Networking – Routing connections through VPN based on hostname (not IP range)

networkingosx-snow-leopardvpn

This bugs me immensly.

I need to connect to client's network through VPN. But I definitely do not want to send all the traffic through client's network so this option is out of question. What I need basically is for the OS to know that all client's network subdomains (*.example.com) need to go through the VPN connection.

I tried a couple of options:

  1. Changing order of services and setting the VPN on top, but this works the same as "Send all traffic over VPN connection".
  2. Using "VPN on Demand" option from network advanced options, but this feature is quite rubbish to be honest. Seems to work only in Safari (?!) and it doesn't route the connection, but it basically triggers the OS to connect to the selected VPN.

The reason I need it to work based on hostnames rather than IP range is simple – my client has a lot of servers inside his network and it's impossible for me to remember all IPs. They are all within a range, but this doesn't help me remembering.

Another option would be to put the VPN connection on the bottom of network services and untick "Send all traffic…" and then put all known hostnames in hosts file, but considering there could be hundreds of servers (therefore hostnames and ips too) it ridiculous job. And if new server appears on the network I'd need to edit the hosts file again. Sisyphean labours.

However this works on Windows very simply. If a hostname is not available through default network interface, then it seems to try VPN connection and this works brilliantly.

So, how can I achieve that on Mac, then?

I know client's internal DNS addresses if that is of any help (like directing a certain domains through a different DNS)?

PS. Using latest version 10.6.6.
PS2. I am using VPN to access intranet, version control servers (svn://), samba shares and for SSH access to servers.

Best Answer

The standard way to do this is to only route the clients IP ranges over the VPN. Route other traffic over your default network.

For security reasons, many VPN connections will force all traffic over the VPN to control information leakage. I would discuss doing otherwise with your client. Disconnect from the VPN when doing your own work.

Related Question