My setup is as follows:

  • Windows 10, Corona forced home office, I'm an external contractor at a huge company
  • I'm connecting to the VPN of my company, called MyVPN, some internal IPs of our client are accessible for us via this VPN
  • I set up split tunneling with Set-VpnConnection "MyVPN" -SplitTunneling 1
  • All the internal IPs I need to call with the VPN start are in the same IP range 999.0.0.0/8 (example IP range, thousands of different IPs beong to this company)
  • So I added all these IPs via netsh interface ipv4 add route 999.0.0.0/8 "MyVPN"
  • This works, I can call internal IPs via the VPN while all other calls don't go through my VPN
  • My issue is now:
    • I can't access all internal IPs via VPN, because of missing Firewall routes (I have to request them which takes some time and a lot of discussions... So I want to avoid this)
    • But some of these internal IPs can be accessed globally without the VPN
    • So I now have the issue, that I can't access these IPs through my VPN, but I could access them if I turn my VPN off. But my netsh route routes them all to the VPN, which leads to a timeout
  • I was thinking to somehow exclude these IPs from the netsh route, but I don't know how. Is there a way?
    • Like netsh interface ipv4 exclude route 999.40.60.80 "MyVPN"
    • The IPs I have an issue with are scattered throughout their whole range, no pattern or similarities

That's the output of netsh interface ipv4 show route (German :) "WLAN" is German for "WiFi") enter image description here

I found it! Based on user1686's answer I tried some stuff and that's the solution

netsh interface ipv4 add route 999.40.60.80/32 "WLAN"

with WLAN beeing the name of my WiFi interface and beeing my default gateway.


Just add normal routes through your regular Internet gateway:

netsh interface ipv4 add route 999.40.60.80/32 "WLAN"

Copy the 'gateway' value from your current route.

  • Thanks, but this results in "The filename, directory name, or volume label syntax is incorrect", even if I enclose with paranthesis (and I also added /32 to the company IP. So this was tried netsh interface ipv4 add route 999.40.60.80/32 "" When I write "WLAN" instead of "" it gets sorted below the VPN entry, and so the VPN route "grabs" it
    – Reeno
    Mar 20 '20 at 15:06
  • Routes are not sorted "above" or "below". They're sorted by prefix length – a longer prefix (e.g. /32) always wins over a shorter prefix (e.g. /8 or /0).
    – user1686
    Mar 20 '20 at 19:22
  • Thanks, I found it! I had to add my WiFi interface name between the two IPs, see the extension of my question.
    – Reeno
    Mar 23 '20 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.