My question is related to this: How to force split tunnel routing on Mac to a Cisco VPN

I am having though a bit of hard time figuring out what to do. The problem I have is that, after I connect to the VPN, the internet becomes much slower (the cisco client has been configured with split-tunnel I think). I am not too sure if all my internet traffic goes to the vpn server and back. Someone asked this question: Cisco VPN Client - External URL are tracked?, however, it's not clear to me whether the traffic is logged or not by the company. Every time I access a page the statistics for the cisco client changes. Does it mean that my network traffic reaches the vpn server and is logged?

Using the Network Utility, netstat displays a lot of connections established through the utun0 which is the interface created by the vpn client.

I also noticed that cisco vpn client has added all sorts of rules to the list (viewable via sudo ipfw list). There are ip addresses in the list that I don't know what they are. The interesting thing is that I don't see anymore the ip addresses of the servers that I have access to.

So, I want my internet speed to get back to the way it was and I want only the requests to the internal servers I have access to to go to the VPN server.

Is this achievable? Let me know if there is more information that I should provide.


  • You should check the routing table when vpn is running. If the default route points to vpn-assigned ip/interface then all traffic goes via VPN. Another simple way is to run traceroute google.com with and without VPN. If your company configured VPN to be default gateway, all traffic will go via your company and there isn't much you can do. If you customize routes manually, running VPN client will override them to company's configuration – Alec Istomin Feb 27 '15 at 21:01
  • @AlecIstomin: I did run traceroute in both scenarios and it's taking different paths. When anyconnect is on, the traffic goes through the vpn server. – costa Feb 27 '15 at 22:02
  • look into virtualization, might be an easier way out to run vpn in a VM and have direct connectivity from Mac – Alec Istomin Feb 28 '15 at 3:18

It should be achievable as long as you have local admin access. As indicated in the links you've provided what you basically need to do it alter routing tables such that all traffic to particular servers/networks goes only via the VPN while the rest goes out through the standard Internet interface.

To test you can use something like 'traceroute' to track the pathway that a packet is likely to take as it goes to a destination.


Another way is to use a packet sniffer like 'Wireshark' to see which interface traffic goes to when you go for traffic to a particular destination.

Namely, does it go through the VPN to the Internet and vice-versa or does it go straight to the Internet. What I'm guessing we're seeing here is basically the application is misconfigured?

Sorry, coming to grips with this website...

Anyhow, Mac OS X essentially uses a BSD core which means it's reliant on tools from the same heritage. It also means that if you think carefully, ipfw (firewall) and the routing tables can obviously overlap (rejected/redirected traffic from ipfw can automatically force traffic to take a different route than normal).


So how do you deal with this?

Ask for the admin to reconfigure the device/client/application in question to give you more normal routing tables.

Stop Cisco AnyConnect from locking down the NIC

Try and find away around these problems by invoking local admin rights (don't have test gear so can't tests) and altering the rulesets in question to give you more normal routing behaviour.

Cisco AnyConnect profile keeps getting overwritten

Setting up the client within a virtual machine so that the routing rules are pushed to that particular operating system and not your base system.



|improve this answer|||||
  • It might be misconfigured. I am seeing definitely different traces with and without cisco anyconnect. My problem is that I have limited knowledge of this type of networking. One thing that confuses me is the mixture of ipfw and route. It is my understanding that ipfw is obsolete but yet anyconnect seems to use this command to configure rules. Then you have the route commands. Do they affect the ipfw settings? – costa Feb 27 '15 at 22:05
  • Mac OS X essentially uses a BSD core which means it's reliant on those freebsd.org/doc/en/books/handbook/firewalls-ipfw.html – dtbnguyen Feb 27 '15 at 23:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.