0

We wanted to upgrade our existing L2TP connections to IKEv2 for connecting to our corporate servers. The problem is as follows:

With L2TP, only the assigned IP range is routed through the tunnel, because the option to "Send all traffic over VP connection" is disabled and the service order is pretty low. Here is an excerpt from the routing table:

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.123.254    UGSc           99        0     en0       
default            link#17            UCSI            0        0    ppp0       
10                 ppp0               USc             0        0    ppp0       
10.1.102.55        10.1.102.56        UH              1        0    ppp0   

With IKEv2, on the other hand, there is no such option "Send all traffic over VP connection", and the interface is not even shown under "Set Service Order". We don't want to route all internet traffic over the VPN connection, just the range that is assigned to the interface. Here is an excerpt from the routing table:

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            link#15            UCS            60        0  ipsec0       
default            192.168.123.254    UGScI          21        0     en0       
1.2.3.4            link#15            UHW3I           0        0  ipsec0     88
10.1.102.57        10.1.102.57        UH              0        0  ipsec0       
23.97.215.12       link#15            UHWIi          20      351  ipsec0       

As you can see, not only has the IKEv2 interface become the primary interface, it has also become the primary gateway for most routes on the table (redacted here for readability). I don't know if this is a built-in macOS "feature" but it is undesirable at the very least.

Does anyone have any ideas on how to change or circumvent this behavior (either client- or server-side)?

PS We also have Windows clients that use IKEv2 without problem because the "Use default gateway on remote network" is unchecked. The server we are connecting to is a Windows Server 2016 with RRAS role installed, setup as a RADIUS client to our isolated DC-AC machine.

  • There seems no way to configure split tunneling with IPSec/IKEv2 using only native macOS settings. We use the free software IPSecuritas to accomplish this task. – not2savvy May 30 at 9:17

You must log in to answer this question.

Browse other questions tagged .