How to use split tunneling on OSx Ventura 13.4.1?
I saw many entries lamenting the inability to use split tunneling on Big Sur, Monterey, and Ventura.
When using the built-in Apple VPN client to connect, it is possible to enable split tunneling and force desired traffic through the tunnel while allowing other traffic to avoid it.
In example, if I am in Eastern Europe and I want to reach Jira and Confluence via the VPN tunnel because I have applied IP restrictions to accessing them, I can do the following:
- Navigate to System Settings → VPN
- Select the i symbol on the desired VPN entry
- Enter your User Name and Password when challenged.
- Select Options on the left pane
- Toggle the “Send all traffic over VPN connection” to OFF in the right pane and click OK at the bottom
- Determine what IP scope Atlassian is using for Jira and Confluence by checking https://ip-ranges.atlassian.com
- Do geolocation of the IP numbers in the table, in this example the 185.166.140.0 - 185.166.143.0 (184.166.140.0/22) networks are geolocated in Amsterdam, Netherlands and will be offered by Atlassian for use to a source IP number in Eastern Europe. (You may note that 104.192.136 - 104.192.143.0 (104.192.136.0/21) are on the list, are geolocated in Des Moines, IA, USA, and will be offered by Atlassian for use to a source IP number in the USA.)
- Open Terminal
- Elevate to Super User by issuing the sudo su command.
- Provide your PW when challenged
- Issue the following: route add -net "185.166.140.0" -netmask "255.255.252.0" -interface ppp0
- OSx will respond add net 185.166.140.0 gateway ppp0
- Repeat step 11 for any other IP network scope that you want to force over the VPN.
- Issue the exit command to remove Super User privileges when done.
- Quit Terminal
Issuing a netstat -r command will allow you to examine the effective route table applied to your Macbook and you can confirm what traffic is appended to the VPN interface (ppp0). You should see that your home office network is not appended to interface ppp0 and you should see that the distant corporate network you are connected to is appended to ppp0 without you having to issue the routing addition for it.
The routes you add are not persistent and will extinguish when the VPN is closed so they need to be added each time the VPN is connected and you want to reach restricted IP ranges. They have to be added while on the VPN as OSx will error out and say that ppp0 doesn't exist if you are not connected. If you have a lot of IP network scopes that you want to force over the VPN, it may be helpful to create an AppleScript using the Script Editor application under Other on the Launchpad of your Mac as follows (replace the xxx with appropriate network information):
set networkUp to false
repeat until networkUp is true
try
do shell script "ping -c 4 xxx.xxx.xxx.xxx". -- IP number of a known internal node, e.g. your domain controller
set networkUp to true
do shell script "route add -net 185.166.140.0 -netmask 255.255.252.0 -interface ppp0" with administrator privileges
route add - net xxx.xxx.xxx.x -netmask xxx.xxx.xxx.x -interface ppp0
route add - net xxx.xxx.xxx.x -netmask xxx.xxx.xxx.x -interface ppp0
route add - net xxx.xxx.xxx.x -netmask xxx.xxx.xxx.x -interface ppp0
route add - net xxx.xxx.xxx.x -netmask xxx.xxx.xxx.x -interface ppp0
on error
-- something went wrong, so try again in 5 seconds
delay 5
end try
end repeat
The above script will confirm a node on the distant network you VPN into is live prior to attempting to apply the routes. If it doesn't see the node (e.g. Domain Controller), it will try to see it again every 5 seconds until it does it see and then it will proceed to apply the addition of the route(s).
MacBook Air (M1, 2020)
