0

We are running Snow Leopard Server and have setup VPN here and external users can pretty easily connect to it. We want to make it even easier though. The one option that I've spent several hours trying to get to work is "VPN on demand", which you of course can find in the 'Advanced' pane of the VPN network options.

We recently tried it again after one client was updated to Lion but got the same result. That is, if one tries to navigate to an address that resolves to our server, it does not automatically connect to the VPN.

Has anyone managed to get this to work? Is there a trick to it? I've seen several threads on other sites with the same problem but no answers.

Improve this question
1

2 Answers 2

Reset to default
3

For me, vpn-on-demand works if the following conditions are met:

  • use a named configuration for the VPN interface (not default)
  • the triggering domain must be a hostname that can NOT be resolved using public DNS
  • vpn connection is only triggered by Safari (and maybe Mail), but not e.g. afp, vnc, smb connections let alone cli triggered connections like ssh
Improve this answer
7
  • Thanks Beely... This answer is correct. I've tested on OSX 10.7.5. Created test configuration named 'testing'. Added a junk domain to the VPN on Demand section "this_feature_is_not.that_useful.com". Tried to load the site in safari, and the vpn connect. I disconnect the vpn and tried loading the domain in Chrome and the VPN did NOT connect. Unfortunately, this feature isn't quite as feature-ful as I'd hoped.
    – user36878
    Commented Dec 18, 2012 at 17:55
  • Cheers, saibot/bneely. I haven't actually verified but if it works for Patrick, great. I'm with Patrick - doesn't seem very useful if only works in Safari.
    – John Stone
    Commented Jan 7, 2013 at 10:16
  • VPN on demand also works for Apple's Server Admin utility (version 10.7 355) on Mac OS X 10.7.5
    – Pro Backup
    Commented Jul 30, 2013 at 13:55
  • To create a triggering domain that must be a hostname that can NOT be resolved using public DNS, I need to set "host.domain.tld" as "RT-N56U's Domain Name:" in section "LAN - DHCP Server" of our Asus RT-N56U router that hosts the VPN server. Each device (whether it uses DHCP or not) can be added as "Manual Assignment" at the bottom of the same configuration page. Now each device at the remote network resolves as "device-its-assigned-host-name.host.domain.tld" on the DNS resolver of the Asus router. Next is to configure *.host.domain.tld as trigger domain in the local VPN client config.
    – Pro Backup
    Commented Jul 30, 2013 at 15:31
  • Don't choose ".local" as tld. A ".local"-tld doesn't seem to trigger the VPN-on-demand functionality.
    – Pro Backup
    Commented Jul 30, 2013 at 16:24
1

As I've read many topic about VPN on Demand seems like not work. then i was using route to manual routing for VPN Tunnel as interface name ppp0

below is example for manual route to Pandora IP Address

sudo route add -net 208.85.40.0/24 -interface ppp0
Improve this answer
5
  • Forgive me as I don't really know what I'm talking about. The interface name 'pp0' you refer to, where is that set? I take it this is not the same as the VPN "Service Name" that is set in the Network Settings dialog? If i use my service name, it complains that it doesn't resolve to an IP address. Your answer looks promising though!
    – John Stone
    Commented Aug 2, 2011 at 4:55
  • When you connect to VPN. new interface will be appears in ifconfig. My VPN interface name is ppp0 then just manual add route with above command with ip address range of destination host. If you want to find destination host ip address. just ping domainname.com to resolve it.
    – meddlesome
    Commented Aug 2, 2011 at 7:17
  • Thanks for the reply. So sure enough, if I manually connect to the VPN, ppp0 resolves just fine and that command seems to execute without error. However, it doesn't seem to do anything with automatically reconnecting to VPN when necessary. Is your suggested 'route add' command just for routing certain traffic to an already connected VPN?
    – John Stone
    Commented Aug 2, 2011 at 8:15
  • exactly, It's need to connected VPN before add route. If you want to automatic to reconnect, You need write some shell script.
    – meddlesome
    Commented Aug 2, 2011 at 9:22
  • Ah thanks. Having it automatically connect to VPN only when needed is my whole goal. I already am able to route the traffic that I want through the VPN when I'm manually connected so don't think this command actually gets me any closer. Or am I missing something?
    – John Stone
    Commented Aug 2, 2011 at 9:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .