Questions[split-tunnel](server)

I am deploying a solution using IKEv2+ipsec with certificates to connect roadwarriors to corporate network. Mikrotik CHR is used as entry point.

All was swift until I started deploying the solution on Dell notebooks. Once connection to the router is established, laptop doesn't get split includes, and only VPN subnet is available. On the contrary, my admin PC, which is stationary workstation, has no such problems.

Windows 10 receiving split includes using DHCP. After some research I found out that for some reason, Dell-provided Windows 10 Pro 1909 fails to send DHCP request to the router. Laptops get their address, DNS, only split include routes are lost. Also, DHCP works well on Wi-Fi adapter.

What was done:

• Logs at router were examined for both laptop and admin PC. No DHCP requests was found when laptop connects.
• Traffic was sniffed at Microtik CHR: DHCP request, which comes from admin machine, doesn't come from notebook.
• Traffic was sniffed at notebook, and no DHCP requests were detected.

Rebooting, resetting ip and winsock using netsh, reverting to older wi-fi driver, deleting and re-creating WAN Miniports, enforcing DHCP for a connection, dancing around a laptop - all that didn't help.

Currently the only solution that works is a clean MSDN version of Windows 10 1909 installation. With this one, laptops get their split includes well. However, it doesn't seem a sound solution to me.

My questions are:

• What is possible cause of the problem?
• What can be done to fix it?

I've got an Ubuntu 12.04 server running on Amazon's EC2 that runs a web crawling process. We're running into a problem where some of the webservers hosting the sites we need to crawl are blocking all EC2 IP addresses.

My brilliant idea was to tunnel outgoing HTTP requests through a VPN. I was able to get the VPN set up but it routed ALL traffic through the VPN which meant that I couldn't SSH into the machine and it wouldn't respond to any incoming http requests. (This server also hosts a web service that we need to be able to access)

Really I just want to "proxy" all outgoing HTTP requests through the VPN so we can access sites that have all EC2 IPs blocked.

It's very possible I'm going about this the wrong way and I welcome any other suggestions that might be simpler or more robust.

I'm using the Juniper client for OSX ('Network Connect') to access a client's VPN. It appears that the client is configured to not use split-routing. The client's VPN host is not willing to enable split-routing.

Is there a way for me to over-ride this configuration or do sometime on my workstation to get the non-client network traffic to by-pass the VPN? This wouldn't be a big deal, but none of my streaming radio stations (e.g. XM) work will connected to their VPN.

Apologies for any inaccuracies in the terminology.

** edit **

The Juniper client changes my system's resolve.conf file from:

nameserver 192.168.0.1

to:

search XXX.com [redacted]
nameserver 10.30.16.140
nameserver 10.30.8.140

I've attempted to restore my preferred DNS entry to the file

$ sudo echo "nameserver 192.168.0.1" >> /etc/resolv.conf

but this results in the following error:

-bash: /etc/resolv.conf: Permission denied

How does the super-user account not have access to this file? Is there a way to prevent the Juniper client from making changes to this file?

Is it possible to do split tunnelling with a site to site VPN connection using Cisco ASAs?

We have a Cisco ASA 5510 at head office, and Cisco 5505 in our branch office, currently connected via a Site-To-Site VPN. I'd like to give direct access to the internet for hosts in the branch office. Is it possible. I know it can be done for Remote Access VPN connections (Easy VPN), but can't find any documentation on Site-To-Site, so wondering if it is missing, or isn't there because it can't be done.

my title might not be very clear, but I'll explain my setup in more detail now.

We have several customers (companies) that need to be remotely supported. At these customers we have servers running with our software that needs to be serviced. These servers are (almost) never connected to the internet. For this we have multiple PC's running VPN clients. These PC's run a VNC server so our service engineers can login from their home laptop remotely to these PC's and connect from there to our customer via the VPN connection on the PC.

The problem is however that several customers do not allow split tunneling. That means that when we connect via VPN to such a customer the VNC connection drops. Our current workaround is using a Citrix VM which we control via XenCenter console, but it's quite slow.

Are there common solutions to handle this?