Adding route automatically after a successful VPN connection in Windows 10

Question

I'm trying on my W10 to perform an automatic "route" command after a successful VPN connection. I tried it based on this short description here which is for W7 but seems so similar, but I can't make it work.

• My VPN connection is ok. It connects and disconnect anytime without problems.
• My route command is ok. If I launch it manually after connecting the VPN everything works fine.
• Of course, my VPN connection doesn't use the remote gateway as a default gateway. I want to do "split tunneling".

I investigated and the Windows event 20225 is still the same on W10 (RAS Connection Establishement). So this is right... why is not triggering the route command? I can see the 20225 events with RasClient as source in the application event viewer after connecting the VPN.

Of course, before trying all of this stuff, I tried to creating the route "persistently" using -p parameter on route command but it doesn't work because the VPN interface doesn't exist when this route is added on every boot, so is not a valid option. So must be scheduled.

I did the task with elevated privileges with the same result, and marked the "Execute with elevated privileges" checkbox as well. The task appears as "never started". And if I try to launch it manually, it says "Task Scheduler service is not available. Task Scheduler will attemt to reconnect to it". But the task scheduler is working fine, other tasks can be scheduled or executed manually and they are working.

Anybody achieved this successfully?

EDIT I tried to change the trigger part to change "Basic" to "Custom" and I put a XPath filter in XML field trying to search for the event id:

<QueryList>
  <Query Id="0" Path="Application">
    <Select Path="Application">*[System[(EventID=20225)]]</Select>
  </Query>
</QueryList>

It neither worked.

The problem is the same. The task appears as "Never launched".

EDIT2 I noticed in event viewer that always, after a successful VPN connection (id 20225) there is always another event (id 900) which can be related... maybe everything is set up but something is blocking the trigger... I don't know. See this screenshot (sorry, the screenshot is in spanish):

Solution 1

Finally I couldn't make it work... so, sadly decided to look for an alternative. I made a batch file using rasdial which works like a charm. The only "problem" is the route command needs to be launched with elevated privileges. That's because I put a runas with the /savedcred argument which will ask only once for the password and then it will work automatically. Then, for the vpn you can put your password (in clear!) or leave set mypass="*" to ask for the password everytime.

Here is my code:

@echo off

cls
echo.

REM put your VPN connection name here
set myvpn="Your VPN name"
REM put your user here
set myuser="foo"
REM put your pass here. Leave * for asking
set mypass="testpass"
REM put your win admin user here
set winadmin="administrator"
REM put your network route here
set network="192.168.8.0"
REM put your network mask here
set mask="255.255.255.0"
REM put your gateway mask here
set gateway="192.168.1.1"

ipconfig | find /i %myvpn% > nul 2>&1

if %ERRORLEVEL% == 0 (

    echo "VPN already connected. Disconnecting..."
    echo.
    rasdial %myvpn% /disconnect
    runas.exe /user:%winadmin% /savedcred "route delete %network% mask %mask% %gateway%"

) else if %ERRORLEVEL% == 1 (

    echo "VPN not connected. Connecting..."
    echo.
    rasdial %myvpn% %myuser% %mypass%
    runas.exe /user:%winadmin% /savedcred "route add %network% mask %mask% %gateway%"
)

I hope this helps to somebody.

Solution 2

On Win 10, Powershell has a cmdlet available that adds routes on VPN connection and removes them again when the VPN is disconnected: Add-VpnConnectionRoute. It works without having to specify the interface ID.

The basic syntax is like this:

Add-VpnConnectionRoute -ConnectionName "VPN Connection Name" -DestinationPrefix 10.0.0.0/16

After entering this command, the routes will be created/removed automatically on connection/disconnection of the VPN.

Comments

[tmh]

If you're running Windows 10, consider using the PowerShell Add-vpnConnectionRoute in module VPNClient.

[Loic Rosnay]

I have a similar problem, but my VPN connection is done with the software PulseSecure (I have no control on the settings), and the connection is not visible in the list of VPN connections returned by Add-VpnConnectionRoute. So I do not know what the "VPN connection name" is...