Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I connect to a client's network via the Cisco VPN client. Once I connect, my local network access (including internet access) is disabled.

Is there a way to get around this, besides for them to change something on their end (because that will not happen)?

share|improve this question
up vote 2 down vote accepted

You could set up a virtual machine (using virtualbox or something similar), and use that to connect to the client, leaving your main connection open to the internet.

share|improve this answer
I was able to get this to work with Windows 7 and running VirtualPC in XP mode. – Even Mien Aug 10 '09 at 12:53

Pip is correct about the remote default gateway. This is a specific choice made by the VPN administrators. It is sometimes for connectivity reasons -- ie connecting to non-local systems across a corporate network -- and it is sometimes sold as a "security" feature, in that systems connected to the VPN either cannot contact the internet or must do so through the corporate internet presence where presumably such activity can be logged.

I am not aware of any circumstances where fiddling with the local routing table gets any lasting effects -- you would probably have to write a script to to repeat the fiddling during each connection to the VPN.

Brent's solution is perhaps the easiest. I personally have a VM for each customer network just so I can be connected to multiple VPNs (mostly SSL-based, but some Cisco clients too) at the same time without having to worry about conflicts.

share|improve this answer

This is probably disabled by the VPN policy and is called dual-homing. If this is the case, then it may not be possible to get around short of using a separate machine -- even a virtual machine will be trapped in the tunnel.

Dual-homing is usually disabled to prevent your machine from become a gateway for the transmission of virus, hacking or other nasty bits.

share|improve this answer

I have a similiar issue.

My current work-around is to use a different laptop, which uses the original internet connection with no problems.

From this I would guess that a virtual machine connecting to the client machine, and having it's network settings modified, wouldn't impact the base machine.

share|improve this answer

Try going into Advanced Mode (Ctrl-M), go to the Options menu, and uncheck Stateful Firewall (Always On). This has sometimes worked for me.

share|improve this answer
Your VPN connection settings, including the Stateful Firewall, are managed on the VPN side. Generally, while the VPN client lets you uncheck this, it won't have any affect if it's a component managed on the VPN side. – GregD Jun 10 '09 at 19:14

I know this is because your PC has to change its default gateway to be a valid gateway on the remote part of the VPN. If it didn't do this then you would be un-able to contact any device through the VPN that wasn't on your local subnet. You should be able to keep access to your local subnet as long as the address range in use doesn't clash with any address range on the VPN.
You might be able to fiddle with your IP settings, set up static routes on your PC so that internet addresses are routed through your local default gateway and only the address range on the remote network gets routed through the VPN.
When I have tried this on a work laptop I didn't manage it though. Hopefully someone else here will have a more solid answer for you. Or your Google Fu might be better than mine was. :)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.