Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't want to send all my network traffic down to VPN when I'm connected to my company's network (via VPN) from home. For example, when I'm working from home, I would like to be able to backup all my files to the Time Capsule at home and still be able to access the company's internal network.

I'm using Leopard's built-in VPN client. I've tried unchecking "Send all traffic over VPN connection." If I do that I will lose access to my company's internal websites be it via curl or the web browser (though internal IPs are still reachable). It'd be ideal if I can selectively choose a set of IPs or domains to be routed through VPN and keep the rest on my own network. Is this achievable with Leopard's built-in VPN client? If you have any software recommendations, I'd like to hear them as well.

share|improve this question
The first solution will only work on a PPP VPN. The following solution will work on a Cisco VPN (and other types nothing specific to Cisco)… – dr jimbob Apr 7 '14 at 4:20
up vote 55 down vote accepted

Create the file /etc/ppp/ip-up with following content:

/sbin/route add <SUBNET> -interface $1 

replacing <SUBNET> with subnet, you want to route through VPN (for ex.

execute as root:

chmod 0755 /etc/ppp/ip-up

This file will be executed each time you connect to VPN.

The parameters given to the script:

  • $1: The VPN interface (e.g. ppp0)
  • $2: Unknown, was 0 in my case
  • $3: IP of the VPN server
  • $4: VPN gateway address
  • $5: Regular (non-vpn) gateway for your lan connections
share|improve this answer
The tip of Aleksei worked for me. I am only wondering whether the first line (#!/bin/sh) is doing anything. Isn't it commented out. I am asking this since I am describing this for use at our company and the simpler the better :-) Thanks, Edgar – Edgar Wieringa Feb 22 '11 at 15:59
@EdgarWieringa: converted your answer to a comment. Hope that's better! :) – studiohack Feb 22 '11 at 15:59
@Edgar - no. That first line is special. – James Moore May 23 '11 at 20:42
James is right, but of course in the case of a shell script, it's not necessary. If a shebang isn't present, the OS will send it to the shell anyway. :-) – Benson Sep 22 '11 at 20:52
On 10.7/Lion, I had better luck with: /sbin/route add -interface $1 The arguments I saw ip-up getting are: $1 = VPN interface, e.g. 'ppp0' $2 = '0' (not sure what this value is) $3 = Your VPN IP $4 = VPN public gateway IP address $5 = Normal default gateway for ethernet/wifi – Gabe Martin-Dempesy Dec 7 '11 at 17:18

I wanted to do a similar thing. Connect the VPN and then route an additional network via that VPN. I ended up with the following bit of Applescript:

-- Connect Work VPN

tell application "System Events"
    tell network preferences
        tell current location
            tell service "Work"
                tell current configuration
                    repeat until get connected = true
                        delay 1
                    end repeat
                end tell
            end tell
        end tell
    end tell
end tell

set gateway to ""

do shell script "route add " & gateway with administrator privileges

You need to change "Work" to the name of your VPN connection, to your gateway address, and to the address of the network to which you wish to route. Additional networks can be added by repeating the final line with different addresses.

share|improve this answer
(Minor addition, for those who wonder about this IP address: just like the questioner talked about, is a private address space just like 10.x.x.x and 192.168.x.x. So, it is in fact part of the VPN, and not some external web site or whatever.) – Arjan Oct 21 '09 at 9:48
So is your router on the VPN, or the router on the LAN? And don't you have to set the default route back to your LAN? – Jack M. Jun 16 '10 at 17:14

The solution is hidden. It's critical that you have your network interfaces sorted into the order you want them to be used. So the "send all data..." tick-box is not doing anything. If you want ALL non-LAN data to go to the VPN, put the VPN interface at the top (i.e. System Preferences / Network - click the gear icon at the bottom of the list of interfaces...) and sort: VPN, Ethernet, Airport; NOT Airport, Ethernet, VPN!

share|improve this answer
I don't think this answers the question, unless the OP is backing up to Time Machine via Ethernet and connecting to the company network view Airport (Wireless connection) – Josh Newman Apr 15 '10 at 17:53
I used the ppp startup trick, but it didn't work until I moved my vpn connection below the wireless connection. This is a valid answer. – Arosboro Aug 11 '12 at 14:41
It really wold be the main answer! Thanks very much, it would be impossible to figure out! – Andre Soares Jan 30 at 1:45

I have had a look online to see if I can find anything, and as far as I can understand you seem to want to be able to use your computer like normal, while also being able to connect to internal company websites, so, you may need to set up a custom routing table.

This link apparently only applies to 10.4, but the command line stuff may still work.

share|improve this answer

You must log in to answer this question.

protected by nhinkle Apr 26 '11 at 8:12

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged .