Where does my traffic go when I use a VPN? Tcpdump shows no outgoing traffic when VPN enabled - vpn

Question

I have two machines, machine A sending packets to machine B.
If I use
tcpdump -i <interface> udp port <port>
on machine A, I can see the traffic going out.
However when I enable the VPN, I then see nothing coming out of that port.
And I would like to understand why.
The VPN is IPsec based which I understand encrypts the packets, and has the tunneling mode as a typical default.
I was going through some stuff on IPsec VPNs and saw it mentioned that the VPN sends the packets out of different ports. I saw port 4500 mentioned in a number of places, as well as some other port numbers.
I did try these port listed but saw nothing at any of them.
Is my issue that I am preforming the traffic dump at the wrong port? If so is there a way to determine which port the outgoing traffic of machine A is leaving from?
If it is another issue, what might it be? Is it possible to monitor my outgoing traffic from a machine with a VPN tunnel enabled?

Answer 1

When you initially capture packets, you are seeing traffic on your default interface (whichever that is). When you enable your VPN, part of the setup process is to make the VPN virtual interface the default interface. Depending on your system, this will mean giving the VPN interface a higher routing metric or higher routing priority in the list.
After you enable your VPN connection, your routing table should change (see below). You should also see the name of your VPN connection with these commands (as new default interface), which can be used as the interface name with tcpdump. Note that depending on your system/VPN solution, you might need to do additional configuration to get the necessary vpn interface name.
Route metrics on various systems
netstat -rn will show you the routing table on most systems (Windows, Macos, Linux, BSD, ...), but won't show you the routing metrics.
The following commands will show you routing metrics (with sample output shown). As you can see, on Ubuntu/Windows, there's a routing metric number, but on Macos, there's a routing ordering. The way you change the routing ordering in Macos is to literally just change the list order like networksetup -ordernetworkservices service1, service2...
Ubuntu 18.04
$ route -n
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 10.0.2.2 0.0.0.0 UG 100 0 0 enp0s3
10.0.2.0 0.0.0.0 255.255.255.0 U 100 0 0 enp0s3
169.254.0.0 0.0.0.0 255.255.0.0 U 1000 0 0 enp0s3
Macos 10.15
$ networksetup -listnetworkserviceorder
An asterisk (*) denotes that a network service is disabled.
(1) AX88179 USB 3.0 to Gigabit Ethernet
(Hardware Port: AX88179 USB 3.0 to Gigabit Ethernet, Device: en5)
(2) Wi-Fi
(Hardware Port: Wi-Fi, Device: en0)
(3) Bluetooth PAN
(Hardware Port: Bluetooth PAN, Device: en3)
(4) Thunderbolt Bridge
(Hardware Port: Thunderbolt Bridge, Device: bridge0)
(5) Corporate VPN
(Hardware Port: L2TP, Device: )
Windows 10
C:\Users\rj>route print
===========================================================================
Interface List
5...08 00 27 04 b9 fa ......Intel(R) PRO/1000 MT Desktop Adapter
3...02 00 4c 4f 4f 50 ......Npcap Loopback Adapter
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.2.2 10.0.2.15 25
10.0.2.0 255.255.255.0 On-link 10.0.2.15 281
10.0.2.15 255.255.255.255 On-link 10.0.2.15 281
...