Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a mac running a parallels virtual machine with ubunutu server and a webserver installed. I can ssh to it and navigate to the web server in the virtual machine from the mac. Once I connect to my VPN at work I can't reach the virtual machine any more. Tracerouteing to the virtual machine show it trying to go over the VPN instead of locally.

I've tried switching the virtual machine to use a NAT instead of bridging but I'm still unable to reach the web server. I've also tried to update the routing table but my networking skills are severely lacking.

How can I exclude the virtual machine's ip from the VPN so I can develop when I'm on the VPN?

Here's a snippet from netstat. is the virtual machine in bridged mode.

Routing tables

Destination        Gateway            Flags        Refs      Use   Netif Expire
default            utun0              UCS            25        0   utun0
default         UGScI           1        0     en0
default        UGScI           1        0     en1
10.211.55/24       utun0              UCS             2        0   utun0        utun0              UHW3I           0       15   utun0   3410      utun0              UHW3I           0       37   utun0   3592
share|improve this question
up vote 0 down vote accepted

What you are seeking is known as "split tunneling" which is actually frown upon from a security point of view. The following appears to be a utility which allows "split tunneling" over SSH -

Ultimately, you probably want to contact your company's IT folks, if your want to "split tunnel" while running through their VPN.

share|improve this answer
I can see how that could cause some security problems. But the virtual machine i'm trying to reach is just another process on my local machine. Wouldn't updating my local machine's routing table be able to fix it without having to modify the VPN for everyone? Or is that over-simplifying the issue? – puppybits Aug 2 '11 at 15:16
It is another resource, but its access is via the network and that will require "split tunneling" which is probably frowned upon as a "less than best" security practice. You can present your case to your IT folks, maybe they will see it your way. – user48838 Aug 2 '11 at 15:58
I tried adjusting the routing tables and the ipfw and couldn't get it working. I'll have to hope IT will allow it. Thanks for you info. It was very helpful to understand what was going on and what I was looking for. – puppybits Aug 4 '11 at 14:53
Good luck. If it is a valid business case and good protections can be in place, then it may be worth considering the exception. – user48838 Aug 4 '11 at 16:54

Your virtual machine IP is in the VPN network range So the way to access it is via the utun0 interface witch is not a very good practice.

Just give to your virtual machine an IP in the range of your local network such as : or, bridging it to the right interface.

-> Bridge the Virtual machine interface to en0 if you give to it the IP.

-> Bridge the Virtual machine interface to en1 if you give to it the IP.

share|improve this answer
I tried setting it staticly and bridging to the VPN but it didn't help. – puppybits Aug 4 '11 at 14:55
You must not bridge it to the VPN interface. You must bridge it to a local interface (en0 or en1). In your virtual machine if you want to be able to reach VPN network, the node in the VPN should be aware of your local networks. If you can't set other hosts behind the VPN or you want to make it "generic", you can masquerade all traffic with the VPN IP address. – DrGkill Aug 25 '11 at 9:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.