Solved

Stopping VPN split tunnelling

Posted on 2015-01-05
6
542 Views
Last Modified: 2015-01-08
I have a client which has a draytek vigor 2860 firewall router which is setup for VPN connections.

They have had an IT audit (by their major client) and they must implement controls to prohibit split tunnelling during remote access. The problem is that i need to access their network via VPN on a PC. I understand that by default split tunneling is turned off when creating a vpn connection in windows and usually you would control these setting and lock them down via group policy. My machine isn't part of their network so it cannot be controlled, so i could just enable split tunnelling if i wanted. Is there a VPN client or a setting on the draytek router, where i could lock down VPN settings (prohibit split tunnelling) or use some sort of software to have these settings included and not easily changed by a user on a vpn client?? Or do i need to implement another solution?

Thanks for your help.

Riccardo
0
Comment
Question by:RiccardoQuest
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3
6 Comments
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40531411
Split tunneling is configured on the VPN concentrator (or firewall or whatever device you  are establishing the tunnel to).  It is not configured on the remote access computer.

Is there a reason you want split tunneling?
0
 

Author Comment

by:RiccardoQuest
ID: 40531417
i don't want split tunnelling, i want a method of locking down the client machine settings so they cannot change their settings on their local machines and then enable split tunnelling?
0
 
LVL 50

Expert Comment

by:Don Johnston
ID: 40531423
Clients can't choose between split tunneling and hair pinning.  That's determined on the other end of the tunnel.
0
Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

 

Author Comment

by:RiccardoQuest
ID: 40531434
i understand that if you follow the steps in the below link, that will enable a split tunnel (at the client end) which could have adverse effects on the other network (the one connected via VPN). These settings are all controlled at the client machine.

https://kb.meraki.com/knowledge_base/configuring-split-tunnel-client-vpn-on-windows-and-mac-os-x
0
 
LVL 50

Accepted Solution

by:
Don Johnston earned 500 total points
ID: 40531655
Okay, I see where you're going now. Sorry.

The thing is, that there are many ways of circumventing a VPN which is not configured for split tunneling.  And most of those methods can not be prevented from the HQ side unless they have control over the host.  For example, if it's a company PC, you can lock it down to prevent changes to the configuration or installation of applications which could bypass the "no split tunnel" rules.

If not, there's not much you can do to enforce that.  For example, on my laptop, I have a wired and wireless NIC.  If I use the Cisco VPN client to establish a VPN over the wired NIC, But I can still browse the internet over the wireless NIC.  So having split tunneling disabled isn't stopping me from having my own, unsecured, internet connection.
0
 

Author Comment

by:RiccardoQuest
ID: 40538180
Thanks for your help! I now understand that to fully prevent split tunneling, restrictions need to be applied to the host machine stopping additional hardware being added as well as restricting VPN connectivity setting using Group Policies.
0

Featured Post

Free NetCrunch network monitor licenses!

Only on Experts-Exchange: Sign-up for a free-trial and we'll send you your permanent license!

Here is what you get: 30 Nodes | Unlimited Sensors | No Time Restrictions | Absolutely FREE!

Act now. This offer ends July 14, 2017.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This program is used to assist in finding and resolving common problems with wireless connections.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Monitoring a network: why having a policy is the best policy? Michael Kulchisky, MCSE, MCSA, MCP, VTSP, VSP, CCSP outlines the enormous benefits of having a policy-based approach when monitoring medium and large networks. Software utilized in this v…
Suggested Courses

623 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question