I set up a vpn server on VPS, using strongswan, l2tpd, and ppp. Just use PSK to do authentication and no cert.

I connect the VPN on my MAC successfully. But I noticed that all the traffic on my MAC was NOT transmitted over that VPN tunnel even when I enabled "Send all traffic over VPN connection". Does someone know why? My macOS is Sierra.

As I understand, if I connected to a VPN, the first line in the 'traceroute' should be the VPN ip, am I right?

But on my mac, it will return the same result when I do 'traceroute www.google.com' no matter with or without the VPN connection, why? Please see the result:

bash-3.2$ traceroute www.google.com
traceroute to www.google.com (, 64 hops max, 52 byte packets
 1 (  1.763 ms  1.562 ms  0.943 ms #<-- My router IP
 2 (  7.755 ms  2.452 ms  4.339 ms  #<-- My Network SP
 3  * * *
 4 (  4.465 ms (  3.195 ms (  6.833 ms
 5 (  9.057 ms (  4.872 ms (  3.335 ms
 6 (  32.817 ms * (  53.460 ms
  • 1
    We need to know what are the IP address ranges on the remote side, and are they distinct from the address ranges on your side. A VPN tunnel of any kind basically acts as a TCP/IP router or a switch. The netstat -nr command should show you your entire routing table which determines how, and through what [virtual] network interface, the traffic is being routed. – Mike Robinson Sep 14 '18 at 14:21
  • 1
    Strictly speaking, I don't actually know whether "route all traffic through the VPN" causes the software to act as a router, or as a switch. (The latter "scoops up everything," not just TCP/IP, e.g. Bonjour auto-discovery messages.) If it's a switch, you might not see it in the routing tables. I'm actually not 150% sure since I use OpenVPN all the time, and, only as a router. So, there will be slight differences that I don't routinely see. – Mike Robinson Sep 14 '18 at 14:22
  • 1
    The reason why I talked about "IP address ranges" is that, as with any router situation, the addresses in each area of the subnet must be distinct, so that a routing rule can be created everywhere which will direct the traffic to the right place. Commonly, everyone uses 192.168.0.x but "everyone" can't do that when you're routing subnets together (by any technology at all). One area might use .1.x, another .2.x and so on. – Mike Robinson Sep 14 '18 at 14:26

You must log in to answer this question.

Browse other questions tagged .