Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a router-router IPSEC VPN and am struggling to get a specific ip to go through the vpn instead of out to the internet. How does my router know whether to send traffic via the internet connection or through the vpn? The router on this side is running pfSense.

If I tracepath a local address on the vpn'd network it works and I get:

1:  localghost.local (                        0.109ms pmtu 1500
1: (                 0.401ms 
1: (                 0.379ms 
2: (                       58.295ms 
3: (                               49.900ms reached

where is on one side of the vpn and on the other.

But when I try to it doesn't go down the vpn:

1:  localghost.local (                        0.117ms pmtu 1500
1: (                  0.415ms 
1: (                  0.385ms 
2: (                  0.414ms pmtu 1492
2: (             38.651ms 
share|improve this question

Traffic that matches your SPD (local and remote subnets as defined in your IPsec connection(s)) goes through the VPN, regardless of your routing table. Anything that doesn't, won't. Change your IPsec config so it matches what needs to go across. Or switch to OpenVPN, which is easier to deal with from a routing perspective since it uses the routing table. Refer to the pfSense book for details on either of those scenarios.

share|improve this answer

I don't known pfSense, but what you need is add a routing rule on both routers, so each other subnet will be known by other router.

Try to follow this tutorial, maybe it can help you.

share|improve this answer

How does my router know whether to send traffic via the internet connection or through the vpn?

With routes; you can do this from pfsense's Static Routes menu.

You need to have a route in place that tells your router where to forward packets to: either a host on the same network or another router that knows where to forward the packets to, and so on, until it reaches it's destination.

However, is not a RFC1918 private address, so unless this is just an example IP for ServerFault, you likely don't have a route for this on either router besides the default route, which would be your next-hop gateway given to you by your ISP.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.