L2TP VPN is Consuming Too Much of Remote Network's Upload Bandwidth

Question

In Ubuntu 16.04, I used the following command so that Network Manager world provide L2TP as an option when adding a VPN connection:

sudo add-apt-repository ppa:nm-l2tp/network-manager-l2tp; sudo apt update ; sudo apt-get install -y network-manager-l2tp network-manager-l2tp-gnome strongswan

The above is intentionally multiple commands combined into one line, so that setup can be achieve in one line at the terminal.

After adding an L2TP VPN and successfully connecting, I was able to access everything I needed to on the remote network through the Meraki firewall.

However, if I go to watch a 4K YouTube video (or any other bandwidth intensive internet activity), on my local computer, I notice that I'm not getting that video directly from my local internet connection; instead, it is actually being downloaded through the VPN tunnel! This is not desired, because the remote network barely has enough upload bandwidth to cover all of the VOIP phones that are being used there. So, I need the VPN client to only use the VPN connection for resources that are actually located on that remote network.

In the past, when I was using a vpnc VPN or an OpenVPN VPN, I could check this box to prevent the local internet activity from consuming the remote network's bandwidth:

However, if I check this same box with a L2TP VPN, it does indeed use only local internet resources, but I can no longer access any of the remote resources on the remote VPN network. For example, I can't even ping the remote LAN's gateway, during a VPN connection, if this box is checked.

How can I both:

1. access resources on the remote L2TP VPN network and
2. have all other internet activity consume only local internet resources?

Meraki support has directed me to this document. However, it is impractical to expect all my non-technical users to add routes to their Ubuntu laptops for each physical location they might connect to the VPN from. I need a solution where I can configure the client to automatically do split-tunneling, so I can set this up for each using, and the only thing they ever have to do is just connect.

Answer 1

Connecting to the VPN changes your default route

If you were to take a look at your routing table before connecting to the VPN, and afterwords, you will notice that not only do you have additional routes, but your default route has been changed. Your traffic goes out over the default route, unless there is a 'better', specific route.

To see your routing table, you can run ip route. You used to be able to run route, but most distributions no longer have that command.

ip route

With each VPN type, and with each VPN client, you are limited to different options and possibilities, but when you use openconnect, you have the ability to control this and prevent your default route from changing.

To be clear, let's say your VPN network is 192.2.2.0/24. When you connect to the VPN, you need a new route to route that traffic to the gateway. It will likely look like 192.2.2.0/24 via 192.2.2.1 on tun0, but the gateway IP could be different. By having this route, any traffic to 192.2.2.0 255.255.255.0 will go over tun0 to 192.2.2.1 instead of eth0/wlan0 to your router. You just don't want 192.2.2.1 becoming your default route.