Route VPN and internet traffic via different interfaces

Question

When I connect to my corporate VPN from home, all network traffic including internet traffic goes through the VPN (Figure 1). The VPN is much slower than my home internet, so I would like to route only requests for intranet data via the VPN (Figure 2).

My route table starts as follows:

IPv4 Route Table
================
Active Routes:
Network Destination     Netmask       Gateway      Interface    Metric
0.0.0.0                 0.0.0.0       192.168.1.1  192.168.1.2  4000     
0.0.0.0                 0.0.0.0       On-link      10.0.0.142   26       <-appears when VPN connects
10.0.0.0                255.255.255.0 On-Link      10.0.0.142   26       <-appears when VPN connects

My understanding of routing tables is that the 0.0.0.0 entries describe how traffic reaches the internet. The first entry represents my home router acting as a gateway when the VPN is disconnected. The second entry represents the traffic routed via the VPN.

I have tried:

• With NirSoft NetRouteView, delete the 0.0.0.0 On-Link entry from the routing table. After doing this, I lost internet connection even though the 0.0.0.0 192.168.1.1 entry was still there.
• With NirSoft NetRouteView, change the metric value of the 0.0.0.0 On-Link entry to 5000, to prioritise internet via my home router. This didn't have any effect. Tracert to www.google.com showed the connection still went via my corporate VPN.

The VPN is connected via Windows 10 built-in SSTP.

Can what I'm trying be done, and what should I try next?

Figure 1: Currently all traffic goes via the VPN

Figure 2: What I am aiming for

Answer 1

I found enough information in https://security.stackexchange.com/questions/13900/if-i-use-a-vpn-who-will-resolve-my-dns-requests to develop a solution.

I went to Control Panel > All Control Panel Items > Network Connections and edited the Properties of the VPN connection.

In the Networking tab I edited the TCP IPv4 settings. I changed the setting to use the default gateway on the remote network, and for good measure changed the metric to be a large number.

As these settings are saved in the VPN connection definition, they should be persistent but easily changeable.

After making these changes, I can still access the corporate network, but tracert to www.google.com goes via my ISP.

There were some initial problems accessing regional spokes of the company network that used different IP ranges. I tried access to these using route commands pointing to the VPN gateway IP. Although route print listed the VPN gateway as 'On-Link', Nirsoft NetRouteView gave the actual IP, leading to commands such as

route -p ADD 192.168.50.0 MASK 255.255.255.0 10.0.0.50

However, the VPN gateway changes occasionally, so a more robust solution was found using Add-VpnConnectionRoute in PowerShell, eg

Add-VpnConnectionRoute -ConnectionName "VPN" -DestinationPrefix 192.168.50.0/24

To check the route has been added, the following Powershell commands can be used:

$conn = Get-VpnConnection -Name "VPN"
$conn.routes