macos - 在 VPN 连接 Mac OS X 中添加路由

Question

我有以下路由表:

➜  ~  netstat -nr
Routing tables

Internet:
Destination        Gateway            Flags        Refs      Use   Netif Expire
default            192.168.0.1        UGSc           63        1     en0
default            10.255.254.1       UGScI           1        0    ppp0
10                 ppp0               USc             2        4    ppp0
10.255.254.1       10.255.254.2       UHr             1        0    ppp0
92.46.122.12       192.168.0.1        UGHS            0        0     en0
127                127.0.0.1          UCS             0        0     lo0
127.0.0.1          127.0.0.1          UH              2    62144     lo0
169.254            link#4             UCS             0        0     en0
192.168.0          link#4             UCS             8        0     en0
192.168.0.1        c0:4a:0:2d:18:48   UHLWIir        60      370     en0    974
192.168.0.100      a0:f3:c1:22:1d:6e  UHLWIi          1      228     en0   1174

如何将网关(10.25.1.252)添加到VPN内的特定IP(10.12.254.9)。我尝试了这个命令，但没有成功:

sudo route -n add 10.12.0.0/16 10.25.1.252

但是traceroute显示它使用默认网关:

 ~  traceroute 10.12.254.9
traceroute to 10.12.254.9 (10.12.254.9), 64 hops max, 52 byte packets
1  10.255.254.1 (10.255.254.1)  41.104 ms  203.766 ms  203.221 ms

Answer 1

您在使用 Cisco AnyConnect 吗？这是来自 https://supportforums.cisco.com/document/7651/anyconnect-vpn-client-faq 的花絮

Q. How does the AnyConnect client enforce/monitor the tunnel/split-tunnel policy?

A. AnyConnect enforces the tunnel policy in 2 ways:

1)Route monitoring and repair (e.g. if you change the route table), AnyConnect will restore it to what was provisioned.

2)Filtering (on platforms that support filter engines). Filtering ensures that even if you could perform some sort of route injection, the filters would block the packets.

我的解释是:每当您更改路由时，Cisco 客户端都会将路由重置为 VPN 管理员配置的路由。

您最好与 VPN 管理员联系并要求他们添加您的路由。