN on my OS X Server at the office, I was having trouble getting the OS X client option "Send all traffic over VPN" to actually do what it says. In fact, the setting appeared to change nothing on my client machine. After much googling and searching the Apple Discussion forums, I couldn't find anything specific to my issue, so I wanted to reveal the solution here for others to enjoy.

Simply go to your Network Preferences, open your Network Port Configurations, and drag the VPN entry to the top of the list.

This seems to force all TCP/IP traffic over the VPN no matter what the "Send all traffic over VPN" setting is, but only when you are connected to a VPN. I don't think this is an ideal solution, but at least it allows me to tunnel all my traffic while traveling.

2

I haven't tested specifically, but if you're looking at the network throughput, you're seeing what I'd expect.

Suppose, for example, you transfer 100MB from some random internet server. The server's packets are transferred entirely over the VPN connection, so you'll see 100MB of traffic going over the VPN interface. But the VPN connection itself is routed over the default interface, so you'll see maybe 110MB (100MB + overhead) going over the default interface.

4
  • I see traffic going from the system to both the VPN IP address and the final destination's IP. I expect to see traffic going back and forth between the VPN IP address only. Is this wrong? Jun 14, 2012 at 12:57
  • How are you looking at the traffic? Jun 14, 2012 at 14:51
  • Little Snitch and Charles Proxy, plus I can verify in router logs. Jun 14, 2012 at 15:20
  • Try using tcpdump or wireshark instead. I've been using OS X VPN's for quite some time and I know for certain that what you think you're seeing is not what you're seeing.
    – bahamat
    Jun 18, 2012 at 23:46
0

Routing should not depend on the service. Routing table is used to figure out what path to take to reach a certain host/network. You cannot route certain services (using one set of ports & protocols) to use one route while other services to use another route. Even if I don't know something, it will be not so common.

What is possible, however, is that split tunnel is used. It heavily depends on how router is configured and what VPN software you are using (whether it allows overrides). In most cases network administrators don't like split tunneling and (as you'd like) route all the traffic through VPN prohibiting any overrides (unless another VPN client is used :-) ). While it is more secure, it is a pain to work and let's say stream music at the same time.

You can use traceroute command to see what path traffic is taking for a particular destination.

You can try to change default gateway and direct all traffic into VPN once connection is established. However this would depend on whether there is a route to the internet on the other site for VPN connections as it may know local network only.

0

For MacOS Monterey, go to Settings -> Network. On the left botom side you'll see three buttons, click on the third (after + and - buttons) and pick "Set Service Order..".

Now, reorder your VPN service on the first place and confirm changes. That's it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .