On Mon, 2006-10-23 at 15:01 +0200, Stefan Schmidt wrote: > Hello. > > On Mon, 2006-10-23 at 11:48, Thomas Liebetraut wrote: > > > > My university uses Cisco Concentrators for VPN which I connect to using > > vpnc. > > Same university, network department. :) > > > vpnc automatically determines the correct routes that it > > gets from the concentrator (at least I suspect that the concentrator > > provides this info as there are no routes specified in the profile files). > > Right cisco vpn pushes them out to the clients. Because of this fact, > I would prefer to let vpnc pushes the routes via dbus and nm can > decide how to handle. Perhaps somebody like to overwrite this route > given by his company.
Right; there's a proliferation of options here. We have a few situations: - Admins route all traffic through VPN, user wishes to override (vpnc plugin already handles this case) - Admins push split networks, but user wishes to override one or more What's needed here is an extension of the current routing preferences. We likely need two lists, one for "route only these netblock over the VPN explicitly" and a second for "never route these netblocks over the VPN". The next problem is split DNS; do people care about that? Ideally we only query the VPN nameservers for names in a certain domain (passed vpnc as CISCO_DEF_DOMAIN). Sometimes though, admins don't push the default domain and you have to manually fill it in for a split network setup. But that requires using named as a local caching nameserver, which people, for some inconceivable reason, are very vocally against. So right now all DNS queries go over the VPN. So basically, we have to modify the user interface to: - Add a "Never route these over VPN" entry - Add an "Override default domain name" entry - Modify the vpnc service daemon to push split networks to NM - Make NM do split DNS if requested This stuff won't get into 0.6.4, but I'd certainly accept patches for 0.7/HEAD. If I could find time to work on it in between dbus-ifying wpa_supplicant, the new config framework, and multiple active devices, I'd take a look at it :) Dan > > regards > Stefan Schmidt > _______________________________________________ > NetworkManager-list mailing list > [email protected] > http://mail.gnome.org/mailman/listinfo/networkmanager-list _______________________________________________ NetworkManager-list mailing list [email protected] http://mail.gnome.org/mailman/listinfo/networkmanager-list
