VPN connections and local network traffic on Mac
Tags: network, vpn, firewall
Published: 2022-01-21 05:55:30

---
canonical_url: https://david.coffee/vpn-connections-and-local-network-traffic-on-mac
---

Mirrored from my blog - https://david.coffee/vpn-connections-and-local-network-traffic-on-mac

These days I've been trying to be more conscious about my online footprint and privacy in general. I've been using one-off email addresses for years now (btw check out my recent post on [masked emails](https://david.coffee/creating-fastmail-masked-emails-without-1password-anytime-and-everywhere) if you haven't yet), and have a bunch of little scripts that spit out things like random usernames when I hit "!" 3 times.

But honestly speaking, IP addresses were one of those things I just kind of didn't really care about.

What changed my view drastically was when I hacked on a [cloudflare workers](https://workers.cloudflare.com/) project and for debug purpose decided to `console.log()` the Request object. Here's what got printed

```json
{
      "message": [
        {
          "cf": {
            "longitude": "REDACTED",
            "latitude": "REDACTED",
            "continent": "AS",
            "country": "JP",
            "tlsVersion": "TLSv1.3",
            "colo": "NRT",
            "timezone": "Asia/Tokyo",
            "city": "REDACTED",
            "edgeRequestKeepAliveStatus": 1,
            "requestPriority": "",
            "httpProtocol": "HTTP/3",
            "region": "Tokyo",
            "regionCode": "13",
            "asOrganization": "REDACTED",
            "postalCode": "REDACTED"
          },
        }
      ],
    }
```

I cut out some of the details here, but the request had longitude, latitude, my internet provider name and a postal code that is *very* close to mine. Meaning *every site* I interact with basically knows where I live to a certain degree. That ain't good. 

I now have a VPN running almost all of the time, which brings me to the main topic of this post:

When using a VPN, like NordVPN, and you want to let that run 24/7 so that you can move all traffic without leaks through the it, you'll sooner or later end up running into issues with things like local network no longer resolving because it's not part of the virtual network.

How do you fix that?

## Temporary rules with route

Mac has a bunch of neat network tools that you can use to get around this, the easiest is `route`:

```
# route <target> <gateway>
sudo route -nv add -net 10.0 192.168.1.1
```

with the `-net` flag (there is also `-host`), `10.0` expands to `10.0.0.0`, so the entire subnet of `10.0.*` will get routed to the gateway `192.168.1.1` instead of the VPN network, sweet! (10.0.5.* is my network for services and smaller devices)

Routes added with `route` are temporary, so once you restart they're gone which makes them good for experimenting and quickly setting things up in a non-destructive way.

## Making things persist

For persistent rules, mac comes with the `networksetup` tool:

```
❯ networksetup -listallnetworkservices

An asterisk (*) denotes that a network service is disabled.
Ethernet
USB 10/100/1000 LAN
Wi-Fi
Thunderbolt Bridge
NordVPN NordLynx
```

The command we want is `-setadditionalroutes`. This command takes a interface, and then triplets of `<target> <netmask> <gateway>`

```
networksetup -setadditionalroutes "Ethernet" 10.0.5.0 255.255.255.0 192.168.1.1
```

This command adds a route for `10.0.5.*` (designated by the netmask `255.255.255.0`) and routes all traffic to the gateway `192.168.1.1` instead. 

Repeat that for all your interfaces that you use to connect, and done.

To add multiple routes you'll have to specify them in the same go, in triplets:

```
networksetup -setadditionalroutes "Ethernet" 192.168.0.0 255.255.0.0 192.168.1.1 10.0.5.0 255.255.255.0 192.168.1.1
```

Now everything from `192.168.*` and `10.0.5.*` will get routed to my router

#### About NordVPN

I never talked to NordVPN, but after trialing 4-5 different VPN services that were recommended for privacy, I ended up at Nord and am very happy with them (dark patterns like difficulty to unsubscribe aside). The speed is very consistent and it's one of the only options I was really able to keep turned on 24h a day.

If you're thinking of signing up for NordVPN, consider using [my referal](https://ref.nordvpn.com/pSuUglACVGO)