Tutorial: Configure Full and Split Tunneling in Access Server⁠

Overview⁠

This tutorial explains how to configure full and split tunneling in Access Server.

You'll learn:

How tunneling works.
How to configure it globally.
How to override settings for specific users and groups using both the Admin Web UI and CLI.

Prerequisites⁠

Access Server installed and running.
Admin Web UI access.
Root access to the Access Server console (for CLI steps).

How full and split tunneling work in Access Server⁠

Access Server uses two OpenVPN directives to control traffic routing:

redirect-gateway: Sends all client traffic through the VPN (full tunnel).
redirect-private: Routes only specific private subnets through the VPN while other traffic uses the client's local internet connection (split tunnel).

By default, full tunneling is configured globally and can be overridden at the user or group level.

Connect to the console and get root privileges.

Configure full tunneling:

sacli --key "vpn.client.routing.reroute_gw" --value "true" ConfigPut
sacli start

Configure split tunneling:

sacli --key "vpn.client.routing.reroute_gw" --value "false" ConfigPut
sacli start

Connect to the console and get root privileges.

Enable split tunneling without pushing DNS:

sacli --user <USER_OR_GROUP> --key "prop_reroute_gw_override" --value "disable" UserPropPut

Enable split tunneling while still pushing DNS:

sacli --user <USER_OR_GROUP> --key "prop_reroute_gw_override" --value "dns_only" UserPropPut

Refresh the Access Server configuration:
```
sacli start
```

Configure using Admin Web UI⁠

Sign in to the Admin Web UI.
Click Access Controls.
- The Group and User Access Rules tab displays.
Click New Access Rule.
Select Group or User as the target.
Select your user or group under Username/Group name.
Add a rule:
- IP address: 0.0.0.0/1
- Reachable via: NAT
Click Save rule.
Click New Access Rule to add a second rule.
Repeat the above steps to select the same User or Group.
Add a rule:
- IP address: 128.0.0.0/1
- Reachable via: NAT
Click Save rule and Restart.

Configure using CLI⁠

Connect to the console and get root privileges.

Use these commands to enable full tunnel for a user, without changing DNS settings:

sacli --user <USER_NAME> --key "type" --value "user_compile" UserPropPut
sacli --user <USER_NAME> --key "access_to.0" --value "+NAT:0.0.0.0/1" UserPropPut
sacli --user <USER_NAME> --key "access_to.1" --value "+NAT:128.0.0.0/1" UserPropPut

Use these commands to enable full tunnel for a group, without changing DNS settings:

sacli --user <GROUP_NAME> --key "access_to.0" --value "+SUBNET:0.0.0.0/1" UserPropPut
sacli --user <GROUP_NAME> --key "access_to.1" --value "+SUBNET:128.0.0.0/1" UserPropPut

Refresh the Access Server configuration:
```
sacli start
```

Can't find what you're looking for?

Our support team will be happy to assist you.

Contact Support Schedule a Demo

Tutorial: Configure Full and Split Tunneling in Access Server⁠

Overview⁠

Prerequisites⁠

How full and split tunneling work in Access Server⁠

Was this information helpful?