Windows – Setting VPN to go through certain IPs and not others

iproutingvpnwindows

I'm a scientific programmer with a loose grasp of what goes on under the hood in my small home network so bear with me whilst I try and explain using the correct words if possible.

My home network of five PCs (Windows 7, Vista, 2003, 2 x XP) uses the 192.168.0.0 range of IP addresses. My ADSL router is 192.168.0.1 and is set to do DHCP and all that good stuff. So far, so good. Most importantly I can connect to my local web server on 192.168.0.42.

I frequently have to connect up to a client's VPN using Checkpoint SecureClient. When I do so I'm given a 10.something IP address on the 'virtual' network card.

If I'm connected to the VPN I can no longer connect to my 192.168.0.42 web server.

How can I tell my PCs to only go via the VPN for anything beginning 10.* and to stay 'local' for everything else?

(below added following Chris Thorpe's answer)

BTW I don't see the VPN connection under Control Panel. I just see my physical NIC. Here's what I see running ipconfig, if that helps:

Ethernet adapter Local Area Connection* 6:

   Connection-specific DNS Suffix  . : <removed for security!> 
   IPv4 Address. . . . . . . . . . . : 10.14.2.130
   Subnet Mask . . . . . . . . . . . : 255.255.255.128
   Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 192.168.0.101
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

(another edit following gravyface's response)

A route print gives 50+ lines of routing info. Here's some lines if that helps…

===========================================================================
Interface List
 11 ...54 ec 6d 95 66 05 ...... Check Point Virtual Network Adapter For SecureClient

  8 ...00 19 d1 6a 79 cb ...... Intel(R) 82566DC Gigabit Network Connection

  1 ........................... Software Loopback Interface 1

===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1    192.168.0.101     10
         10.0.2.0    255.255.255.0      10.14.2.129      10.14.2.130      1
         10.1.0.0      255.255.0.0      10.14.2.129      10.14.2.130      1
         10.2.0.0      255.254.0.0      10.14.2.129      10.14.2.130      1
         10.4.0.0      255.255.0.0      10.14.2.129      10.14.2.130      1

<lots of 10.*  removed>
<some seemingly random IP addresses removed until we get to the 192.168 >

      192.168.0.0    255.255.255.0         On-link     192.168.0.101    266
      192.168.0.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.0.101  255.255.255.255         On-link     192.168.0.101    266
    192.168.0.101  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.0.255  255.255.255.255         On-link     192.168.0.101    266
    192.168.0.255  255.255.255.255      10.14.2.129      10.14.2.130      1
      192.168.4.0    255.255.255.0      10.14.2.129      10.14.2.130      1
     192.168.16.0    255.255.255.0      10.14.2.129      10.14.2.130      1
     192.168.64.0    255.255.255.0      10.14.2.129      10.14.2.130      1
     192.168.67.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.120.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.125.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.140.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.150.0    255.255.255.0      10.14.2.129      10.14.2.130      1
    192.168.250.3  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.250.8  255.255.255.254      10.14.2.129      10.14.2.130      1
    192.168.253.1  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.253.2  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.254.3  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.254.8  255.255.255.254      10.14.2.129      10.14.2.130      1
   192.168.254.10  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.255.1  255.255.255.255      10.14.2.129      10.14.2.130      1
    192.168.255.2  255.255.255.255      10.14.2.129      10.14.2.130      1

<some other non 192.168* removed>

  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link       10.14.2.130    256
  255.255.255.255  255.255.255.255         On-link     192.168.0.101    266
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  1    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

Best Answer

Go into:

Control Panel -> Network Connections -> find your VPN connection
Right-click it and select properties.
Find the TCP/IP settings and then the 'advanced' settings pane.
Untick 'use default gateway on remote network'

Related Solutions

Linux – Routing all traffic over VPN on Ubuntu Linux

Your local network is 192.168.1.0/24, as shown by this line in your routing table:

 192.168.1.0/24 dev eth0  proto kernel  scope link  src 192.168.1.32  metric 1

Your VPN network is 10.0.0.0/8, as shown by this line:

 10.0.0.0/8 dev tun0  scope link

Currently, your default router is:

 default via 192.168.1.254 dev eth0  proto static

which is of course what you do not want, because it belongs to your local LAN: thus all of your stuff is routed through your local gateway, as if the VPN did not exist.

 You do have however, the all-important statement

 128.122.252.68 via 192.168.1.254 dev eth0  src 192.168.1.32

which is the route to your VPN-provider.

EDIT:

I had not realized that the routing table is simply the one that is obtained from your VPN, without your intervention. This may indicate (indirectly) that your service provider is willing to forward only the traffic explicitly allowed in your table through the interface tun0, and may have taken further steps to block all other traffic, in which case your efforts will be futile.

However, assuming that your provider is willing to forward all of your traffic, what you need to do is the following.

First, you need to find out whether there is a gateway willing to accept your connection on the other side, because we need its IP address. I will give you four methods to do this.

1) With the pc connected to the VPN, try the following command:

   sudo dhclient -v tun0

If everything goes well, you should see a reply containing this line:

 DHCPOFFER of a.b.c.d from x.y.w.z

x.y.w.z is the IP address of the local gateway. You may have to shutdown your VPN after this test, and maybe even to reboot your pc, because we will have just messed up the routing table pretty well.

2) Alternatively, you may try navigating to one of the allowed sites (those that appear in your routing table as going through the tun0 interface), then issuing the command:

  ip neigh show

You should get a list of pcs contacted through the ARP protocol, with MAC and IP address; most likely, you will receive either zero or one reply. If you get a single reply, then that's your router.

3) If you get no such reply, then you may try with

  sudo nmap -sn 10.0.0.0/8

(which is going to be very slow). Your gateway will be one of the pcs listed, most likely the one with address ending in .1 or in .254, if any such exist.

4) Use the tcpdump command:

  sudo tcpdump -n -i tun0

and see the IP addresses spewed out by the command.

If you get no proper reply to this test either, it means someone has really tightened the screws in his network.

But let us be optimistic, and suppose you now have a candidate IP address x.w.y.z for the remote router. You will need to delete the default gateway, (as sudo!):

  ip route del default via 192.168.1.254

an add the new one:

  ip route add default via x.w.y.z

and try to navigate.

Let me repeat: since your provider has allowed traffic only to a few selected IP addresses through his VPN, it is possible he may have taken extra measures (=firewall) to prevent a smart user to force his generic traffic through his VPN. In this case, there is nothing you can do. But if he did not, the above steps should help you find a solution.

Best Answer

Related Solutions

Linux – Routing all traffic over VPN on Ubuntu Linux

Related Question