Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

We are running Snow Leopard Server and have setup VPN here and external users can pretty easily connect to it. We want to make it even easier though. The one option that I've spent several hours trying to get to work is "VPN on demand", which you of course can find in the 'Advanced' pane of the VPN network options.

We recently tried it again after one client was updated to Lion but got the same result. That is, if one tries to navigate to an address that resolves to our server, it does not automatically connect to the VPN.

Has anyone managed to get this to work? Is there a trick to it? I've seen several threads on other sites with the same problem but no answers.

share|improve this question
    
Not sure how I didn't find the thread before, but there is a really similar one on superuser at superuser.com/questions/106661/how-to-vpn-on-demand-mac-os-x Unfortunately even after creating a non default config as it suggests, still not working for me. –  John Stone Aug 3 '11 at 8:29
add comment

2 Answers

up vote 3 down vote accepted

For me, vpn-on-demand works if the following conditions are met:

  • use a named configuration for the VPN interface (not default)
  • the triggering domain must be a hostname that can NOT be resolved using public DNS
  • vpn connection is only triggered by Safari (and maybe Mail), but not e.g. afp, vnc, smb connections let alone cli triggered connections like ssh
share|improve this answer
    
Thanks Beely... This answer is correct. I've tested on OSX 10.7.5. Created test configuration named 'testing'. Added a junk domain to the VPN on Demand section "this_feature_is_not.that_useful.com". Tried to load the site in safari, and the vpn connect. I disconnect the vpn and tried loading the domain in Chrome and the VPN did NOT connect. Unfortunately, this feature isn't quite as feature-ful as I'd hoped. –  user36878 Dec 18 '12 at 17:55
    
Cheers, saibot/bneely. I haven't actually verified but if it works for Patrick, great. I'm with Patrick - doesn't seem very useful if only works in Safari. –  John Stone Jan 7 '13 at 10:16
    
VPN on demand also works for Apple's Server Admin utility (version 10.7 355) on Mac OS X 10.7.5 –  Pro Backup Jul 30 '13 at 13:55
    
To create a triggering domain that must be a hostname that can NOT be resolved using public DNS, I need to set "host.domain.tld" as "RT-N56U's Domain Name:" in section "LAN - DHCP Server" of our Asus RT-N56U router that hosts the VPN server. Each device (whether it uses DHCP or not) can be added as "Manual Assignment" at the bottom of the same configuration page. Now each device at the remote network resolves as "device-its-assigned-host-name.host.domain.tld" on the DNS resolver of the Asus router. Next is to configure *.host.domain.tld as trigger domain in the local VPN client config. –  Pro Backup Jul 30 '13 at 15:31
    
Don't choose ".local" as tld. A ".local"-tld doesn't seem to trigger the VPN-on-demand functionality. –  Pro Backup Jul 30 '13 at 16:24
show 2 more comments

As I've read many topic about VPN on Demand seems like not work. then i was using route to manual routing for VPN Tunnel as interface name ppp0

below is example for manual route to Pandora IP Address

sudo route add -net 208.85.40.0/24 -interface ppp0
share|improve this answer
    
Forgive me as I don't really know what I'm talking about. The interface name 'pp0' you refer to, where is that set? I take it this is not the same as the VPN "Service Name" that is set in the Network Settings dialog? If i use my service name, it complains that it doesn't resolve to an IP address. Your answer looks promising though! –  John Stone Aug 2 '11 at 4:55
    
When you connect to VPN. new interface will be appears in ifconfig. My VPN interface name is ppp0 then just manual add route with above command with ip address range of destination host. If you want to find destination host ip address. just ping domainname.com to resolve it. –  meddlesome Aug 2 '11 at 7:17
    
Thanks for the reply. So sure enough, if I manually connect to the VPN, ppp0 resolves just fine and that command seems to execute without error. However, it doesn't seem to do anything with automatically reconnecting to VPN when necessary. Is your suggested 'route add' command just for routing certain traffic to an already connected VPN? –  John Stone Aug 2 '11 at 8:15
    
exactly, It's need to connected VPN before add route. If you want to automatic to reconnect, You need write some shell script. –  meddlesome Aug 2 '11 at 9:22
    
Ah thanks. Having it automatically connect to VPN only when needed is my whole goal. I already am able to route the traffic that I want through the VPN when I'm manually connected so don't think this command actually gets me any closer. Or am I missing something? –  John Stone Aug 2 '11 at 9:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.