In a recent post, I described how to configure routing for Windows 10 Always On VPN clients. In that article, I shared guidance for disabling the class-based default route in favor of defining specific routes for the VPN client. While this is easy enough to do when you use custom XML (deployed via PowerShell, SCCM, or Intune), there is a known limitation when using the native Intune UI that could present some challenges.
Updated 11/9/2024 to include update information for a workaround using Intune Remediation.
Intune VPN Profile Configuration
Defining specific routes is easy to do in Intune using the native VPN configuration profile. In the Configuration settings expand Split Tunneling and click Enable. The administrator can then add routes by entering their Destination prefix and Prefix size, as shown here.
Class-Based Default Route
The limitation with using Intune to configure routes is that there is currently no option to disable the class-based default route as there is with custom XML. This means the routes shown in the example above will be added to the client, but the class-based route will also be added automatically, as shown here (class-based default route highlighted with the arrow).
Considerations
In most cases, the inclusion of the class-based default route along with the administrator-defined routes will not be a problem. However, in some scenarios, it could yield unexpected results. Specifically, Always On VPN clients may have unintended access to some networks over the VPN tunnel. This is most significant for the Always On VPN device tunnel, where it is common to limit access to only specific resources using individual host routes.
Workaround
As a workaround, administrators can use Intune Remediations to disable the class-based default route post-deployment. Sample detection and remediation scripts for the user and device tunnel can be found here.
Additional Information
Deploying Windows 10 Always On VPN with Intune and Custom XML
Deploying Windows 10 Always On VPN Device Tunnel with Intune and Custom XML
Windows 10 Always On VPN Routing Configuration
Windows 10 Always On VPN Device Tunnel Operation and Best Practices
Administrators configuring a Windows Server Routing and Remote Access Service (RRAS) server to support Windows 10 Always On VPN connections may encounter an issue where the RemoteAccess service fails to start. Attempts to start the service might seem to work at first, but the service immediately stops again.
