When I connect to my corporate VPN from home, all network traffic including internet traffic goes through the VPN (Figure 1). The VPN is much slower than my home internet, so I would like to route only requests for intranet data via the VPN (Figure 2).

My route table starts as follows:

IPv4 Route Table
Active Routes:
Network Destination     Netmask       Gateway      Interface    Metric         4000              On-link   26       <-appears when VPN connects       On-Link   26       <-appears when VPN connects

My understanding of routing tables is that the entries describe how traffic reaches the internet. The first entry represents my home router acting as a gateway when the VPN is disconnected. The second entry represents the traffic routed via the VPN.

I have tried:

  • With NirSoft NetRouteView, delete the On-Link entry from the routing table. After doing this, I lost internet connection even though the entry was still there.
  • With NirSoft NetRouteView, change the metric value of the On-Link entry to 5000, to prioritise internet via my home router. This didn't have any effect. Tracert to www.google.com showed the connection still went via my corporate VPN.

The VPN is connected via Windows 10 built-in SSTP.

Can what I'm trying be done, and what should I try next?

Figure 1: Currently all traffic goes via the VPN All traffic goes via the VPN

Figure 2: What I am aiming for internet traffic doesn't go via VPN

1 Answer 1


I found enough information in https://security.stackexchange.com/questions/13900/if-i-use-a-vpn-who-will-resolve-my-dns-requests to develop a solution.

I went to Control Panel > All Control Panel Items > Network Connections and edited the Properties of the VPN connection.

In the Networking tab I edited the TCP IPv4 settings. I changed the setting to use the default gateway on the remote network, and for good measure changed the metric to be a large number.

VPN properties dialogue box

enter image description here

As these settings are saved in the VPN connection definition, they should be persistent but easily changeable.

After making these changes, I can still access the corporate network, but tracert to www.google.com goes via my ISP.

There were some initial problems accessing regional spokes of the company network that used different IP ranges. I tried access to these using route commands pointing to the VPN gateway IP. Although route print listed the VPN gateway as 'On-Link', Nirsoft NetRouteView gave the actual IP, leading to commands such as

route -p ADD MASK

However, the VPN gateway changes occasionally, so a more robust solution was found using Add-VpnConnectionRoute in PowerShell, eg

Add-VpnConnectionRoute -ConnectionName "VPN" -DestinationPrefix

To check the route has been added, the following Powershell commands can be used:

$conn = Get-VpnConnection -Name "VPN"

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .