When connecting to our company's VPN and looking at the routing table I find this:
172.16.0.0 10.8.0.241 255.255.0.0 UG 0 0 0 tun0 10.8.0.241 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 10.8.0.0 10.8.0.241 255.255.255.0 UG 0 0 0 tun0
I think I understand the first line to be: A packet to the 172.16 network is dropped into the tun0 interface, but addressed to the gateway 10.8.0.241 which will take care of the rest.
The second line says explicitly that to get to 10.8.0.241, just drop it into tun0.
What I don't understand is why the last two lines cannot just be combined into
10.8.0.0 0.0.0.0 255.255.255.0 UG 0 0 0 tun0
to say that anything to 10.8 can just be dropped into the tunnel and the right machine will pick it up. Why must a packet to 10.8 first be explicitly handed over to the gateway of that same network? Is it that the 10.8.0.251 is kind of misused as a switch here, because it is actually the only machine directly connected to the other end of tun0 and knows ways how to move packets onwards for 10.8?