how to force split tunnel routing on mac -> cisco vpn

Question

Any one know how to hack the routing table (on a mac) to defeat the forcing of VPN routing for every thing over a cisco VPN? pretty much what I want to do is have only 10.121.* and 10.122.* addresses over the VPN and everything else straight to the internet.

Answer 1

You should be able to ask the administrator of the router you are connecting to to set up a separate "group" that does split tunneling and give you a PCF file that contains the group name and group password for that group.

Answer 2

More than likely your admin should want to set up VPN connections to use local routing for the 10.121.* and 10.122.* subnets and let the remote (your home machine) route all the rest of the requests. (it saves them bandwidth and liability)

Are you using the Cisco's "VPN Client"? os OS X?

if you use OS X's VPN (set up via the networking Preference Pane) you should be able to click "advanced" and select the "VPN on Demand" tab. then supply the necessary subnets for the VPN to use.

Answer 3

The following works for me. Run these after connecting to the cisco vpn. (I'm using OS X's built-in cisco client, not the Cisco branded client.)

sudo route -nv add -net 10 -interface utun0
sudo route change default 192.168.0.1

Replace "10" in the first command with the network that's on the other side of the tunnel.

Replace "192.168.0.1" with your local network's gateway.

I put it into a bash script, like this:

/Users/mhaase/bin $ cat vpn.sh 
#!/bin/bash

if [[ $EUID -ne 0 ]]; then
    echo "Run this as root"
    exit 1
fi

route -nv add -net 10 -interface utun0
route change default 192.168.0.1

I also found an explanation on how to run this automatically when you connect the VPN, but it's late on Friday and I don't feel like trying it :)

https://gist.github.com/675916