My home network is a simple router + pc's setup, nothing fancy - the router has DHCP enabled for 192.168.0.X (255.255.255.0) and my PC picks up the address 192.168.0.82. There are no devices on my local lan in the 192.168.1.x range.

On my pc i have the DrayTek VPN client, and a company i do some work for has a DrayTek Vigor router. The VPN client establishes a VPN to that remote company using an IPSec Tunnel (PreShared Key - no encryption)

Last night i shut down my pc with the VPN tunnel still connected, when i turned my computer on this morning i accidentally clicked an RDP shortcut to 192.168.1.2 (a host in the remote company) and to my amazement it connected?!? I checked and the DrayTek VPN client isnt running, and when i did run it, it clearly shows "Status: No connection".

confused as to how my machine can still talk to this remote machine i tried a trace:

C:\Users\HeavenCore>tracert 192.168.1.2

Tracing route to C4SERVERII [192.168.1.2]
over a maximum of 30 hops:

  1     *        *        *     Request timed out.
  2     *        *        *     Request timed out.
  3     *        *        *     Request timed out.
  4     *        *        *     Request timed out.
  5     *        *        *     Request timed out.
  6     *        *        *     Request timed out.
  7     *        *        *     Request timed out.
  8     *        *        *     Request timed out.
  9     *        *        *     Request timed out.
 10     *        *        *     Request timed out.
 11     *        *        *     Request timed out.
 12    15 ms    21 ms    32 ms  C4SERVERII [192.168.1.2]

Trace complete.

No indication there as to how it's getting from my network to the remote host.

with my network mask being 255.255.255.0 with ip 192.168.0.1 i dont even see how packets are routing to 192.168.1.1 - unless there was a static route in place, so i checked the route table:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.82    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.0.0    255.255.255.0         On-link      192.168.0.82    266
     192.168.0.82  255.255.255.255         On-link      192.168.0.82    266
    192.168.0.255  255.255.255.255         On-link      192.168.0.82    266
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.0.82    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.0.82    266
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0      192.168.0.1  Default
===========================================================================

As far as i can see, nothing indicating how my packets are getting to 192.168.1.2???

To confirm i was on a different subnet i did an ipconfig /all:

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Marvell Yukon 88E8056 PCI-E Gigabit Ether
net Controller
   Physical Address. . . . . . . . . : 00-23-54-F3-4E-BA
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.82(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1
   DNS Servers . . . . . . . . . . . : 192.168.0.1
                                       208.67.222.222
   NetBIOS over Tcpip. . . . . . . . : Enabled

Yet straight after confirming my ip and subnet as above i can go ahead and ping the remote machine:

C:\Users\HeavenCore>ping 192.168.1.2

Pinging 192.168.1.2 with 32 bytes of data:
Reply from 192.168.1.2: bytes=32 time=48ms TTL=127
Reply from 192.168.1.2: bytes=32 time=23ms TTL=127
Reply from 192.168.1.2: bytes=32 time=103ms TTL=127
Reply from 192.168.1.2: bytes=32 time=25ms TTL=127

Ping statistics for 192.168.1.2:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 23ms, Maximum = 103ms, Average = 49ms

Also, note on the ping how the times are 35ms ish, this clearly shows the pings are to the remote host and not something on my local lan (all stuff on my local lan pings in 0ms) - plus i verified the host was actually the host via RDP.

My Question: Can an IPSec tunnel stay up some how after a reboot without use of the VPN client? (well, i can clearly see that it can) - where in windows is there visibility of this? how does my machine know where to route the packets?

I appreciate any insights & thoughts!