Configure the intranet VPN (TAP/TUN) to only route intranet traffic

config_tap.bat

@echo off
REM Automaticaly configure your network so that the VPN (TAP) of your intranet
REM provider (employer/campus) won't unintentionally block your access to the
REM Internet while working from home.

REM Change corresponding names and IP ranges to fit your need.
REM Designed for typical home PC behind routers, without PPPoE.
REM The code is provided as-is without warranty.

powershell -command Start-Process powershell -Verb runAs -ArgumentList ^
	'-ExecutionPolicy', 'bypass', '-command', '(Get-Content -Path ^"%cd%\%~nx0^" -Encoding "utf8" -Tail 76) -Join ^'^' ^'^' ^| echo ^| powershell -command -'
if %errorlevel% neq 0 ( pause )
exit

$ErrorActionPreference = "Stop";

function Test-PrivateOrSpecialIP {
	param(
		[string]
		$IP
	)
	
	if ($IP -Match '(^127\.)|(^192\.168\.)|(^10\.)|(^172\.1[6-9]\.)|(^172\.2[0-9]\.)|(^172\.3[0-1]\.)|(^255\.255\.255\.255)|(^22[4-9]\.)|(^23[0-9]\.)|(^0\.0\.0\.0[/$])') {
		$true;
	}
	else {
		$false;
	}
}

$rules = Get-NetRoute -AddressFamily IPv4;

<# detect global routing rule created by vpn #>;
ForEach ($i in $rules) {
	if ($i.DestinationPrefix -eq '0.0.0.0/0' -And $i.InterfaceAlias.StartsWith('Array Networks SSL VPN')){
		$vpnGlobalRule = $i;
	}
}

if (!(Test-Path variable:vpnGlobalRule)){
	echo "Error: Cannot find the default routing rule created by Array Networks SSL VPN.";
	sleep 5;
	exit;
}

$cannotDecideDefaultGateway = $false;

<# detect default gateway from default global routing rule #>;
ForEach ($i in $rules) {
	if ($i.DestinationPrefix -eq '0.0.0.0/0' -And $i -ne $vpnGlobalRule
        -And (Get-NetIPInterface -AddressFamily IPv4 -InterfaceIndex $i.InterfaceIndex).ConnectionState -eq "Connected"){
		if (!(Test-Path variable:defaultGlobalRule)
			-Or $i.InterfaceMetric + $i.RouteMetric
				-lt $defaultGlobalRule.InterfaceMetric + $defaultGlobalRule.RouteMetric
				){
			$defaultGlobalRule = $i;
		}
	}
}

$needsNewGlobalRule = $true;

<# alternatively detect default gateway from vpn's self-pass-through rule #>
if (Test-Path variable:defaultGlobalRule){
	$needsNewGlobalRule = $false;
} else {
	ForEach ($i in $rules) {
		if (!(Test-PrivateOrSpecialIP $i.DestinationPrefix)){
			if (Test-Path variable:defaultGlobalRule){
				$cannotDecideDefaultGateway = $true;
				break;
			}
			$defaultGlobalRule = $i;
		}
	}
}

if ($cannotDecideDefaultGateway){
	echo "Error: Cannot find the default routing rule of your default network adapter.";
	sleep 5;
	exit ;
}

<# remove and adds #>
Remove-NetRoute -DestinationPrefix 0.0.0.0/0 -NextHop $($vpnGlobalRule.NextHop) -InterfaceIndex $($vpnGlobalRule.InterfaceIndex) -Confirm:$false;
if ($needsNewGlobalRule){
	New-NetRoute -DestinationPrefix 0.0.0.0/0 -NextHop $($defaultGlobalRule.NextHop) -InterfaceIndex $($defaultGlobalRule.InterfaceIndex) -RouteMetric $($defaultGlobalRule.RouteMetric) -PolicyStore ActiveStore -Confirm:$false;
}
New-NetRoute -DestinationPrefix 172.16.0.0/12 -NextHop $($vpnGlobalRule.NextHop) -InterfaceIndex $($vpnGlobalRule.InterfaceIndex) -RouteMetric $($vpnGlobalRule.RouteMetric) -PolicyStore ActiveStore -Confirm:$false;