Setting Client Side Routes on MacOS to L2TP Unifi Remote User VPN

Written by James McDonald

January 18, 2022

If you are connecting to a Unifi L2TP Server type Remote User VPN and you haven’t selected the “Send all traffic over VPN connection” option under advanced settings on the Mac.

You will need to set routes so you can access a LAN or LANs behind your UDM

If you are wondering what is being passed to the the /etc/ppp/ip-up echo the arguments to /tmp/ip-up by uncommenting the “# echo \"$0\" \"$1\" \"$2\" \"$3\" \"$4\" \"$5\" \"$6\" >> /tmp/ip-up” line

I want to set routes based on the IP of the remote VPN-Server so argument $5 is the one that I have put into the case block to add routes.

I found I didn’t need an /etc/ppp/ip-down script because the routes added by /etc/ppp/ip-up go away when the ppp0 connection created by the L2TP / IPSec tunnel goes away

Create an ip-up script to set routes when L2TP/IPSec connection comes up on MacOS

This script was on the Unifi forums but posting here so I can find it easier than I did last time.


#  /etc/ppp/ip-up

# uncomment this and start the connection to your UDM/USG to check what is being passed to this script
# escaping the quotes are needed because one of the arguments is there but empty
# echo \"$0\" \"$1\" \"$2\" \"$3\" \"$4\" \"$5\" \"$6\" >> /tmp/ip-up

# $0.                         $1                          $2               $3         $4                          $5                             $6
# this-script             interface-name   tty-device  speed  local-IP-address  remote-IP-address local-gateway
# "/etc/ppp/ip-up" "ppp0"                   ""                "0"        ""    ""         "" 

case "$5" in
         # Based on vpn-server-ip, do different things
                /sbin/route add
                /sbin/route add
		        # anything else could also go here
               # some.other.ip.address could be another VPN server and you can 
               # do different stuff here.
exit 0

If you are more comfortable with GNU/Linux utilities for listing IP addresses then install

brew install iproute2mac
# you can then list routes easier with 

ip route
# output
default via dev en0
default via link#17 dev ppp0 via dev ppp0 via dev ppp0 via dev en0 via dev lo0 via dev lo0 dev en0  scope link dev en0  scope link dev en0  scope link dev en0  scope link via ppp0 dev ppp0 dev en0  scope link dev ppp0  scope link dev en0  scope link dev ppp0  scope link


Submit a Comment

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

The reCAPTCHA verification period has expired. Please reload the page.

You May Also Like…