Okay, with all that advice, I gave it another try. I'm also setting up a VirtualBox for my WFH stuff and VB wants to use 10.0.0.0 for its networking. I've changed this to 172.16.0.0 so now I can easily tell that network from work network (which seems to use 10.25.0.0)
I wanted to add a route to NetworkManager's VPN connection. It wants Address, Network, Gateway, and Metric so I gave it "10.0.0.0", "255.0.0.0" (this one shows up automatically), "207.x.y.z", "1". But then VPN fails to start with the complaint that the configuration is invalid. So I tried what I think is the same on the CL: $> route add -net 10.0.0.0/8 gw "207.x.y.z" metric 1 SIOCADDRT: Network is unreachable So apparently, it's not quite as straightforward as I thought it might be. :-)