# Add routes for split tunnel after networkmanager-vpnc

## Faraclas

After my VPN connection is established, I would like to add the routes for split tunneling so all internet traffic will go out my normal interface (very fast) and only VPN traffic will go out the VPN connection.

I did check the box for NetworkManager to do this for me but it seems not to be working.  When I was doing this in OSX, I used to run this script after connecting to the VPN and it did the trick wonderfully.  I've read a bunch on how to do this in linux but I am not really understanding what is going on. [which is probably the bulk of my issue].

```
#!/bin/bash

if [[ $EUID -ne 0 ]]; then

    echo "Run this as root"

    exit 1

fi

route -nv add -net 130.164.0.0 -interface utun0

route -nv add -net 10.0.0.0 -interface utun0

route change default 192.168.0.1
```

Otherwise, here is what is going on, as far as I can tell.

System on boot

Initial resolv.conf

```
# Generated by resolvconf

nameserver 192.168.0.1
```

```
# netstat -r

Kernel IP routing table

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

default         192.168.0.1     0.0.0.0         UG        0 0          0 enp16s0

default         192.168.0.1     0.0.0.0         UG        0 0          0 wlp6s0

192.168.0.0     *               255.255.255.0   U         0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 wlp6s0
```

```
# tracepath www.google.com

 1?: [LOCALHOST]                                         pmtu 1500

 1:  192.168.0.1                                           0.282ms 

 1:  192.168.0.1                                           0.187ms 

 2:  rs-204-15-87-1-0001.broadweave.net                    0.482ms 

 3:  no reply

 4:  10.1.248.1                                           10.802ms 

 5:  97.75.178.101                                         1.033ms 

 6:  ip65-46-63-49.z63-46-65.customer.algx.net             2.457ms 

 7:  vb1611.rar3.sanjose-ca.us.xo.net                     22.277ms asymm  9 

 8:  ae0.cir1.sanjose2-ca.us.xo.net                       18.873ms 
```

System after VPN connection

/etc/resolv.conf

```
# Generated by NetworkManager

search amer.corp.natinst.com natinst.com

nameserver 130.164.12.30

nameserver 130.164.44.25

nameserver 192.168.0.1
```

Note1: It seems that NetworkManager turned on the WiFi interface wlp6s0 when the VPN connected.  I dont think this is a problem

Note2: the netstat -r command takes a significant amount of time to run whereas before it was immediate

```
# netstat -r

Kernel IP routing table

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

default         192.168.0.1     0.0.0.0         UG        0 0          0 enp16s0

default         192.168.0.1     0.0.0.0         UG        0 0          0 wlp6s0

130.164.30.0    *               255.255.255.0   U         0 0          0 tun0

130.164.30.0    *               255.255.255.0   U         0 0          0 tun0

130.164.141.21  192.168.0.1     255.255.255.255 UGH       0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 wlp6s0
```

Note: The tracepath also is taking a VERY long time to execute in this case

```
# tracepath www.google.com

 1?: [LOCALHOST]                                         pmtu 1500

 1:  192.168.0.1                                           0.268ms 

 1:  192.168.0.1                                           0.213ms 

 2:  rs-204-15-87-1-0001.broadweave.net                    0.501ms 

 3:  no reply

 4:  10.1.248.1                                            4.872ms 

 5:  97.75.178.101                                         7.226ms 

 6:  ip65-46-63-49.z63-46-65.customer.algx.net             2.475ms 

 7:  vb1611.rar3.sanjose-ca.us.xo.net                     19.162ms asymm  9 

 8:  ae0.cir1.sanjose2-ca.us.xo.net                       18.944ms 

 9:  no reply

10:  no reply
```

Problem: Even though it says VPN connected, I cannot actually see anything on the remote [VPN] Network.

Next Step, Connect with vpnc directly using:

```
vpnConnect() {

   echo "Connecting to NI-VPN";

   sudo vpnc /etc/vpnc/niVPN.conf;

   echo "/etc/resolv.conf";

   cat /etc/resolv.conf;

}
```

 *Quote:*   

> $ vpnConnect 
> 
> Connecting to NI-VPN
> 
> Connect Banner:
> ...

 

Note1: Now I can see the resources on the VPN network just fine.

Note2: netstat -r responds immediately

```
# netstat -r

Kernel IP routing table

Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface

default         *               0.0.0.0         U         0 0          0 tun0

default         192.168.0.1     0.0.0.0         UG        0 0          0 enp16s0

130.164.141.21  192.168.0.1     255.255.255.255 UGH       0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 enp16s0

192.168.0.0     *               255.255.255.0   U         0 0          0 enp16s0
```

But all of the traffic is going out the VPN interface...

```
# tracepath ww.google.com

 1?: [LOCALHOST]                                         pmtu 1412

 1:  mp2-152-4-v-vpn-public.natinst.com                   40.435ms 

 1:  mp2-152-4-v-vpn-public.natinst.com                   41.186ms 

 2:  mp2-152-7-g-gw-vlan-550.amer.corp.natinst.com        40.951ms asymm  5 

 3:  no reply

 4:  mp3-1n14-d4-n-gw-vlan-541.amer.corp.natinst.com      41.727ms asymm  5 

 5:  mp3-1n14-d1-n-fw-g-1-2-541.amer.corp.natinst.com     45.926ms 

 6:  mp3-1n14-d4-n-gw-vlan-588.amer.corp.natinst.com      69.919ms 

 7:  130.164.4.35                                         45.060ms 

 8:  13.gigabitethernet3-0-2.gw3.aus4.alter.net           51.788ms 

 9:  0.ae2.xl4.dfw7.alter.net                             53.498ms asymm 12 

10:  tengige0-7-0-3.gw4.dfw13.alter.net                   54.052ms asymm 13 
```

Although I really would like to get networkmanager-vpnc working properly, I am not sure if this is the best thing to persue.  Instead, If I can redo the routing properly after using the script, that would be great.

Thanks for the help![/code]

----------

## Faraclas

Hey guys, I'm still stumped on this.  Can anyone help me convert that OSX script to work in linux?

----------

