Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

Short Question
Is there something I am missing when setting up a Cisco IPSec VPN connection that redirects all traffic over the VPN?

Background
When I am connected to the VPN, I can browse our company's intranet with no problems, but when I try to go out to say www.google.com it times out. Another co-worker is having the same problem on his MBP as well. The VPN client we use for our Windows machines is Shrew Soft talking to a pfSense router, which works like a champ.

System Information
Network
VPNing into a Pfsense based router

Hardware
MBP early 2008
4GB Ram
500GB 7200RPM HDD

Software
OS X 10.6.8
Bootcamp and Parallels 6: Windows 7 Pro

share|improve this question
    
VPN can either allow this or prevent this - you need to know the details of what you asked your VPN client to do. It's entirely possible the person that set up the mac configuration didn't allow split routing. It could be by intention or by omission, but asking them is the best way out of your dilemma. –  bmike Aug 2 '11 at 17:01
    
@bmike: If split routing was not enabled, would why would our Windows machines work as expected? Please do not take this a disrespectful, I honestly cannot figure out the answer to it either. –  Adam Lewis Aug 2 '11 at 18:32
    
the usual suspect is that the configuration file that windows uses is distinct and different than the one that the mac uses. Also, the mac client of the Cisco software doesn't always interpret the same file in the same way. Big headache, especially when the IT person won't listen when you have a legitimate problem. The cisco client software was always the biggest headache for me with all the versions, highly restricted dowload site, lack of public knowledge base, etc.... –  bmike Aug 2 '11 at 18:49
1  
Or to be succinct. Split routing means the Mac software allows it. Your config has to tell the mac to keep it's default route active and just overlay the corporate IP ranges. It doesn't really matter what windows does - your mac OS needs instructions that it understands. –  bmike Aug 2 '11 at 18:52

3 Answers 3

IPSec connections to Cisco routers are only allowed split routing based on the configuration of the router. I don't know what kind of router you are connecting to,b ut an example is shown here. Basically whomever is running the router would need to configure it to allow this behavior.

share|improve this answer
    
We are not using a Cisco router for our VPN, we are using pfSense. The only configuration that would connect to it was using the Mac's IPSec Cisco connection. Is there a better IPSec client for OS X? –  Adam Lewis Aug 2 '11 at 18:34
    
I believe that Viscosity supports split tunneling with pfSense. –  ssevennm Aug 2 '11 at 18:46
    
This looks pretty cool. And for $9 it will be an easy sell if it works. I will give it a try when I reboot into OS X. Thanks for the link! –  Adam Lewis Aug 2 '11 at 18:50
    
Of course with Viscosity you would need to setup your pfSense to do OpenVPN. If you have to stay with IPSec you could try IPSecuritas which is Free. –  ssevennm Aug 2 '11 at 19:09

I'm running an ipsec endpoint with pfsense 2.0-rc2. Using the native vpn client with Mac OS 10.6 and now 10.7, internet and local lan access works fine. However all traffic travels over the tunnel so I had to add an any-any rule for ipsec traffic in the pfsense firewall settings. Hope that helps.

share|improve this answer
    
Does the any-any rule still force traffic over the tunnel? Meaning would requests to IE: www.google.com go through the tunnel and the DNS on the endpoint then route the data back to the mac? –  Adam Lewis Aug 12 '11 at 3:42
    
Yup, the traffic is still forced over the tunnel and using the DNS on the endpoint. I should have also mentioned that I enabled "IPsec Mobile Client Support" in the VPN/Ipsec page under "Mobile Clients". On this page you can define the dns settings that your vpn clients should use. Hope this helps. –  joet3ch Aug 12 '11 at 20:31
    
Yuck. It's a DSL connection I am connecting to, so bandwidth is not what you would call plentiful... It seems on Windows 7, connecting to the same Pfsense router still allows my local traffic to go through normally. I say this because I could still talk to servers that were on my local LAN and my download speeds were still in the Mb/sec range. Does this make sense to you that Win 7 behaves differently than OS X at the routing level? –  Adam Lewis Aug 12 '11 at 21:15
    
I'm not sure about Win7. Although if you check the setting for 'Provide a list of accessible networks to clients' in the mobile clients view, I wonder if that will only route the networks exposed.. –  joet3ch Aug 12 '11 at 21:27
up vote 0 down vote accepted

We were able to resolve this issue by running Shrewsoft's 2.2 Beta release that supports Mac OS X. The install directions are here. So far this seems to be working like a champ. It also allows a single configuration for both Windows and Mac users regarding the VPN configuration.

Thanks for all of the great trouble shooting tips!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.