add set-default-route=[01]

[oto-ledger]

Ability to disable default route for VPN with explicit routing only.
Few fixes to split routes to avoid routes with 0.0.0.0 as their destination to be unaccessible.

[aaronjg]

What is the difference between this option and the "--set-routes" option? It looks quite similar to me, so if there is a difference it should at least be made clearer in the help text.

[oto-ledger]

Well, --set-routes does not set any routes. Here we just want to set the routes sent by the server but not the default route. (Use the VPN connection to only access particular machine but not push all the traffic through it).

[DimitriPapadopoulos]

This has been already discussed. See #22 and #371 for example.

[oto-ledger]

Actually, it's not that I want to add particular routes, because I don't know them before connecting to the remote server. Those routes are dynamic on the server side. Therefore, I just wanted to apply them (needing some tweaks when they are specified using the default gateway), and avoid routing all the traffic through the vpn remote end.

[DimitriPapadopoulos]

Yes, I understand that. Yet if the FortiGate gateway admins have set it up to request all traffic to be directed through the gateway, we do as FortiClient and follow the admins' requests.

I'd rather address this as part of #678 - but not in the short term unfortunately.

[oto-ledger]

Oh, ok.
Also, if I'm not mistaken, even if the fortigate server does not specifies it, the client sets up the default route through the VPN, isn't it?

[DimitriPapadopoulos]

Ah, I don't know, I'm not familiar with this part of the code. If so you have a case :-)

[mrbaseman]

Actually the server can use either default routing mode or split tunnel mode. In default routing mode a default route will be added whereas in split tunnel mode only the routes pushed by the fortigate are added. The fortigate pushes rotes to all destinations where accept policies via ssl vpn are configured for this particular account.

An alternative to the default route are two routes with netmask /1 ("half internet routes") which can be used on the client side instead of changing the default route.

[mrbaseman]

I think when the Fortigate pushes the default route, it doesn't push any other routes.

So, if you are attempting to avoid the default route through the vpn connection, you have to configure routing manually.

This would be --no-routes in combination with a pppd-ifup-script i.m.o.