IKEv2 Client Routing On Windows Issue

ltctech

That's really odd, considering that split tunneling in Windows is not a default setting and has to be enabled per VPN connection. Did you enable it earlier and forgot about it?

Prior to Windows 10 it used to be a check box in TCP/IP IPv4 settings, in Windows 10 it's exclusively a PS command, not sure what MS is thinking.

Cosmo_Kramer

@ltctech:

That's really odd, considering that split tunneling in Windows is not a default setting and has to be enabled per VPN connection. Did you enable it earlier and forgot about it?

Prior to Windows 10 it used to be a check box in TCP/IP IPv4 settings, in Windows 10 it's exclusively a PS command, not sure what MS is thinking.

I am running Windows 10, and I didn't enable split tunneling previously. I wonder what could have caused it.

davros123

@Cosmo_Kramer:

@ltctech:

That's really odd, considering that split tunneling in Windows is not a default setting and has to be enabled per VPN connection. Did you enable it earlier and forgot about it?

Prior to Windows 10 it used to be a check box in TCP/IP IPv4 settings, in Windows 10 it's exclusively a PS command, not sure what MS is thinking.

I am running Windows 10, and I didn't enable split tunneling previously. I wonder what could have caused it.

I just setup an ikev2 connection on my Win10 Surface 3 Pro and tested it at a friends house over his wifi. The iPhone connects and works fine, but while the Windows PC connects, all traffic goes through the local wifi - not the VPN.

I am back home now and just saw this thread and checked my setting using Get-VpnConnection and it seems mine is set to split tunneling!
SplitTunneling : True
I DEFINITELY did not set it to true.

C:\Users\davros>powershell
Windows PowerShell
Copyright (C) 2015 Microsoft Corporation. All rights reserved.

PS C:\Users\davros> Get-VpnConnection -Name 'home ikev2'

Name                  : home ikev2
ServerAddress         : <myserver>.com
AllUserConnection     : False
Guid                  : {2AED2628-F1E4-43FF-920D-FB4E26D37064}
TunnelType            : Ikev2
AuthenticationMethod  : {Eap}
EncryptionLevel       : Required
L2tpIPsecAuth         :
UseWinlogonCredential : False
EapConfigXmlStream    : #document
ConnectionStatus      : Disconnected
RememberCredential    : True
SplitTunneling        : True
DnsSuffix             :
IdleDisconnectSeconds : 0</myserver>

This is the settings for my PureVPN connection on the same PC…as you can see, it's set to false.

PS C:\Users\davros> Get-VpnConnection -Name 'pureVPN'

Name                  : pureVPN
ServerAddress         : s050105.pointtoserver.com
AllUserConnection     : False
Guid                  : {EA9CBF5A-1F0B-4931-B6BA-99CDFF97D10A}
TunnelType            : Pptp
AuthenticationMethod  : {Chap, MsChapv2}
EncryptionLevel       : NoEncryption
L2tpIPsecAuth         :
UseWinlogonCredential : False
EapConfigXmlStream    :
ConnectionStatus      : Disconnected
RememberCredential    : False
SplitTunneling        : False
DnsSuffix             :
IdleDisconnectSeconds : 0

This now routes correctly from the PC. Solved.

Wasca

I've just updated to Pfsense 2.2.5 and setup the native Windows 10 IKEv2 VPN as per the instructions on this page (https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2)

I can establish the VPN connection correctly but the routes to my phase2 destinations are not being added to my Windows 10 routing table. I need to manually add them with a simple batch command after I've established the connection.

#Add Routes For VPN
route ADD 192.168.1.0 MASK 255.255.255.0 192.168.11.255
route ADD 192.168.5.0 MASK 255.255.255.0 192.168.11.255
route ADD 192.168.10.0 MASK 255.255.255.0 192.168.11.255

Once I've manually added the routes I can get to all the remote networks.

Does anyone know how I can get the routes added automatically in Windows 10 once the VPN is established?

Cosmo_Kramer

@Wasca:

I've just updated to Pfsense 2.2.5 and setup the native Windows 10 IKEv2 VPN as per the instructions on this page (https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2)

I can establish the VPN connection correctly but the routes to my phase2 destinations are not being added to my Windows 10 routing table. I need to manually add them with a simple batch command after I've established the connection.
#Add Routes For VPN
route ADD 192.168.1.0 MASK 255.255.255.0 192.168.11.255
route ADD 192.168.5.0 MASK 255.255.255.0 192.168.11.255
route ADD 192.168.10.0 MASK 255.255.255.0 192.168.11.255
Once I've manually added the routes I can get to all the remote networks.

Does anyone know how I can get the routes added automatically in Windows 10 once the VPN is established?

The only thing I can think of is maybe advertising the routes via DHCP. Not sure if that'd work though.

Philipp26

When you have split tunneling enabled in Windows 10 you can add a VPN connection route for an IPv4 address. The route will only be set when the VPN connection is active (see https://technet.microsoft.com/en-us/library/dn262649.aspx).

Windows PowerShell Example:
Add-VpnConnectionRoute -ConnectionName "Contoso" -DestinationPrefix 176.16.0.0/16 -PassThru

Windows PowerShell Enable Split Tunneling:
set-vpnconnection Contoso -splittunneling $True

Works like a charm.

Philipp

Cosmo_Kramer

@Philipp26:

When you have split tunneling enabled in Windows 10 you can add a VPN connection route for an IPv4 address. The route will only be set when the VPN connection is active (see https://technet.microsoft.com/en-us/library/dn262649.aspx).

Windows PowerShell Example:
Add-VpnConnectionRoute -ConnectionName "Contoso" -DestinationPrefix 176.16.0.0/16 -PassThru

Windows PowerShell Enable Split Tunneling:
set-vpnconnection Contoso -splittunneling $True

Works like a charm.

Philipp

Nice find, thanks for posting!

viniciusferrao

This problem still occurs as today with 2.3-RELEASE.

Any other workarounds for publishing the Phase2 routes accordingly on Windows?

JoelLinn

… and it seems like the problem is spanning over the complete Windows 10 Platform including mobile devices.
And since there is no Shell on the phone to configure routes it's effectively kinda broken. I even looked into Windows 10 Provisioning tools but no configurable VPN routes there....

jimp

That is all up to the client on Windows. Nothing pfSense or the server can do.