Juniper VPN forces my traffic via the corporate proxy - can it be undone?

Question

When connected to the corporate VPN from home, all the traffic is redirected to go via the corporate proxy, effectively blocking sites that I want to use freely when I am at home, and slowing down access to external sites. How can I undo this situation?

I am asking the same question as here Avoid corporate blocked URL's when on Cisco VPN, with the exception that my VPN client is Juniper and the OS is windows7. Non of the answers there worked for me: - Juniper client doesn't have the "Use default gateway on remote network" configuration - I wasn't able to find the setting on win7's control pannel (I could find the connection, than IpV4 => properties => advanced => Ip Settings , but nothing there similar to "Use default gateway on remote network"

Interestingly enough the very same vpn client does not force the traffic via the corporate proxy on another computer of mine which runs WinXP

Answer 1

Absolutely possible. I wrote a script that sets up static routes to my home gateway for all IP ranges that I know do not need to go to my corp network. Then it launches Network Connect, then updates the Instantproxy.pac file. (note my corp network is on 136.x.x.x)

basic idea is below - good luck :

%echo off
echo Set up Static routes to home network then launch VPN application

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::: Set interfaceID (found using ROUTE PRINT command) to be equal to the       :::
::: number of the interface of your regular network adapter.                   :::
::: Set homegw equal to the IP address of your home network g/w.               ::: 
:::                                                                            :::
:::    Issue the command as:     LaunchVPN Ethernet       or                   :::
:::                              LaunchVPN Wireless       or                   :::
:::                              LaunchVPN Gigabit                            :::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

set lookfor=%1
set  VPN_version=Network Connect 7.2.0


:: Look for the interface ID that corresponds with the argument passed. Most wireless
:: NIC cards are identified as "Wireless", Ethernet Cards either as "Ethernet" or "Gigabit"

@For /f "tokens=1" %%* in (
   'route.exe print ^|findstr /C:%lookfor%'
   ) Do @Set "interfaceID=%%*"


:: If we did not find any interface - it could be that we need to look for
:: a Gigabit adapter. (If this still fails - the argument passed will need to be
:: modified to match the specific string that identified your NIC. In a DOS
:: window issue the command "Route Print" to see how your NICs are shown.

if (%interfaceID%)==() (set lookfor=Gigabit)

@For /f "tokens=1 delims=." %%* in (
   'route.exe print ^|findstr /C:%lookfor%'
   ) Do @Set "interfaceID=%%*"


@For /f "tokens=1 delims=." %%* in (
   'route.exe print ^|findstr /C:Juniper'
   ) Do @Set "VPNinterfaceID=%%*"


echo Setting up static routes to %lookfor% interface %interfaceID% using %VPN_version%
echo If you should be using a different version than %VPN_version% then update the batch file.

:: Now we need to find the default home gateway. Often this is 192.168.2.1
:: But we'll also search to see if there is a better value to be used.
:: This is to be used as the first hop for non-VPN traffic

set homegw=192.168.2.1


@For /f "tokens=3" %%* in (
   'route.exe print ^|findstr "\<0.0.0.0\>"'
   ) Do @Set "homegw=%%*"

echo Home Gateway is at IP address %homegw%
echo wait .........
pause

:: The loops below may need to be updated to match your specific network needs.
:: A good way to find this is to launch your VPN the noraml way - and to see
:: which addresses need to go to your corporate net. Also, once the VPN is
:: launched, the instantproxy.pac file (that is created for you and stored in
:: "%USERPROFILE%\Application Data\Juniper Networks\Network Connect 7.0.0"
:: or equivalent location may hold some clues.
:: The objective is to make this loop issue the ROUTE command below only for
:: the range of IP address that do NOT need to go to your corp network.

set /a counter=0
:loop_one
set /a counter=%counter%+1
if %counter% ==127 (goto :done_one) 

route add %counter%.0.0.0 MASK 255.0.0.0 %homegw% METRIC 21 IF %interfaceID%

goto :loop_one
:done_one
set /a counter=127
:loop_two
set /a counter=%counter%+1
if %counter% ==136 (goto :done_two) 

route add %counter%.0.0.0 MASK 255.0.0.0 %homegw% METRIC 21 IF %interfaceID%

goto :loop_two
:done_two

set /a counter=136
:loop_three
set /a counter=%counter%+1
if %counter% ==198 (goto :loop_three)
if %counter% ==225 (goto :done_three) 

route add %counter%.0.0.0 MASK 255.0.0.0 %homegw% METRIC 21 IF %interfaceID%

goto :loop_three
:done_three



set /a counter=225
:loop_five
set /a counter=%counter%+1
if %counter% ==240 (goto :done_five) 


route add %counter%.0.0.0 MASK 255.0.0.0 %homegw% METRIC 22 IF %interfaceID%

goto :loop_five
:done_five

route add 192.168.2.0 MASK 255.255.255.0 %homegw% METRIC 15 IF %interfaceID%


Start "" "%PROGRAMFILES(x86)%\Juniper Networks\%VPN_version%\dsNetworkConnect.exe"
echo "wait until VPN client is fully launched and you have logged-in then hit any key.............."
pause

:: Once the client is launched, then kill the intantproxy.pac that is created each time
:: or overwrite it with your own version as needed.

copy /Y "%USERPROFILE%\Application Data\Juniper Networks\%VPN_version%\pacmanproxy.pac" "%USERPROFILE%\Application Data\Juniper Networks\%VPN_version%\instantproxy.pac"



@For /f "tokens=3" %%* in (
   'route.exe print ^|findstr "\< 1 \>"'
   ) Do @Set "VPNgw=%%*"

echo The VPN Gateway is at IP address %VPNgw%

:: route add 198.152.0.0 MASK 255.255.0.0 %VPNgw% METRIC 20 IF %VPNinterfaceID%
:: net use \\192.168.2.2 /USER:Bobby


% echo "Done - ready to use now"
pause

Answer 2

Probably. Not enough information to give a comprehensive specific answer.

Routes are added and removed as interfaces (physical or logical) are activated and deactivated. The interface activate action adds routes, and more recently added routes are (generally) used in preference. What probably happens when you login to the VPN is a new logical network interface is created/activated, and the routing table is updated to use it by default. Assuming the Juniper client creates a tunnel interface, and does not also add a local host-firewall (and that you are not violating corporate policy -- it's possible that this is intentional), you should be able to

• replace the default route (setting it back to your home router via ethernet/wifi interface),
• add specific routes to the corporate network via the tunnel interface.

The MSKB 140859 in the question you link to provides much of the theory, but not so much of the practise.

If you understand the theory, running netsh interface show interface and route print before and after connecting should be useful.

Answer 3

Probably not.

If this was possible you would basically link the corporate network with the public Internet which is something your administrators will try to avoid. Usually it is possible to configure the VPN solution to do what you want but it's not something the client can decide; it's set up by the administrators.