# IPSec on macOS and split tunneling **URL:** \ **Category:** VPNs\ **Created:** [18 August 2021 07:47 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070 "2021-08-18T07:47:04Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [18 August 2021 07:47 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/1 "2021-08-18T07:47:04Z")
Hi, Thanks to ipfire v158 it’s easier than ever to allow macOS and iOS devices to connect via IPSec directly, no third-party app required. It works great on macOS Catalina 10.15.7 & Big Sur 11.5.2 for IpSec Roadwarrior & Certifcate but I’ve to set “Local Subnet” to “0.0.0.0/0” to have access to the office’s local DNS or else the DNS names will not resolve (even if setting DNS Server manually). Sadly all traffic routes through the IPSec VPN which is not desired if you have a lot of connected IPSec connections…so Split Tunneling would be the solution to allow connection to the office’s network but other traffic routed via the home’s router. Here are the commands for split tunneling for Cisco IPSec on macOS but doesn’t seem to work for me: (192.168.64 is the office’s network / 192.168.178.1 is my home router “fritzbox”) > sudo route -nv add -net 192.168.64 -interface ipsec0 > sudo route change default 192.168.178.1 A better solution would of course to have Split Tunneling directly on ipfire IPSec configuration…at least a Cisco Unity plugin existed for Strongswan long time ago: [[strongSwan] Need help with StrongSwan & Mac OS X split tunneling](https://lists.strongswan.org/pipermail/users/2015-February/007402.html) Or any other suggestion how to implement Split Tunneling via /etc/ipsec.user.conf ? thanks ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 08:09 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/2 "2021-08-18T08:09:16Z")
reading [https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling](https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling), maybe it should be: ```auto leftsubnet=192.168.64.0/24 ``` What do you think? ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [18 August 2021 08:59 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/3 "2021-08-18T08:59:43Z")
Thanks but checking `/etc/ipsec.conf` the value of leftsubnet is: `leftsubnet=0.0.0.0/0` (that’s the value from `Local Subnet` in the WebUI. and setting it to: `leftsubnet=192.168.64.0/24` doesn’t resolve the internal office’s DNS even if `DNS Server`is set to 192.168.64.1 (office’s ipfire firewall)… ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 09:44 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/4 "2021-08-18T09:44:24Z")
and if you put something like this in /etc/ipsec.user.conf? ```auto conn mac leftsendcert=always leftallowany=yes rightdns=192.168.64.1 rekey=no reauth=no ``` where “mac” is the name I gave when creating the certificate of the client (you change it to yours), and the only entry of interest for your problem is “rightdns”. This entry should just push the DNS setting to the clients, in case this is why they are not using your VPN office DNS. ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [18 August 2021 11:24 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/5 "2021-08-18T11:24:00Z")
Unfortunately this doesn’t work either (my connection name is MyConfig)…still everything is routed through the VPN, even if I set `leftsubnet=192.168.64.0/24` but then I no DNS-names resolve). Does Split-Tunneling work for you ? What do you have in `/etc/resolv.conf` ? ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 11:43 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/6 "2021-08-18T11:43:21Z")
> [@cgil](#): > > Unfortunately this doesn’t work either (my connection name is MyConfig)…still everything is routed through the VPN, even if I set `leftsubnet=192.168.64.0/24` but then I no DNS-names resolve). Do you have a rule in the firewall to allow the green network to access the DNS (I imagine yes since you have problems only with a split tunnel)? Is the DNS not passed to the client or is the client ignoring the entry when you have a split tunnel? > [@cgil](#): > > Does Split-Tunneling work for you ? I do not use split tunnels. I will try when I find a bit of time and report here. > [@cgil](#): > > What do you have in `/etc/resolv.conf` As expected, but as I said, I do not have a split tunnel. ```auto Hasbeen-MBP:~ cfusco$ scutil --dns DNS configuration resolver #1 search domain[0] : localdomain nameserver[0] : 10.1.1.1 if_index : 12 (ipsec0) flags : Request A records reach : 0x00000002 (Reachable) [...] ``` ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 12:36 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/7 "2021-08-18T12:36:46Z")
How about this? [https://www.frakkingsweet.com/strongswan-ikev2-split-dns-and-ios/](https://www.frakkingsweet.com/strongswan-ikev2-split-dns-and-ios/) Also this one, which is really old, but it goes in the same direction. [https://serverfault.com/questions/521536/strongswan-cant-push-dns-resolver-to-osx-mountain-lion-split-tunnel](https://serverfault.com/questions/521536/strongswan-cant-push-dns-resolver-to-osx-mountain-lion-split-tunnel) Maybe this problem is old but has never been fixed by apple? ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [18 August 2021 12:45 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/8 "2021-08-18T12:45:01Z")
Sorry I was thinking about `/etc/resolv.conf` on your ipfire-firewall and yes a rule on green is set for DNS. The DNS is not passed to the client when I narrow the “Local Subnet” to our office’s LAN 192.168.64.0/24 (when setting to 0.0.0.0/0 DNS works but then all traffic is routed through the VPN). Tried also to bypass lan…taken from Strongswan’s mailing list: [https://lists.strongswan.org/pipermail/users/2015-January/007289.html](https://lists.strongswan.org/pipermail/users/2015-January/007289.html) ```auto conn lanbypass leftsubnet=192.168.64.0/24 rightsubnet=192.168.66.0/24 rightdns=192.168.64.1 type=passthrough auto=route ``` (here 192.168.66.0/24 is IPSec’s Host-to-Net Virtual Private Network) but no luck yet… ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 12:49 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/9 "2021-08-18T12:49:52Z")
@cgil check the attr angle from my other message, where I posted those two links. see also the official documentation: [attr plugin - strongSwan](https://wiki.strongswan.org/projects/strongswan/wiki/AttrPlugin) It looks like 28674 and 28675 are extensions only for IKEv1 ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 13:04 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/10 "2021-08-18T13:04:53Z")
@cgil I think I found the solution. You have to manually modify the file generated by IPFire for apple configurator, here how: [https://lists.strongswan.org/pipermail/users/2015-October/008842.html](https://lists.strongswan.org/pipermail/users/2015-October/008842.html) This is the documentation manual for apple configurator xml syntax : [https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf](https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf) In particular DNS Dictionary Keys section, SupplementalMatchDomains, on how to control spilt DNS. ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [18 August 2021 13:28 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/11 "2021-08-18T13:28:49Z")
Thanks…so I need to edit the downloaded profile `MyConnection.mobileconfig` and add the following key: ```auto DNS ServerAddresses 1.1.1.1 2.2.2.2 SearchDomains test2.com test3.com SupplementalMatchDomains test2.com test3.com ``` but which values to set for `1.1.1.1` ? `192.168.64.1` maybe ? ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [18 August 2021 13:55 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/12 "2021-08-18T13:55:10Z")
Read the manual, the way I understood how this works would be something like this: if you have a local DNS in 192.168.64.1 a local domain called “localdomain” and 3 computers in your local domain, host1, 2 and 3, the entry would be: ```auto DNS ServerAddresses 192.168.64.1 SearchDomains host1.localdomain host2.localdomain host3.localdomain SupplementalMatchDomains host1.localdomain host2.localdomain host3.localdomain ``` any other query not included in the array of “SupplementalMatchDomains” should be resolved by the system default DNS server, according to the documentation. ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [19 August 2021 13:00 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/13 "2021-08-19T13:00:56Z")
After reading the PDF I’ve added the keys ServerAddresses, SearchDomains and SupplementalMatchDomains right after AuthPassword but still no split-tunneling, but found a manual solution, see below: Added to the MyConnection.profile: ```auto MyConnection VPNType IKEv2 IKEv2 ... AuthPassword ServerAddresses 192.168.64.1 SupplementalMatchDomains myoffice.local ``` Trying to ping our mailserver fails: ```auto #ping mailsrv.myoffice.local ping: cannot resolve mailsrv.myoffice.local: Unknown host ``` However I’ve found out when using scutil it works: ```auto #sudo scutil > d.init > d.add ServerAddresses * 192.168.64.1 > d.add SupplementalMatchDomains * myoffice.local > set State:/Network/Service/aabbcc/DNS > d.show { ServerAddresses : { 0 : 192.168.64.1 } SupplementalMatchDomains : { 0 : myoffice.local } } > quit ``` Pinging the mailsrv: success! ```auto #ping mailsrv.myoffice.local PING mailsrv.myoffice.local (192.168.64.102): 56 data bytes 64 bytes from 192.168.64.102: icmp_seq=0 ttl=63 time=3.451 ms 64 bytes from 192.168.64.102: icmp_seq=1 ttl=63 time=3.005 ms ``` Now remove DNS and ping fails: ```auto sudo scutil > remove State:/Network/Service/aabbcc/DNS > quit ``` Pingin the mailsrv fails! ```auto #ping mailsrv.myoffice.local ping: cannot resolve mailsrv.myoffice.local: Unknown host ``` So I need to further investigate the .profile file… ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [20 August 2021 09:11 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/14 "2021-08-20T09:11:02Z")
SOLVED! macOS Split-Tunneling works now ! tested on macOS Big Sur 11.5.2 No need to edit the Profile file, just edit `/etc/strongswan.d/charon/attr.conf`…read on: First I didn’t see the article of Frakkingsweet that @cfusco posted earlier: [https://www.frakkingsweet.com/strongswan-ikev2-split-dns-and-ios/](https://www.frakkingsweet.com/strongswan-ikev2-split-dns-and-ios/) Just edit `/etc/strongswan.d/charon/attr.conf` for Split-Tunneling on macOS (and iOS too) and add the line: `25 = myoffice.local` Of course change `myoffice.local` to your internal DNS name. So `/etc/strongswan.d/charon/attr.conf` looks like: ```auto # Section to specify arbitrary attributes that are assigned to a peer via # configuration payload (CP). attr { # Add the following for IPSec split-tunnel # See https://www.frakkingsweet.com/strongswan-ikev2-split-dns-and-ios/ # 25 = myoffice.local # is an attribute name or an integer, values can be an IP address, # subnet or arbitrary value. # = # Whether to load the plugin. Can also be an integer to increase the # priority of this plugin. load = yes } ``` I also narrowed the _Local Subnet_ to `192.168.64.0/24` instead of `0.0.0.0/0` in IPSec WebUI \> edit Connection. Then restart ipsec: `#ipsec restart` Finally IPSec Split-Tunneling should work! Hope this helps others… It would be great to have this option in the IPSec WebUI… ---
**Author:** ![cgil](https://community.ipfire.org/user_avatar/community.ipfire.org/cgil/32/16450_2.png) [@cgil](https://community.ipfire.org/u/cgil)\ **Post date:** [23 August 2021 08:46 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/15 "2021-08-23T08:46:51Z")
Note: The attribute `25 = myoffice.local` corresponds to the “INTERNAL\_DNS\_DOMAIN”, here: _IKEv2 Configuration Payload Attribute Types_ [https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-21](https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-21) ---
**Author:** ![cfusco](https://community.ipfire.org/user_avatar/community.ipfire.org/cfusco/32/9213_2.png) [@cfusco](https://community.ipfire.org/u/cfusco)\ **Post date:** [24 August 2021 09:15 UTC](https://community.ipfire.org/t/ipsec-on-macos-and-split-tunneling/6070/16 "2021-08-24T09:15:03Z")
@cgil Congratulations. Excellent job.