Native IKEv2 macOS implementation routes ALL traffic over the VPN tunnel

Question

We wanted to upgrade our existing L2TP connections to IKEv2 for connecting to our corporate servers. The problem is as follows:

With L2TP, only the assigned IP range is routed through the tunnel, because the option to "Send all traffic over VP connection" is disabled and the service order is pretty low. Here is an excerpt from the routing table:

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.123.254    UGSc           99        0     en0       
default            link#17            UCSI            0        0    ppp0       
10                 ppp0               USc             0        0    ppp0       
10.1.102.55        10.1.102.56        UH              1        0    ppp0   

With IKEv2, on the other hand, there is no such option "Send all traffic over VP connection", and the interface is not even shown under "Set Service Order". We don't want to route all internet traffic over the VPN connection, just the range that is assigned to the interface. Here is an excerpt from the routing table:

Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            link#15            UCS            60        0  ipsec0       
default            192.168.123.254    UGScI          21        0     en0       
1.2.3.4            link#15            UHW3I           0        0  ipsec0     88
10.1.102.57        10.1.102.57        UH              0        0  ipsec0       
23.97.215.12       link#15            UHWIi          20      351  ipsec0       

As you can see, not only has the IKEv2 interface become the primary interface, it has also become the primary gateway for most routes on the table (redacted here for readability). I don't know if this is a built-in macOS "feature" but it is undesirable at the very least.

Does anyone have any ideas on how to change or circumvent this behavior (either client- or server-side)?

PS We also have Windows clients that use IKEv2 without problem because the "Use default gateway on remote network" is unchecked. The server we are connecting to is a Windows Server 2016 with RRAS role installed, setup as a RADIUS client to our isolated DC-AC machine.

Answer 1

Configure IKEv2 VPN to split traffic on macOS

The following commands were tested on a Mac running macOS Monterey.

Ensure you have already successfully connected to VPN before trying any of the steps below.

Find your VPN interface name and gateway address

Before running the main commands, we need to find your VPN interface name and the gateway IP address for your home network. These values will vary depending on your home network configuration and your macOS configuration.

To find your VPN interface name Run the following command in Terminal:

netstat -i

This will give you a list of all interfaces, towards the bottom of the list, you will find an interface that begins with ipsec followed by a number, such as:

***
ipsec1     1280  <Link#27>                       109462     0    77052     0     0
ipsec1     1280  10.5.6/26    10.5.6.7           109462     -    77052     -     -
***

In my case, my VPN interface name is ipsec1.

To find your home network gateway IP address

1. Open Network settings in System Preferences
2. Select your primary home network from the left. If using a Mac connected simultaneously via ethernet and Wi-Fi, choose the ethernet connection, as it should be higher priority than Wi-Fi. You can verify this by clicking the downward arrow below the list and clicking on Service Order.
3. Click Advanced on the bottom right.
4. Locate the router IP address, this is your gateway address.

Split your network traffic

The following commands need to be run AFTER connecting to VPN. Your network configuration will automatically be reset to defaults when you disconnect from VPN, this means that you will need to re-run them EVERY time you reconnect to VPN in order to properly route your traffic.

sudo route -nv add -net 10.5.0.0/16 -interface <interface name>
sudo route change default <gateway address>

In my case, my interface name is ipsec1 and my gateway address is 10.0.0.1, so the commands are:

sudo route -nv add -net 10.5.0.0/16 -interface ipsec1
sudo route change default 10.0.0.1

You will be prompted for a password after the first command, this is your macOS admin password.