1

Short Question
Is there something I am missing when setting up a Cisco IPSec VPN connection that redirects all traffic over the VPN?

Background
When I am connected to the VPN, I can browse our company's intranet with no problems, but when I try to go out to say www.google.com it times out. Another co-worker is having the same problem on his MBP as well. The VPN client we use for our Windows machines is Shrew Soft talking to a pfSense router, which works like a champ.

System Information
Network
VPNing into a Pfsense based router

Hardware
MBP early 2008
4GB Ram
500GB 7200RPM HDD

Software
OS X 10.6.8
Bootcamp and Parallels 6: Windows 7 Pro

Improve this question
4
  • VPN can either allow this or prevent this - you need to know the details of what you asked your VPN client to do. It's entirely possible the person that set up the mac configuration didn't allow split routing. It could be by intention or by omission, but asking them is the best way out of your dilemma.
    – bmike ♦
    Aug 2, 2011 at 17:01
  • @bmike: If split routing was not enabled, would why would our Windows machines work as expected? Please do not take this a disrespectful, I honestly cannot figure out the answer to it either.
    – Adam Lewis
    Aug 2, 2011 at 18:32
  • the usual suspect is that the configuration file that windows uses is distinct and different than the one that the mac uses. Also, the mac client of the Cisco software doesn't always interpret the same file in the same way. Big headache, especially when the IT person won't listen when you have a legitimate problem. The cisco client software was always the biggest headache for me with all the versions, highly restricted dowload site, lack of public knowledge base, etc....
    – bmike ♦
    Aug 2, 2011 at 18:49
  • 1
    Or to be succinct. Split routing means the Mac software allows it. Your config has to tell the mac to keep it's default route active and just overlay the corporate IP ranges. It doesn't really matter what windows does - your mac OS needs instructions that it understands.
    – bmike ♦
    Aug 2, 2011 at 18:52

3 Answers 3

Reset to default
2

IPSec connections to Cisco routers are only allowed split routing based on the configuration of the router. I don't know what kind of router you are connecting to,b ut an example is shown here. Basically whomever is running the router would need to configure it to allow this behavior.

Improve this answer
4
  • We are not using a Cisco router for our VPN, we are using pfSense. The only configuration that would connect to it was using the Mac's IPSec Cisco connection. Is there a better IPSec client for OS X?
    – Adam Lewis
    Aug 2, 2011 at 18:34
  • I believe that Viscosity supports split tunneling with pfSense.
    – B Morin
    Aug 2, 2011 at 18:46
  • This looks pretty cool. And for $9 it will be an easy sell if it works. I will give it a try when I reboot into OS X. Thanks for the link!
    – Adam Lewis
    Aug 2, 2011 at 18:50
  • Of course with Viscosity you would need to setup your pfSense to do OpenVPN. If you have to stay with IPSec you could try IPSecuritas which is Free.
    – B Morin
    Aug 2, 2011 at 19:09
2

I'm running an ipsec endpoint with pfsense 2.0-rc2. Using the native vpn client with Mac OS 10.6 and now 10.7, internet and local lan access works fine. However all traffic travels over the tunnel so I had to add an any-any rule for ipsec traffic in the pfsense firewall settings. Hope that helps.

Improve this answer
4
  • Does the any-any rule still force traffic over the tunnel? Meaning would requests to IE: www.google.com go through the tunnel and the DNS on the endpoint then route the data back to the mac?
    – Adam Lewis
    Aug 12, 2011 at 3:42
  • Yup, the traffic is still forced over the tunnel and using the DNS on the endpoint. I should have also mentioned that I enabled "IPsec Mobile Client Support" in the VPN/Ipsec page under "Mobile Clients". On this page you can define the dns settings that your vpn clients should use. Hope this helps.
    – joet3ch
    Aug 12, 2011 at 20:31
  • Yuck. It's a DSL connection I am connecting to, so bandwidth is not what you would call plentiful... It seems on Windows 7, connecting to the same Pfsense router still allows my local traffic to go through normally. I say this because I could still talk to servers that were on my local LAN and my download speeds were still in the Mb/sec range. Does this make sense to you that Win 7 behaves differently than OS X at the routing level?
    – Adam Lewis
    Aug 12, 2011 at 21:15
  • I'm not sure about Win7. Although if you check the setting for 'Provide a list of accessible networks to clients' in the mobile clients view, I wonder if that will only route the networks exposed..
    – joet3ch
    Aug 12, 2011 at 21:27
0

We were able to resolve this issue by running Shrewsoft's 2.2 Beta release that supports Mac OS X. The install directions are here. So far this seems to be working like a champ. It also allows a single configuration for both Windows and Mac users regarding the VPN configuration.

Thanks for all of the great trouble shooting tips!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .