1

I have a virtual machine running Windows Server 2008 R2 that is used as a build machine for our projects.

To run the build, the vm must be connected to a VPN (using a GlobalProtect client). The problem is that when the VPN is connected, the VM sends all the data through the VPN and becomes isolated from our local network.

Is it possible to add a secondary network adapter to the vm and have both connections (vpn and local) accessible at the same time? If so, how should I do that?

Currently the VM only has one network adapter configured as NAT.

Thanks

2
  • What version of vmware are you running? Why can't you configure a split-tunnel at your firewall so ALL the traffic does not go out the tunnel?
    – Citizen
    Jun 3, 2016 at 17:18
  • I'm running the VMware Workstation 12.1. I don't have the permission to set the firewall.
    – dijeferson
    Jun 3, 2016 at 18:11

2 Answers 2

0

You don't need two NICs for this. What you do need is to configure a route to your local network after bringing up the tunnel. Note that some VPN software (not sure about GlobalProtect) will detect this type of trickery and prevent it or disconnect.

You may want to talk to your GlobalProtect administrator about setting up split tunneling for your purposes.

In order to attempt to set up the split tunneling from your end, you can try to use the route command in Windows to add a route that would override the default route that is installed by GlobalProtect. However, exactly how that would be accomplished, and indeed if it can be accomplished will depend on whether GlobalProtect will do anything to stop you from doing this.

As an example, if your machine is on the local 192.0.2.0/24 subnet, with an IP address of 192.0.2.10, and the machine you're trying to reach is 192.0.2.20, you can add the following command on the command line:

route add 192.0.2.20 192.0.2.10

When looking in "route print" you should see an entry like this:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
....
  192.0.2.20       255.255.255.255         On-link         192.0.2.10   306

If the network you are trying to reach is on a different subnet, instead enter the gateway address of your network as the last argument to the route command.

You will probably need to execute this after bringing up the GlobalProtect tunnel.

3
  • Is it possible to setup split tunneling just within the vm? I mean, I don't have the permission to change my network firewall and the globalprotect vpn (it's managed by a 3rd party)
    – dijeferson
    Jun 3, 2016 at 18:13
  • Yes, it is possible. I have edited the post to illustrate how this might happen. However, I will repeat that it's possible that the VPN software will detect this kind of subversion of its policies and take action. I don't know what GlobalProtect does in this scenario, so you might still need to reach out to your third party. Jun 5, 2016 at 16:45
  • I tried it and looks like the vpn app doesn't block it. It worked exactly how i wanted, now I can let the vpn always-on and continue to connect to the rest of the network! Thanks a lot mate! Cheers!
    – dijeferson
    Jun 6, 2016 at 18:33
0

If you can't setup a split tunnel, add a NIC to the guest

You can add multiple NIC's to the guest operating system. One NIC for the tunnel and another for LAN access. You may get some strange routing issues if your VPN tunnel has a quad-zero route bound to it though.

The scenario would be ALL traffic goes out the tunnel EXCEPT LAN traffic on the 2nd NIC. IF you don't put a DG on the LAN NIC you may get what you want, unless Internet traffic through the new 2nd NIC is a desirable component of adding it.

1
  • Just a question: The vpn client does not create a vpn connect, but a virtual nic, so the "use default gateway on remote network" is not available. How should I proceed? If I create a second nic, how to force the traffic to nic #1 or #2 ?
    – dijeferson
    Jun 3, 2016 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .