We are dealing with a badly configured VPN connection from a vendor, which set up the default gateway but doesn't route traffic anywhere beyond their VPN zone.

I managed to do some ad-hoc routing to configure a computer in a way that it can reach the vendor's VPN, our local network as well as the internet. I then tried to turn this into a script, but that failed since the interface number of the VPN changes on every connection.

Is there a way in Windows XP and/or Windows 7 to configure custom routing on the client side of a VPN connection? What I would like to do is to have a script running just after the connection comes up that changes the routing table (similar to an ifup script on UNIX).


I've used Connection Manager Administration Kit (CMAK) to deploy Windows XP compatible VPN connectoids, or whatever they're called a few times; I believe the newer versions (the ones on Windows 2008 Server) support Windows 7 as well. Works great, you can definitely set custom routes (as well as alot of other items) and it doesn't require Windows Routing and Remote Access either (I setup some L2TP/IPSec clients via Astaro).

Only caveat is that I believe it requires Windows 2008 (or 2003, if you don't need Win7 clients; double-check that though) Server. Docs in the link (above) says "Windows 7" but I'm not sure if that's referring to the client or where you can run CMAK.

  • Having the right term I found this: windowsecurity.com/articles/… -- and yes, it looks like it does what we need. Thanks for that. The thing I wonder is wether I can do the same thing the tool does manually. – Peter Becker Sep 14 '10 at 1:25
  • I'm sure you could writing a script with route commands and using the rasdialer.exe but honestly, why bother? It's a pretty painless "Next, Next, Next" Wizard kind of thing and it's solid; I've deployed it to dozens of users. – gravyface Sep 14 '10 at 1:30
  • We actually tried CMAK but then found that you need a 32bit server installation to create configurations for 32bit clients. With only 64bit servers and mostly 32bit clients that brought an end to the story. We ended up working around it with an Apache reverse proxy in our network since only HTTP access was required. – Peter Becker Jan 26 '11 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.