What traffic is routed through VPN server?

Question

I was under the impression that, once connected to a VPN server, all outbound traffic from my computer is routed through that VPN server. I'm not a network engineer so I never really thought about it much until now.

Now, I'm connected to my company's VPN and have the following routing table:

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.1.1        UGSc           80        0     en0
10.8.0.1/32        10.8.0.17          UGSc            0        0   utun3
10.8.0.17          10.8.0.18          UH              8        0   utun3
10.11/24           10.8.0.17          UGSc            2        0   utun3
24.222.7.19/32     10.8.0.17          UGSc            0        0   utun3
24.222.7.21/32     10.8.0.17          UGSc            0        0   utun3
24.222.7.66/32     10.8.0.17          UGSc            0        0   utun3
99.79.0.44/32      10.8.0.17          UGSc            0        0   utun3
127                127.0.0.1          UCS             0       81     lo0
127.0.0.1          127.0.0.1          UH              9  2597308     lo0
169.254            link#5             UCS             0        0     en0
192.168.1          link#5             UCS             3        0     en0
192.168.1.1/32     link#5             UCS             1        0     en0
192.168.1.1        d8:a7:56:1a:d8:c1  UHLWIir        23     1710     en0   1188
192.168.1.109      link#5             UHRLWI          0       21     en0      1
192.168.1.131      4c:7c:5f:54:20:20  UHLWI           0        2     en0   1031
192.168.1.144      c0:f2:fb:a9:19:95  UHLWI           0        0     en0    402
192.168.1.147/32   link#5             UCS             1        0     en0
192.168.1.147      8c:85:90:1c:78:cd  UHLWI           0       20     lo0
192.168.99         link#11            UC              1        0 vboxnet
224.0.0/4          link#5             UmCS            2        0     en0
224.0.0.251        1:0:5e:0:0:fb      UHmLWI          0        0     en0
239.255.255.250    1:0:5e:7f:ff:fa    UHmLWI          0      278     en0
255.255.255.255/32 link#5             UCS             0        0     en0

My understanding is that the gateway chosen depends on the "Destination" address that I am making a request to. Suppose I was making a request heading towards a network that did not match any routes (203.0.113.3/24, for example). In that case, doesn't this request just go to the default gateway, bypassing any address on the VPN and going straight out to the internet?

Am I understanding things correctly or is there still a piece I'm missing?

Answer 1

I was under the impression that, once connected to a VPN server, all outbound traffic from my computer is routed through that VPN server.

Not necessarily. That only happens if the VPN client explicitly adds a 'default' route that goes through the VPN's interface. If the routing table doesn't say your packets go there, then they don't go there.

Commercial VPN providers configure their servers and/or client apps to always add a high-priority default route, since that's the whole point of their service... but there is nothing inherent in the "VPN" technologies themselves that would enforce or require this.

Many corporate or university VPNs only push specific routes relevant to the user, leaving everything else direct. (This is often called split tunneling.)

Suppose I was making a request heading towards a network that did not match any routes (203.0.113.3/24, for example). In that case, doesn't this request just go to the default gateway, bypassing any address on the VPN and going straight out to the internet?

Yes, it does go straight out to the Internet.

(Although technically it does match a route: the 0.0.0.0/0 via 192.168.1.1 aka "default" route. If it didn't match any routes at all, the OS would give you a "Host unreachable" error.)