5 ms·
Agreed. Split-Tunneling is also a simple solution where you end up using home internet bandwidth for things like MS Teams/Zoom/etc. and the rest goes over the V
by unfocused 6y ago
Agreed. Split-Tunneling is also a simple solution where you end up using home internet bandwidth for things like MS Teams/Zoom/etc. and the rest goes over the VPN. For generic large corporations or governments, this is a good enough solution. Email and documents are not bandwidth hogs.
That should be the first step, and after that, you start getting into detailed analysis as each business has its specific needs.
- blakes 6y agoSplit-tunnel has solved all of our bandwidth and performance issues, and it's so easy.
- Fredej 6y agoWe recently moved _away_ from split tunneling. It's still giving me headaches. Not just performance, but things like docker containers don't always work right.
- xxpor 6y agoSplit tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traffic to those providers? Probably not.
- abfan1127 6y agoI thought that all access to EC2/Azure IPs is over HTTPS or SSH so you don't need to tunnel to it. We use split tunnel for my work, all of my work's IPs go through the tunnel. Everything else is the individual HTTPS or SSH connection. If you were within your corporate wall, you'd still need HTTPS to get to Azure from inside, right?
- droopyEyelids 6y agoAside from accessing intranet resources: Is the corporate VPN for encrypting Internet traffic, or is it for proxying and monitoring employee traffic? Without answering that question, you can't discuss what makes sense.
- abfan1127 6y agoour corp VPN is for accessing internal sensitive documents. I'm sure there is some level of monitoring, but it isn't the first priority. I work for a large US Corp so we have lots of design, specs, reviews and other paperwork to access.
- gruez 6y agobut all the VPNed resources would be under private IPs anyways? In that case you only need your VPN to route traffic to your company's subnet.
- xxpor 6y agoMost companies want all general internet traffic to go through the VPN so they can filter/record/do whatever to it. The sites that are split tunneled are usually trusted internal (in that they're owned by the company, or used for a known service like email) or known high bw but safe (like youtube)
- c0nsumer 6y agoNot always, thankfully... Newer versions of Cisco AnyConnect (for example) can do name-based split tunnel. The client resolves the address then dynamically adds a route for the split tunnel as it's needed. It works excellently for cloud-hosted stuff.
- xxpor 6y agoAh that's quite interesting. There how do they work around the client controlling the DNS server? I suppose part of the session setup could be sending anyconnect a known trusted DNS server address.
- c0nsumer 6y agoI believe the DNS gets assigned to the client during the VPN session setup. And this is watched, and if something tries to change it, it shuts down the tunnel.
- deleted 6y ago[deleted]
- Cthulhu_ 6y agoWe run our own hardware (due to security concerns, our work is in mobile infrastructure) and have both a split and full VPN; I'm usually on the split one. Our code, task management and dev/test VMs go through the VPN, the rest over the open internets. The security argument we have is a bit hit and miss though, since our e-mail is at a random hosting provider (doesn't even have calendar support) and most of our other comms goes through services like Skype, Zoom, etc.