<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>
<div>Hi Ben,</div><div><br></div><div>In your search for a cleaner way, almost anything will probably be cleaner than the default activity, which seems to be to add an individual route for every other IP address you try to connect to. After a minute or so, this is the top of my routing table :</div><div><br></div><div>Destination Gateway Flags Refs Use Netif Expire</div><div>default utun0 UCS 16 0 utun0</div><div>default 192.168.1.10 UGScI 12 0 en1</div><div>10.66.0.2 utun0 UHWIi 25 211 utun0</div><div>10.66.2.2 utun0 UHW3Ii 0 9 utun0</div><div>10.66.3.78 utun0 UHW3Ii 0 9 utun0</div><div>10.66.4.147 utun0 UHW3Ii 0 9 utun0</div><div>10.66.54.21 utun0 UHWIi 2 49 utun0</div><div>10.100.255.1 10.100.255.1 UH 1 36 utun0</div><div>17.72.255.11 utun0 UHWIi 1 3 utun0</div><div>65.55.223.14 utun0 UHW3Ii 0 3 utun0</div><div>93.97.103.209 utun0 UHW3Ii 0 6 utun0 8</div><div>111.221.74.14 utun0 UHW3Ii 0 3 utun0 3</div><div>111.221.74.27 utun0 UHW3Ii 0 6 utun0</div><div>127 127.0.0.1 UCS 0 0 lo0</div><div>127.0.0.1 127.0.0.1 UH 4 22033 lo0</div><div>157.55.56.145 utun0 UHW3Ii 0 3 utun0</div><div>157.55.130.143 utun0 UHW3Ii 0 3 utun0</div><div>157.55.130.157 utun0 UHWIi 1 2 utun0</div><div>157.55.235.142 utun0 UHW3Ii 0 3 utun0</div><div>157.56.52.15 utun0 UHW3Ii 0 3 utun0</div><div>...</div><div>...</div><div><br></div>The original default route is still there (192.168.1.10), but the other one comes first, so gets used.<div>Then every other host I connect to whether on a private or public subnet, gets a new entry. I don't think there is anything that times them out either. So after a few hours, you're going to have a massive routing table and I would expect the machine would slow down a bit.</div><div><br></div><div>My organisation are 100% mac based and we wanted a split VPN with direct internet access and access to a private network over VPN. I have a StrongSwan config that does that fine on Windows/Linux but everything goes over the VPN on OSX. :-(</div><div>You might want to consider tunnelblick and OpenVPN instead of IPsec VPNs for OSX. Unfortunately that's not available for iPhone/iPad users.</div><div><br></div><div>If the Cisco extensions could help, then I'll add a +1 to that feature request ;-)</div><div><br></div><div>Max<br><div>
<br><BR></div><br><div><div id="SkyDrivePlaceholder"></div>> From: martin@strongswan.org<br>> To: insyte@gmail.com<br>> Date: Fri, 24 Aug 2012 10:44:05 +0200<br>> CC: users@lists.strongswan.org<br>> Subject: Re: [strongSwan] Strongswan + OS X (Cisco IPsec) + default route?<br>> <br>> Hi Ben,<br>> <br>> > I've found a few hacks that require installing custom applescript to<br>> > override the default route, but I'm hoping there's a cleaner, better<br>> > way. Any suggestions?<br>> <br>> The best way to set up split tunneling with OS X is to use the Cisco<br>> Unity extensions. These allow you to define (on the responder) which<br>> subnets to include into the tunnel, but we currently don't support them.<br>> We might bring support for it in a future release, but not sure yet when<br>> this will happen.<br>> <br>> Regards<br>> Martin<br>> <br>> <br>> _______________________________________________<br>> Users mailing list<br>> Users@lists.strongswan.org<br>> https://lists.strongswan.org/mailman/listinfo/users<br></div></div> </div></body>
</html>