In order to access the enterprise intranet remotely, we have to use the Cisco AnyConnect VPN client. We're allowed to install it on any personal machines, and they provide downloads and instructions for Windows, Mac and Linux. This works fine except for the routing table configurations they provide.

They route everything except the and (that's not a typo) subnets over the VPN. This is baked into the client and I can't find a way to change it. All I really need are ports 80, 443 and 22 for a small Class C subnet routed through the VPN tunnel.

Is there a way to change the routing table configurations? Barring that, would it be possible to setup a linux VM with an HTTP/S proxy and SSH that route over the VPN tunnel?

  • I don't understand the problem you're trying to solve. Can you restate your question? – joeqwerty Jul 25 '16 at 16:01
  • 1
    @joeqwerty : The VPN is pushing almost all traffic down the VPN tunnel unnecessarily. So any internet bound traffic is being pushed through the VPN tunnel and private network addresses that aren't valid on the intranet. This is a huge bottleneck since the VPN throughput is severely constrained. – MyItchyChin Jul 25 '16 at 16:26

Barring that, would it be possible to setup a linux VM with an HTTP/S proxy and SSH that route over the VPN tunnel?

I can only address the first part of that question, "would it be possible to setup a linux VM ... that route over the VPN tunnel". Yes, you can.

If you make use of an alternate client, openconnect, split tunneling is fairly straightforward. You'd also need vpnc-script in order to make the process of setting up routes a little easier (although you can always manually go back afterwards and use the ip route commands).

Then you'd follow the instructions in this github gist. Essentially,

sudo openconnect <corporate-vpn-endpoint> \
     -m 1290 \
     -u <your-vpn-user> \
     --servercert sha256:<0446a7EXAMPLE8901278394> \
     -s 'vpn-slice <>'

where should be the subnet you'd like to have pass through the VPN.

Your routes after this command will end up looking something like

# ip route
default via dev wlp4s0 proto static metric 600 dev wlp4s0 proto kernel scope link src metric 600 dev tun0 scope link dev tun0 scope link metric 6 dev tun0 scope link dev tun0 scope link metric 6

Note that most traffic is passing over the default route, while the subnet specified in the command ( is passing over the tunnel.


It doesn't allow split tunnels. This is a security feature of the VPN software. Allowing split tunnels puts the business network at risk because this can be used to bypass the firewall. The software actively monitors host routing changes, and it will reverse changes made to the host routing.

  • 3
    I disagree that a split tunnel puts them at risk. The Web Security Agent (local firewall) runs by default regardless of the status of the Secure Mobility Agent (the VPN). Both can be disabled or removed, because they're installed on unmanaged machines. So there's a risk that the machine can be compromised and then connect to the VPN. – MyItchyChin Jul 25 '16 at 16:31
  • 2
    The risk is that you could use the tunnel from inside the firewall at the business site to get to things on the Internet which are forbidden by policies and protections on the firewall. It really doesn't matter whether or not you disagree, that is why the software was designed that way, and how it works. – Ron Maupin Jul 25 '16 at 16:36
  • Could you elaborate on how you could use split tunneling to circumvent the firewall at a business site? We're talking about off-site unmanaged clients connecting to a VPN. – MyItchyChin Jul 25 '16 at 16:45
  • 1
    Those aren't equivalents. VPN users should be treated as hostile and relegated to a subnet on your network with limited routing on the intranet. The Cisco VPN supports this and actually allows account level restrictions. Additionally the clientside routes are not defined by Cisco, they're defined by the network admin deploying the production. The VPN client also comes with a separate Firewall solution that is required to be running while the VPN client is running, but can be disabled when the VPN client is disabled. – MyItchyChin Jul 25 '16 at 17:02
  • 3
    Look, you asked the question, and I explained why it is the way it is. I didn't design the software, so don't gripe to me about it, gripe to Cisco, but don't expect to get very far. You may not like it, but it is what it is. – Ron Maupin Jul 25 '16 at 17:04

Since the routing has to allow for TCP packets towards the VPN server, you can use clever NAT rules and software like SSLH to multiplex additional streams (such as SSH with tunnels) on this by-design hole.

See details here for step-by-step instructions and how/why this works

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.