2

I've got a corporate VPN, which I use to access the Internet. When it's on, I cannot reach the servers inside the corporate network anymore, so I think there are some problems with the gateway setup. Here is the netstat -rn output when the VPN is turned off:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
10.131.60.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1_rename
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1_rename
0.0.0.0         10.131.60.1     0.0.0.0         UG        0 0          0 eth1_rename

Here it is with the VPN turned on:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.7.4.0        0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
10.131.60.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1_rename
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1_rename
0.0.0.0         0.0.0.0         0.0.0.0         U         0 0          0 ppp0

ppp0 is the VPN device.

How can I make both the Internet and LAN routing work when the VPN is enabled?

0

3 Answers 3

2

Probably, you need to add appropriate route table entries to reach local intranet server via 10.131.60.1, not via ppp0. Consult with your system administrator if you don't know exactly which addresses should be accessed via local gateway.

1
  • I resolved adding a static route on the correct interface for the corporate net.
    – ludiegu
    Nov 18, 2011 at 8:49
0

Many corporate VPN software are configured to allow access only to corporate network. This is due to security reasons so that customers wouldn't be able to forward traffic into corporate network.

Do you know what VPN software are you using? If it's OpenSource you can propably tweak the settings. Otherwise you have to contact the corporate.

3
  • You can try ip route change default gw 10.131.60.1 Nov 17, 2011 at 10:17
  • I'm using the VPN client in Ubuntu, so I can modify the settings. When I run the ip route change default gw 10.131.60.1 I've this output: Error: either "to" is duplicate, or "gw" is a garbage.
    – Diego
    Nov 17, 2011 at 10:49
  • my mistake. ip route change default 10.131.60.1 Nov 17, 2011 at 12:46
0

Can you clarify the question. It sounds like you are saying that it prevents you connecting to the Internet and Corporate servers at the same time, but do you mean from home or from the office?

If you are connecting from home, or other external location then this is exactly the behaviour I would hope to see - split tunneling presents some security risks to the organisation so preventing it is a useful security improvement.

3
  • I'm inside the corporate net. When the vpn is OFF, I can reach all the servers inside it, of course. When the vpn is ON, I can surf, but cannot reach any server which is outside the subnet in the eth1_rename ip range (I can still ping ip in this subnet).
    – ludiegu
    Nov 17, 2011 at 10:53
  • Interesting - normally the connecting outbound from the office environment is handled through reverse proxies, webfilters etc. - not through a VPN. Is this the recommended solution in your company for Internet access?
    – Rory Alsop
    Nov 17, 2011 at 10:55
  • The vpn I'm using it's not own from the corporate net I'm in, they use a normal transparent proxy (and I don't have credential, of course).
    – ludiegu
    Nov 17, 2011 at 11:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .