8

I need to connect to a VPN to work remotely on certain tasks. While working on a remote network through a VPN connection, I may also want other network connections to not go through the VPN. For example, let's say I'm editing a remote file through a VPN connection, and I also want to stream music while doing so but I don't want the music stream to go through the remote VPN connection. A more sensitive example would be if I have confidential data transfers happening while I'm connecting to a VPN that is for a separate set of confidential data transfers - how would I keep track of, separate, and monitor the two? Using a Virtual Machine, or by some other means?

Ultimately the question is: How can one determine and control the extent of data passing through a VPN connection?

I'd say please explain it like I'm five, but I know just enough to know it may be too much for a five year old...anyway, please answer as if to a novice.

Improve this question
3
  • 1
    The simplest way would be to use a virtual machine that has the VPN connection enabled and transfer sensitive data over the host machine's network. Also, look into end-to-end encrypted messaging programs to make sure the confidential data veritably remains confidential.
    – bvpx
    Apr 17, 2017 at 20:06
  • 1
    The situation you describe sounds like a VPN client installed locally on a system and connecting to the remote gateway/VPN concentrator/network. Depending on the configuration of the locally installed client, you may not be able to control what uses the VPN tunnel and what uses local LAN resources. If a corporate VPN solution, the client is sometimes hardened to deny networking that isn't explicitly using the VPN tunnel. How to determine the case? It varies widely based on OS, VPN client, etc. @bvpx makes a good suggestion with VMs.
    – 0xSheepdog
    Apr 17, 2017 at 21:55
  • Those are both helpful answers. If you make your comment an answer, I'll upvote and potentially accept. To beef up the answer, could include more info about using VMs to do this and/or info about data using the VPN tunnel vs. LAN resources and how that could be monitored.
    – cr0
    Apr 17, 2017 at 22:14

2 Answers 2

Reset to default
12
+25

VPNs have two main routing modes:

  • Full tunnel - All network traffic is routed through the VPN
  • Split tunnel - Network traffic for specific ranges is sent through the VPN, but general Internet traffic is not.

Many corporate VPNs operate in full tunnel mode to give their network team more control. For example, you can only browse the Internet through the corporate filtering proxy. Some VPN clients go to great lengths to enforce full tunnel mode, and some laptops are configured so there is no direct Internet access at all, and you have to connect to the VPN to do anything.

A simple way to investigate is to browse to whatsmyip.org and see whether this is your home or work IP address. Or you can use the "route" command to view the routing table. Look for the default route (0.0.0.0) - and see if the default gateway is your local router, or the VPN endpoint. You can also use network monitors (e.g. nettop on Linux; Windows Task Manager has a simple one) to monitor the amount of traffic going through the VPN. It's not so easy to monitor the non-VPN traffic, as the local interface traffic includes the encrypted VPN tunnel.

A common scenario is that your VPN if configured in full-tunnel mode, and you want split-tunnel. If you have control over the VPN software you can configure it to perform split tunnelling e.g. with OpenVPN look at the redirect-gateway configuration option. If your VPN client is locked down, then a good option is to run the VPN within a Virtual Machine. That VM will operate in full-tunnel mode, but network traffic from the host (or other VMs) will not.

Improve this answer
2
  • How do you use the route command as you suggest?
    – theonlygusti
    Aug 13, 2021 at 20:26
  • @theonlygusti - You use "route print". You'll need to read up a bit to interpret the output; plenty of info online
    – paj28
    Aug 14, 2021 at 16:49
1

You can control this by routing configuration. Detailed configuration instructions depends on your operating system and VPN type but here is an example how you can achieve it with OpenVPN:https://community.openvpn.net/openvpn/wiki/IgnoreRedirectGateway. This will work for 'music stream' example - music stream will not go over VPN in case of simultaneous VPN connections configuration is more complex but idea is the same. You can find more information on routing configuration in Linux here: https://www.cyberciti.biz/faq/howto-linux-configuring-default-route-with-ipcommand/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .