1

I'm using F5 BIG-IP Edge VPN client on OS X Yosemite 10.10 and trying to find the best way to access the web, while connected

Has anyone found a solution, how to make it work? Maybe this could be an approach to setting up routes in memory?

The behavior of the application looks like this, from the beginning:

  • backup of the original /var/run/resolv.conf
  • provide a new resolf.conf from the vpn client
  • checking the hash of resolv.conf, when failed - replace it with the provided by vpn client

Well, and since the application is running from the wheel user, I don't have the option to replace routs on the file level

Looking for community advice

Note: using VM for this purposes, doesn't seem good, because VPN client only works on MacOS and Windows operation systems, or at least the fixed version on Linux wasn't found

Constantine SV
  • 11
  • 1
  • 4
  • 1
    As the administrator of the BIG-IP Edge Gateway server you can change the network access policy to better fit your needs. Ask him if you are not the admin. - One solution is to allow **"split tunneling"** where only traffic to pre-defined subnets will go over the VPN connection and all other client traffic will be allowed to access the internet directly. The should be in the policy --> Client Settings --> Advanced. Anther option is to deselect the option **"Prohibit routing table changes during Network Access Connection"** which should be in the policy --> Client Settings --> Security. – HBruijn Jul 18 '18 at 13:07

2 Answers2

1

Building on HBruijn's comment:

There are a few reasons this would not work:

  1. Split Tunneling is not allowed and the VPN routes are preventing web browsing while on a full VPN tunnel (or policy is explicitly denying browsing while on VPN). This is configurable by your VPN administration team/person.

  2. The VPN network is mirrored to your home LAN and VPN routing configurations are creating problems. This does happen from time to time when VPN networks override with home networks and complex internal network routing confuses the two. This usually happens when split tunneling IS allowed but the VPN think's your home network is the corporate VPN network. You'll get async routes and all sorts of fun issues there. Again, VPN team will need to work with you to resolve permanently.

  3. Something is just wrong with the routing table provided by the VPN client. This again will fall on your VPN admins configuration of how the VPN network is allowed to route your home traffic.

And from HBruijn; You should usually allow for routing table changes to be made by the VPN so you can get proper access to resources. If Prohibit routing table changes during Network Access Connection is flagged, definitely disable. This is pretty important if you're not allowed to use split tunneling. You won't receive corporate routes to allow external traffic. I run macOS and the F5 VPN tunnel in full tunnel (no split) and it works fine. Corporate just asks that I don't stream Netflix while on VPN.

tl;dr - Your VPN team will need to address the configuration, routing, or browsing policies when the Edge client connects to corporate resources. You can one-off fix routing tables but it will reoccur until they address it permanently.

Chase
  • 409
  • 2
  • 8
0

I had to do something bizarre in order to bypass this. On a bash console:

while :; do sleep 0.3s; echo nameserver 8.8.8.8 | sudo tee /etc/resolv.conf ; done

Just hit Ctrl+C when you are done with the VPN

pabloveliz
  • 1