Static Routes, VPN, and Split Tunneling -- Please Help Me :)

Question

My school recently openned up VPN access for students (PPTP based). It assigns us an IP in the 192.168.168.x range. This allows us to access resouces that we would otherwise be denied access to -- such resources have public IPs (not 192.168.168.255 addresses).

The negative to this is that when I connect to the VPN (I'm using vista right now), all traffic is routed through the VPN by default. I only wanted traffic for the secured resources in question to flow through the VPN -- I want the rest to use my normal internet connection.

I have tried unchecking the box to 'use default gateway on remote network’ under the TCP settings for the VPN connection. The immediate effect of this (from looking at the routing table) is to only pass 192.168.168.x traffic through the VPN and not other traffic. This fails to pass the secured resources through the VPN as they are not on this subnet.

I have come to the conclusion that I need to uncheck the box so that the default gateway is not the remote network. I then need to manually define static routes. The problem is, I have no idea how to do this either on vista (which I'm currently using as a client) or on my dd-wrt router (which can also be a PPTP client).

Thanks for any help.

NemesisDB · Answer

Thanks Bill ... I am looking into this as well and will post if I find out anything.   My school said it was very possible to do but that they would not support it or provide assistance.

dremeda · Answer

To add to my last post, and if you have the authorization to do so, I recommend looking at a stand alone VPN client solution. I have used OpenVPN ( http://openvpn.net/ ) in various network environments successfully.

It is open source, free, and easy to configure.

Enjoy your weekend :)

Dre

dremeda · Answer

So you are using the built in Vista VPN connection. By default PPTP will route all traffic securely. Be aware that all VPN solutions have variations but my idea is based solely on your post that Vista is what you are using as a client. You said that un-checking 'use default gateway on remote network’ doesn't route securely, did you edit your HOSTS & LMHOSTS files? You need to add the address of the servers/computers/etc you want to connect to within these files. As this should make it easy to route only specific traffic to and from your target(s) securely, I will recommend you Google how to add addresses to your host files. Let me know if this helps, it should do the trick ;) Regards, Andres Armeda IT Director Secure Integrations, Inc.

NemesisDB · Answer

Dremeda, thanks for your help.   Unfortunately, I do not have the authorization to change the VPN implementation used by my school (I'm just a student).  They've just recently opened up VPN access to students at all (it used to be faculty only) so despite all of the security weaknesses of PPTP, I can't really complain.  I do like openVPN and actually use that to connect to my own home network from remote locations.   Our school has network shares (with public IPs) that are only accessible from IPs within the school network.  This is the only reason I use their VPN -- I do not want my other traffic to go through it.   Regarding your suggestion, I was under the impression that the hosts file only routed domain names to IPs.  Is there a way I can use the HOSTS file to have a connection to a specific IP address (the secured school resources) to go through the VPN connection?

NemesisDB · Answer

I apologize if I seem to be talking past you here -- I really am trying to understand this.  Currently for the networked resource I want to access I have both an IP address and a URL.  If I uncheck the box to use the remote gateway as the default then I can not access by either IP or URL.  This is because the attempt to connect is routed through my normal internet connection and not the VPN.  I need a way to route the IPs in question over the VPN while not sending everything.

dremeda · Answer

You should be able to address the IP to Computer names you want to connect to.

Also if you run into any problems editing your HOSTS or LMHOSTS file being that it's Vista here is the work around:

http://support.microsoft.com/kb/923947

http://support.microsoft.com/kb/314884/en-us
http://theillustratednetwork.mvps.org/Vista/PPTP/Examplelmhosts.txt

dremeda · Answer

Can you please send me your full configuration, settings and network device specs? You can hit me up in private if you'd like.

dremeda · Answer

Nemesis, I was wondering if the problem was fixed? Please let me know if you need further assistance.

NemesisDB · Answer

I apoligize for the delay in responding to you.  School just started back up this week and I've been burried in work.  I'll try to send you the config info this week if I don't get it figured out   :)

NemesisDB · Answer

Dremeda, I believe I have it working at last. Once i connect to the VPN (with the use default gateway on remote network box unchecked), I used a command prompt to add in manual routes. Basically I used:

route add [IP of resource I wanted access to] [the VPN IP address that was assigned to me]

This sends my normal traffic out over my internet connection, while only the IPs defined above (and other traffic on the VPNs subnet) use the VPN.

There were only 3 or 4 IPs I needed, so it's not a huge pain. Still, a better way to automate it would be nice. My VPN IP is dynamic, so persistant routes don't work -- it also makes creating a bat file a bit harder, though I'm sure it can be done.

Any ideas on how to automate the entry of the route commands?

Message Edited by NemesisDB on 01-19-2008 08:48 PM

NemesisDB · Answer

Thanks Bill, that was my thought too.     If it was just typing in the commands in sequence, I think I could make the bat file based off what I read on google.  Unfortunately, my VPN IP changes each time I connect, which changes the command accordingly.  I'd need a way to grab the current IP as a variable and then insert it for each route command.   Alternatively, I need a way to define the route with the adapter name (which is constant) and not the IP.   Sure it's doable -- just not something I've ever tried to do before   :)

NemesisDB · Answer

Fortunately, there are a lot of code examples on google. i've never made a batch file before, but after cobbling together examples from five or so sites, I was able to come up with the following, which I think works.

The goal of this code was to route a few specific and static IP addresses (the secured resources) through my VPN IP address, which was dynamically assigned. My dynamic VPN address was always in the format of 192.168.168.x

REM Keeps the code from displaying and keeps the variables local

@echo off

setlocal

REM Finds and parses my VPN IP and stores it to ip2.txt

ipconfig | find "192.168.168." > ip1.txt
for /f "tokens=1-2 delims=:" %%i in (ip1.txt) do echo %%j> ip2.txt

REM Stores my IP in the variable CLS

set /p CLS=

REM Creates new routes (where for IP1 and 2 I have typed in the actual address I am routing to)

route add IP1 %CLS%
route add IP2 %CLS%

REM CleanUp
del ip1.txt
del ip2.txt

Message Edited by NemesisDB on 01-21-2008 01:32 AM

dremeda · Answer

Nemesis, I am glad to see you have everything working.

Networking, Internet, & Bluetooth

Static Routes, VPN, and Split Tunneling -- Please Help Me :)

Was this post helpful?