How do I send traffic to specific IP addresses through VPN and others directly to the internet?

Question

I am running Windows 7 and using the Cisco VPN adapter to connect to a private network where I access resources starting with the IP address 172..

My problem is that when connected to the VPN all external traffic is routed through the VPN. I want to set things up so only certain IP addresses go through the VPN and everything else goes out over the local adapter and out to the internet as normal.

How?

Answer 1

In Vista:

Go into the Control Panel and click the “Network and Sharing Center” icon.

On the left panel of the resulting screen you should see a link, “Manage network connections.” Click it.

The next screen will have icons for all of your connections. There should be one for your VPN. Right-click it and select “Properties” from the menu.

In the “Properties” screen, click the “Networking” tab and then select “Internet Protocol Version 4? and click the “Properties” button.

Click the “Advanced” button. This will bring up a new window where you can un-check “Use default gateway on remote network.”

OK out to save everything.

Answer 2

The term you're looking for is called a "split tunnel" - this features in configured and controlled by the VPN hardware itself, not on the VPN client software.

Cisco has a good example on how to configure a split tunnel available, but here's a summary for how to configure a PIX or ASA:

access-list Split_Tunnel_List standard permit 10.0.1.0 255.255.255.0
group-policy hillvalleyvpn attributes
  split-tunnel-policy tunnelspecified
  split-tunnel-network-list value Split_Tunnel_List
  tunnel-group hillvalleyvpn general-attributes
  default-group-policy hillvalleyvpn

Answer 3

This is a settings on the VPN peer that is pushed to the Cisco VPN Client.
The (very) short answer is to configure "Split Tunneling" on the VPN peer.

On VPN3000, either set "Tunnel Everything" & "Allow the network in the list to bypass the tunnel" and add things like 192.168.*, etc... (in fact, as you want to access all internet, you need to add anything except 172. it can be a nightmare but it's good to allow access only to local ressource) as "Split Tunneling Network List" or (much easier) set "Only tunnel in the list" and choose the network with your IP in 172.* in the network list.
On ASA/PIX, it's almost the same, use the ASDM and set "Exclude Network List Below" and add things like 192.168.*, etc... in the network list or set "Tunnel Network List Below" then choose the network with your IP in 172.* in the network list.

There is a good documentation on Cisco website:

• See this for VPN3000.
• See this (everything in the tunnel except local lan access) and this (only a set of network on the tunnel) for ASA/PIX.