Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am deploying a set of computers to a diverse set of geographical locations. However, I still need to be able to ssh into them to do updates.

Once deployed, I would like all the standard internet traffic (email, web pages, ..) to not go through the VPN. However, I would like SSH to go through the VPN.

How can this be set up?

share|improve this question
You want to ssh from a central location through the tunnel to the internal IP-addresses of the clients? – Alexander Janssen Oct 5 '12 at 17:35
yes, I want to be able to ssh into the clients from a central location – Scoop Oct 5 '12 at 17:40
And what VPN-software are you using? Because you describe a simple and plain regular case of Split Tunneling. Edit: I just mean: Just don't set the default-route over your new tunnel-interface as soon as the client establishes the VPN-connection. Just propagate the necessary routes so that the clients can reach the internal networks. – Alexander Janssen Oct 5 '12 at 17:44
that looks interesting. I'm using PPTP. Could you explain a little more about what you said after the edit. – Scoop Oct 5 '12 at 18:01
Sorry, I can't help you with PPTP, I personally never used it. (although my company just migrated to OpenVPN because PPTP was considered inherently insecure in some implementations and configurations) – Alexander Janssen Oct 5 '12 at 18:09
up vote 1 down vote accepted

Should be easy enough - presume these are win7 clients as you talk about pptp and that's windowsy. It's a split VPN, the important bit is to NOT use a default gw on the VPN net. It's on "advanced settings" on your PPTP connection profile.

See here for how to set it up:

Once you are happy, you can switch to L2TP, which windows supports in the same framework as PPTP but isn't insecure by design, but i'd say "get it working, then make it good" :)

share|improve this answer
it is on debian – Scoop Oct 5 '12 at 21:16
You could probably use something like openvpn then - same principle applies, in fact IIRC OpenVPN works that way by default. – Tom Newton Oct 6 '12 at 19:24

If you're using PPTP and your machine is Windows XP/7, it's as easy as unchecking "use default gateway on remote network" in your Advanced properties of your PPTP connection. You can add DNS suffix if you'd like, but if they're just standalone workstations, you likely will hit them up by IP address.

share|improve this answer
it is on debian – Scoop Oct 5 '12 at 21:15
That would've been really helpful as a detail in your question. – gravyface Oct 6 '12 at 21:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.