How to configure Shrewsoft’s VPN client to only route traffic to a certain IP address through the VPN

ip addressvpn

We're using Shrewsoft's VPN client to connect to a third party development server. However, it seems to be configured to send all or nothing through the VPN. The devs have to disconnect from the VPN to get email/internet access back.

The server that needs to be accessed via the VPN is on a specific (local – 10.x.x.x) IP address and a specific ports. Can we configure the Shrewsoft client application to only route traffic to that one address and/or port through the VPN and to route anything else though the usual channels?

If so, how is it done? I'm not a VPN specialist and the options are confusing.

In the absence of any Shewsoft VPN client specific advice, what should I be search for? Split tunnels?

Best Answer

In properties window of VPN connection profile, go to (1) Policy tab. There you can add routes.

(2) Uncheck Obtain Topology Automatically or Tunnel All
(3) Click Add.
(4) Set Type to Include.
(5) Set Address to the exact IP you want. (6) Set Netmask to 255.255.255.255.

See also: Shrew Soft VPN Client Admin Guide: Policy Settings (Archived here.)

Related Solutions

Windows – How to determine which traffic is routed through the VPN from the client side

In addition to darwish's suggestion to using tracert, you can do either of the following -

1. Execute route print in command prompt and see what the default gateway is. The default gateway is the one one which starts with 0.0.0.0 - and that line will tell you what gateway IP or interface is used as default route.

2. Just google what is my ip or visit ifconfig.me, that will give you your public facing IP address. If you know which one is vpn and which one is your ISP's IP, then you should be able to tell the difference.

Route all traffic through StrongSwan VPN

I needed to run

sudo sysctl net.ipv6.conf.all.forwarding=1
sudo sysctl net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -s 10.0.3.0/24 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.0.3.0/24 -o eth0 -j MASQUERADE

on the host to cause it to route the traffic out.

My client C can now see other machines on the local network, and SOME (but not all, which I don't understand) on the internet.

Best Answer

Related Solutions

Windows – How to determine which traffic is routed through the VPN from the client side

Route all traffic through StrongSwan VPN

Related Topic