Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I've got a corporate VPN, which I use to access the Internet. When it's on, I cannot reach the servers inside the corporate network anymore, so I think there are some problems with the gateway setup. Here is the netstat -rn output when the VPN is turned off:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
10.131.60.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1_rename
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1_rename
0.0.0.0         10.131.60.1     0.0.0.0         UG        0 0          0 eth1_rename

Here it is with the VPN turned on:

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
10.7.4.0        0.0.0.0         255.255.255.255 UH        0 0          0 ppp0
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
91.218.225.31   10.131.60.1     255.255.255.255 UGH       0 0          0 eth1_rename
10.131.60.0     0.0.0.0         255.255.255.0   U         0 0          0 eth1_rename
169.254.0.0     0.0.0.0         255.255.0.0     U         0 0          0 eth1_rename
0.0.0.0         0.0.0.0         0.0.0.0         U         0 0          0 ppp0

ppp0 is the VPN device.

How can I make both the Internet and LAN routing work when the VPN is enabled?

share|improve this question
add comment

3 Answers

up vote 2 down vote accepted

Probably, you need to add appropriate route table entries to reach local intranet server via 10.131.60.1, not via ppp0. Consult with your system administrator if you don't know exactly which addresses should be accessed via local gateway.

share|improve this answer
    
I resolved adding a static route on the correct interface for the corporate net. –  ludiegu Nov 18 '11 at 8:49
add comment

Can you clarify the question. It sounds like you are saying that it prevents you connecting to the Internet and Corporate servers at the same time, but do you mean from home or from the office?

If you are connecting from home, or other external location then this is exactly the behaviour I would hope to see - split tunneling presents some security risks to the organisation so preventing it is a useful security improvement.

share|improve this answer
    
I'm inside the corporate net. When the vpn is OFF, I can reach all the servers inside it, of course. When the vpn is ON, I can surf, but cannot reach any server which is outside the subnet in the eth1_rename ip range (I can still ping ip in this subnet). –  ludiegu Nov 17 '11 at 10:53
    
Interesting - normally the connecting outbound from the office environment is handled through reverse proxies, webfilters etc. - not through a VPN. Is this the recommended solution in your company for Internet access? –  Rory Alsop Nov 17 '11 at 10:55
    
The vpn I'm using it's not own from the corporate net I'm in, they use a normal transparent proxy (and I don't have credential, of course). –  ludiegu Nov 17 '11 at 11:00
add comment

Many corporate VPN software are configured to allow access only to corporate network. This is due to security reasons so that customers wouldn't be able to forward traffic into corporate network.

Do you know what VPN software are you using? If it's OpenSource you can propably tweak the settings. Otherwise you have to contact the corporate.

share|improve this answer
    
You can try ip route change default gw 10.131.60.1 –  anttir Nov 17 '11 at 10:17
    
I'm using the VPN client in Ubuntu, so I can modify the settings. When I run the ip route change default gw 10.131.60.1 I've this output: Error: either "to" is duplicate, or "gw" is a garbage. –  Diego Nov 17 '11 at 10:49
    
my mistake. ip route change default 10.131.60.1 –  anttir Nov 17 '11 at 12:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.