2

At my work there are certain internal sites which I can access from my home but only through my work laptop. I wonder how this works. When my work laptop is connected to the corpnet, it has one IP address. When the machine is connected to my home network it has another IP address. Still the server is somehow able to distinguish whether I am trying to access the site from my work laptop or personal laptop. How is this possible?

1

There's a few different things that could lead to this.

There could be a VPN that's automatically established for you for those hosts, even if you use another VPN at work. Many enterprise VPN clients can have complex configurations, and are able to detect whether they are on your corporate network or not to perform the VPN connection.

Another possibility is that your computer is configured to use specified DNS servers instead of those provided by your home router or ISP. In that case, your work DNS servers might be able to return results for the affected sites while your home computer is not able to resolve those hostnames.

In some (higher security) environments, computers are issued SSL client certificates (often backed by a TPM-stored key). In that case, the server can look for the certificate to verify the incoming connection as being from an authorized client (your work laptop) and only allow access to those hosts.

| improve this answer | |
0

The most common way this sort of control is implemented is via a VPN and firewall rules: the server only allows traffic from a certain set of IPs (or it's not externally accessible at all), and that set includes both the subnet that computers in the office get and the IP of the VPN server. So when you're out of the office, your computer connects to the VPN and traffic is tunneled through there. This may not be obvious, since VPNs can be set up to only tunnel some traffic, so if you visit whatismyip.com or similar it may still show your home ISP.

| improve this answer | |
  • Thanks. But I don't think I connect to a VPN at home. – morpheus Oct 15 '17 at 19:40
  • Are you sure? If it's a work-provided laptop, it may be set up to do that automatically, and not be obvious that it's doing so. (Or it could not be a VPN, we can't really tell from this side of the internet.) You can also just ask your IT department instead of trying to reverse-engineer it. ;) – Xiong Chiamiov Oct 16 '17 at 23:08
  • Yes I think I am sure because I connect to a VPN at work sometimes to access some domains. – morpheus Nov 4 '17 at 21:01
0

In addition to the responses about VPNs and DNS and such, there are some other possibilities.

Browsers perform a lot of authentication automatically. If your work machine is domain-joined and you visit a site that expects NTLM authentication, most Windows browsers will automatically authenticate. If you're not using a domain-joined computer, or possibly just if you're not signed into a domain account (depending on whether it's looking for a domain user or machine credential), you won't be able to get in (you might get prompted to enter your domain credentials, but sometimes non-domain machined will just get rejected). Another possibility in this vein is TLS client certificates; your work machine may have some client certificates installed that it uses to automatically identify itself to certain TLS servers (e.g. an HTTPS server) and your home machine, lacking the required cert, will be unable to connect.

Servers can be configured to require IPsec, and clients configured to use it. IPsec is a way to secure network traffic at a lower level than things like TLS or SSH (which are application-level and require the application that is communicating over the network to do the encryption/decryption/signing/verification/etc. itself). IPsec can be (and often is) used to establish the secure tunnel for a VPN (as can TLS, which is how OpenVPN works), but it can also be used to secure communication with specific hosts or networks.

Unlike TLS, each machine that wants to establish an IPsec connection to particular network/host must be configured for that connection. Your work machine would receive IPsec configurations for your corporate network, but your personal machine wouldn't have them, and the corporate servers would therefore refuse the connection. As with corporate VPNs, it would generally be a breach of company policy to export the configuration from a company-owned machine to a personal one.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.