Creating Static Routes in Windows and Mac OS X When Servers and Clients Use Separate Gateways from the VPN Clients

Overview

Often, we set up VPN appliances where the connected clients are on a separate subnet and the company will have alternate internet connections and do not use this particular device as the gateway for certain servers or clients. In this case, we must manually create persistent routes in order for the VPN clients to communicate with these servers or workstations over the VPN tunnel.

The following routes should be created on the clients and servers only if you do not have an additional router you can access to include the static routes. Often in small business situations the second router is ISP owned and there's no access to create rules of this nature. If you do have a router you can add a static route to the same basic principles apply.

Essentially, you must create a route from the VPN client subnet to the VPN router's internal interface address. IE: If "Company's" Exchange server is on the subnet 10.0.1.0 and uses the gateway 10.0.1.254 but the VPN appliance is 10.0.1.1 and the VPN clients are connecting on the 10.0.100.0 subnet you must create the following routes in order for the connected VPN clients to communicate with the Exchange Server:

Windows

This has been tested on Windows 2000 - Windows 2008 R2. The "-p" makes the route persistent so if it's not it included the route will disappear after the server is restarted.


Adding the Route
Open up an elevated command prompt and type:

route add 10.0.100.0 mask 255.255.255.0 10.0.1.1 -p
                      

Select all Open in new window

Deleting the Route
Open up an elevated command prompt and type:

route delete 10.0.100.0 mask 255.255.255.0 10.0.1.1
                      

Select all Open in new window

Mac OS X

Of course this process in OS X is considerably more complicated if you need it to be persistent. We can easily create temporary routes that will clear after the machine restarts. See below.


Adding the Route
Open up the terminal and type (enter the password for the current logged in user when prompted)

sudo route add -net 10.0.100.0 -netmask 255.255.255.0 -gateway 10.0.1.1
                      

Select all Open in new window

Above will add the temporary route that can be removed by simply restarting the machine and it's a good idea to do that as a test before running through the process of creating a persistent route.
Note: All of these commands must be run within the "/System/Library/StartupIt ems" directory

1

Create a start up item called "AddVPNRoutes"

cd /System/Library/StartupItems
                      sudo mkdir AddVPNRoutes
                      cd AddVPNRoutes
                      

Select all Open in new window

2

Create a file called "AddVPNRoutes""VI" is a command line based text editor that makes it much much easier to modify files in these system directories. Here is the MAN page for the VI editor VI MAN Page

sudo vi AddVPNRoutes
                      

Select all Open in new window

Once the VI editor is open you must type i to begin insert and copy/paste the following script into the terminal window. Hit "Escape" to exit insert mode and to save and quit you must type ":wq" to write and quit:

#!/bin/sh
                      . /etc/rc.common
                      route add -net 10.0.100.0 -netmask 255.255.255.0 -gateway 10.0.1.1
                      

Select all Open in new window

3

Create a file "StartupParameters.plist"

sudo vi StartupParameters.plist
                      

Select all Open in new window

Copy/Paste the below code (after typeing i to enable insert mode)

{
                      Description = "Add Static Routes For VPN Clients";
                      Provides = ("AddVPNRoutes");
                      Requires = ("Network");
                      OrderPreference = "None";
                      }
                      

Select all Open in new window

Type Esc and :wq to exit insert mode and to write and quit.

4

You must change the permissions on the .plist file

sudo chmod 755 AddVPNRoutes StartupParameters.plist
                      

Select all Open in new window

5

Reboot your computer and verify the route with netstat -nr

Deleting the Route
Simply remove the files we've just created from "/System/Library/StartupIt ems"

sudo rm -r /System/Library/StartupItems/AddVPNRoutes
                      

Select all Open in new window

Notes

Sources