1
I work in a remote office, and in order to connect to corporate resources, we have to log into a software VPN. Once authenticated, this VPN then gets an IP address and configures its gateway as the default gateway, thus routing all traffic into the corporate network. Then in order to be able to access any corporate resources (wiki, git, etc) we have to use the corporate proxy server. The problem there is the proxy filters are significant, blocking access to many commonly-used sites, and the throughput ranges from lousy to awful (downloading a 600MB image from docker.io can take >20 minutes over the VPN but <1 minute while off the VPN).
I want to be able to bypass the VPN (and specifically the default route into the VPN) whenever I want. What (I think) I want is a local proxy server that routes all traffic over the local network gateway, NOT the VPN gateway. That way I avoid managing network/domain by-pass configurations (which I've already attempted to do, and there are at least 200 networks/IPs, so it's way too much to manage) and just use the local proxy only when I'm connected to the VPN and explicitly need to bypass it entirely. How can I accomplish this?
The "right answer" is to use a split-tunnel configuration on the VPN so that it identifies only traffic to VPN protected endpoints for tunneling. This would be along the line of setting your default route to be the VPN for the network(s) that are company-private and leaving your ISP route for everyone else (read: local & internet). This should be setup in the VPN policy, so it should be done by corporate. They may not do it becasue its hard, or they may want to monitor all traffic (policy/compliance reasons are common for non-split-tunnels). – Ruscal – 2017-04-25T16:53:36.363
If you are trying to setup a local proxy (and assuming this isn't a breach of policy, but that corporate has some other [unknown?] reason for not configuring the VPN policy to split) then you'll need to list what your current routing policies are. I would suspect that no matter what you will have to enumerate all the VPN networks since it sounds like corporate policy is 0.0.0.0/0 to do a full catch-all. In the end, no proxy and just writing good split-tunnel routes would be easier (and if lucky you can get corporate to do it-try arguing excess consumption of expensive ISP connection at HQ) – Ruscal – 2017-04-25T16:58:21.027
>
Just that one network for VPN? Thats fairly easy. What OS are we talking about? If I have an image handy I'll run a quick command test and drop that as an answer. But basically you'll remove the VPN default route and replace it with a proper split-route. Make that a script that you run right after the VPN connection and Bob's your uncle. – Ruscal – 2017-04-25T18:06:14.637
MacOS 10.12.4. What else do you need to know? – DrStrangepork – 2017-04-25T18:16:03.170