How to change default gateway on XP VPN connection

Typically there are two reasons I see this done.

• As Robert Kaucher mentioned, content filtering, logging, and enforcement at the "hub site" is one big reason. Many content filtering products allow "slave" servers to be deployed at remote sites to perform filtering and logging based on a central "policy server". For a remote site where there isn't any server computer, though, and organization might just opt to route all that traffic back to a central filtering server.

• Centralized firewall rules and monitoring are another common reason I've seen this done (for user-to-site VPNs in particular, but I've seen it with site-to-site, too). "Split tunneling" (that is, allowing the remote VPN endpoint to directly communicate with the Internet and sending only traffic to the corporate network down the VPN pipe) is seen by some as a major security risk. In a site-to-site environment, you could make the call that the firewall in the remote office should be configured to allow safe direct Internet access, but I've seen situations where it was considered "better" (I suppose because the firewall rules at the remote site ended up being, basically, "allow VPN traffic only") to route all that Internet traffic to the "hub" site.

You should see an improvement in bandwidth utilization at the "hub" site, and improved responsiveness at the remote site by moving to a split tunnel. As long as you've got solid firewall rules in the remote site (and whatever monitoring infrastructure, content filter, etc that you want) there shouldn't be any reason not to allow it to have direct Internet access and save bandwidth at the "hub" site.

The VPN addresses given out are in the 10.1.0.0/24 range. The local LAN is in 192.168.0.0/24. The remote LAN is 192.168.1.0/24.

You are in pretty good shape since there is no overlap there. What you are missing is a route to 192.168.1.0/24. When you try to connect to that subnet, it goes out your default gateway (local internet connection) since there is no specific route for it.

Without using split tunnel, it works, because your default gateway is the remote server, and it knows how to get to 192.168.1.0/24. With split tunnel, you need to specify that that traffic needs to go over the VPN.

There are two ways to fix that:

• Change the VPN on the server side to bridge to the LAN, and hand out 192.168.1.0/24 addresses. Since this doesn't require any changes on the client side, it's probably the easiest if you have many clients.
• Add a specific route to 192.168.1.0/24 using 10.1.0.1 as the gateway - this needs to be added on every client. Some VPN clients have a configuration setting to add routes every time you connect. Some do not, in which case you'd have to readd it every time you connect.

Open an administrator command prompt and type:

route add 192.168.1.0 mask 255.255.255.0 10.1.0.1

If there are other subnets on the remote network you want to access, do the same for those as well.