FortiClient VPN Split Routing Configuration and Route Testing

for cidr in default 0.0.0.0/1 128.0.0.0/1; do
  sudo route -q -n delete -ifscope "$VPN_IF" "$cidr"
done

if ! sudo route -n change default "$LOCAL_GW"; then
  sudo route -n add default "$LOCAL_GW"
fi

sudo route -n add -net 10.0.0.0/8 "$VPN_PEER"

sudo route -n change -net 10.0.0.0/8 "$VPN_PEER"

bash forticlient_split.sh 10.1.1.1 192.168.0.100 google.com

chmod +x forticlient_split.sh
./forticlient_split.sh 10.1.1.1 192.168.0.100 google.com

#!/usr/bin/env bash
# =============================================================================
# FortiClient VPN Split Routing with Enhanced Output
#
# This script resets FortiClient–injected routes, restores the local default
# gateway for non-VPN traffic, binds the 10.0.0.0/8 network to the VPN, and
# then shows rich diagnostics: routing tables, interface mappings, and
# connectivity tests (ping).
#
# Usage:
#   forticlient_split.sh [ -h | --help ] host1 [host2 ...]
#
# Options:
#   -h, --help    Show this help message and exit.
# =============================================================================

set -euo pipefail
IFS=$'\n\t'

# -----------------------------------------------------------------------------
# Error and Info Helpers
# -----------------------------------------------------------------------------

# die prints an error message and exits with status 1.
# Arguments:
#   $@: The error message to display.
die() {
  printf '❌ %s\n' "$*" >&2
  exit 1
}

# info prints an informational message.
# Arguments:
#   $@: The message to display.
info() {
  printf 'ℹ️  %s\n' "$*"
}

# -----------------------------------------------------------------------------
# Utility Functions
# -----------------------------------------------------------------------------

# get_vpn_interface finds the first utun/tun/ppp interface with a PtP address.
# Returns:
#   Prints the interface name or nothing if not found.
get_vpn_interface() {
  while read -r iface; do
    iface=${iface%:}
    if ifconfig "$iface" | grep -q 'inet .*-->'; then
      printf '%s\n' "$iface"
      return
    fi
  done < <(ifconfig | awk '/^(utun|tun|ppp)[0-9]+:/{print $1}')
}

# get_vpn_peer obtains the Point-to-Point peer IP for a given VPN interface.
# Args:
#   $1: Interface name (e.g. utun4)
# Returns:
#   Prints the peer IP or nothing if not found.
get_vpn_peer() {
  local iface="$1"
  ifconfig "$iface" | awk '/inet / && /-->/ {
    for (i = 1; i <= NF; i++) {
      if ($i == "-->") { print $(i+1); exit }
    }
  }'
}

# get_local_gateway finds the non-VPN default gateway.
# Returns:
#   Prints the gateway IP or nothing if not found.
get_local_gateway() {
  netstat -rn \
    | awk '$1=="default" && $NF !~ /(utun|tun|ppp)/ { print $2; exit }'
}

# iface_of returns the interface used to reach a host.
# Args:
#   $1: Hostname or IP
# Returns:
#   Prints the interface name.
iface_of() {
  route get "$1" 2>/dev/null \
    | awk '/interface:/{print $2}'
}

# show_route_info prints current routes for default and 10.0.0.0/8.
show_route_info() {
  printf '\n──────────────────────────────────────────────────\n'
  info "🔎 Current Default Route:"
  route get default 2>/dev/null | awk 'NR<=5'
  info "🔎 Current 10.0.0.0/8 Route:"
  route get 10.0.0.1 2>/dev/null | awk 'NR<=5'
  printf '──────────────────────────────────────────────────\n\n'
}

# test_connect tests ping connectivity to a host.
# Args:
#   $1: Hostname or IP
test_connect() {
  local host="$1"
  printf '   ↳ Testing %s: ' "$host"
  if ping -c2 -W1 "$host" &>/dev/null; then
    printf '✅ Reachable\n'
  else
    printf '❌ Unreachable\n'
  fi
}

# -----------------------------------------------------------------------------
# Usage
# -----------------------------------------------------------------------------

usage() {
  cat <<-EOF
Usage: $(basename "$0") [ -h | --help ] host1 [host2 ...]
Options:
  -h, --help    Show this help message and exit.
EOF
  exit 0
}

# -----------------------------------------------------------------------------
# Main
# -----------------------------------------------------------------------------

# Parse flags.
if [[ "${1-}" =~ ^-h|--help$ ]]; then
  usage
fi

# Collect hosts.
HOSTS=("$@")
(( ${#HOSTS[@]} )) || die "Please specify at least one host."

# 1. Detect VPN interface and gateways.
info "🔍 Detecting VPN interface and local gateway"
VPN_IF=$(get_vpn_interface)                         || die "Cannot find VPN interface (utun/tun/ppp)."
VPN_PEER=$(get_vpn_peer "$VPN_IF")                  || die "Unable to get VPN Point-to-Point peer IP."
LOCAL_GW=$(get_local_gateway)                       || die "Cannot find local gateway."
info "   • VPN Interface: $VPN_IF"
info "   • VPN Peer: $VPN_PEER"
info "   • Local Gateway: $LOCAL_GW"

# Show current routes before changes
show_route_info

# 2. Reset routes injected by FortiClient.
info "🧹 Removing FortiClient injected forced routes"
for cidr in default 0.0.0.0/1 128.0.0.0/1; do
  sudo route -q -n delete -ifscope "$VPN_IF" "$cidr" 2>/dev/null || true
done

# 3. Restore local default gateway.
info "🚧 Setting local default route ➜ $LOCAL_GW"
if ! sudo route -n change default "$LOCAL_GW" 2>/dev/null; then
  sudo route -n add default "$LOCAL_GW"
fi

# 4. Bind 10.0.0.0/8 to VPN.
info "🔗 Binding 10.0.0.0/8 ➜ $VPN_PEER ($VPN_IF)"
if ! sudo route -n add -net 10.0.0.0/8 "$VPN_PEER" 2>/dev/null; then
  sudo route -n change -net 10.0.0.0/8 "$VPN_PEER"
fi

# Show current routes after changes
show_route_info

# 5. Verify routing interfaces and connectivity.
info "🌐 Testing routing interfaces and connectivity"
for host in "${HOSTS[@]}"; do
  actual_if=$(iface_of "$host" || echo "Unknown")
  if [[ $host == 10.* ]]; then
    expected_if="$VPN_IF"
  else
    expected_if="Local (non-VPN)"
  fi
  printf '   • %-15s ➜ Interface %-8s (expected %s)\n' \
    "$host" "$actual_if" "$expected_if"
  test_connect "$host"
done

info "🎉 Configuration, routing, and connectivity tests completed"