up vote 4 down vote favorite
1
share [g+] share [fb]

Any one know how to hack the routing table (on a mac) to defeat the forcing of VPN routing for every thing over a cisco VPN? pretty much what I want to do is have only 10.121.* and 10.122.* addresses over the VPN and everything else straight to the internet.

link|improve this question
feedback

3 Answers

You should be able to ask the administrator of the router you are connecting to to set up a separate "group" that does split tunneling and give you a PCF file that contains the group name and group password for that group.

link|improve this answer
that's not going to happen :) They are paranoid – user23601 Jan 4 '10 at 18:52
feedback

More than likely your admin should want to set up VPN connections to use local routing for the 10.121.* and 10.122.* subnets and let the remote (your home machine) route all the rest of the requests. (it saves them bandwidth and liability)

Are you using the Cisco's "VPN Client"? os OS X?

if you use OS X's VPN (set up via the networking Preference Pane) you should be able to click "advanced" and select the "VPN on Demand" tab. then supply the necessary subnets for the VPN to use.

link|improve this answer
The OS X vpn client has a separate "Cisco" option (separate from PPTP and L2TP) that doesn't have the "VPN on Demand" options. – mehaase Jul 22 '11 at 20:49
feedback

The following works for me. Run these after connecting to the cisco vpn. (I'm using OS X's built-in cisco client, not the Cisco branded client.)

sudo route -nv add -net 10 -interface utun0
sudo route change default 192.168.0.1

Replace "10" in the first command with the network that's on the other side of the tunnel.

Replace "192.168.0.1" with your local network's gateway.

I put it into a bash script, like this:

/Users/mhaase/bin $ cat vpn.sh 
#!/bin/bash

if [[ $EUID -ne 0 ]]; then
    echo "Run this as root"
    exit 1
fi

route -nv add -net 10 -interface utun0
route change default 192.168.0.1

I also found an explanation on how to run this automatically when you connect the VPN, but it's late on Friday and I don't feel like trying it :)

https://gist.github.com/675916

link|improve this answer
feedback

Your Answer

 
or
required, but never shown