0

I was using my own home personal computer on a weekend while connected to my work's VPN (it's called pulse secure), and was bored so I decided to look at some "non-work" related websites (possibly/definitely nsfw stuff). Am I exposed? Can they see all my activity? Obviously I don't know anything about this stuff so please help me out cause I'm kinda panicking.

Edit: Added Route Table Below

===========================================================================
Interface List

13...02 05 85 7f eb 80 ......Juniper Networks Virtual Adapter

15...60 45 cb 81 cc d8 ......Intel(R) Ethernet Connection (2) I219-V
  1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.158     25

0.0.0.0          0.0.0.0         On-link      10.2.100.225      1

10.2.100.225  255.255.255.255         On-link      10.2.100.225    256

127.0.0.0        255.0.0.0         On-link         127.0.0.1    331

127.0.0.1  255.255.255.255         On-link         127.0.0.1    331

127.255.255.255  255.255.255.255         On-link         127.0.0.1    331

151.188.247.203  255.255.255.255      192.168.1.1    192.168.1.158     25

192.168.1.0    255.255.255.0         On-link     192.168.1.158    281

192.168.1.158  255.255.255.255         On-link     192.168.1.158    281

192.168.1.255  255.255.255.255         On-link     192.168.1.158    281

224.0.0.0        240.0.0.0         On-link         127.0.0.1    331

224.0.0.0        240.0.0.0         On-link     192.168.1.158    281

224.0.0.0        240.0.0.0         On-link      10.2.100.225    256

255.255.255.255  255.255.255.255         On-link         127.0.0.1    331

255.255.255.255  255.255.255.255         On-link     192.168.1.158    281

255.255.255.255  255.255.255.255         On-link      10.2.100.225    256

===========================================================================

Persistent Routes:

None

Edit:

Via company's IT handbook: "All user activity on any County information system and County-approved mobile communications or fixed devices is subject to monitoring, logging, auditing, review, dissemination and archiving"

I'm pretty sure this quote answers my question.

  • 1
    There's no way to answer that question without knowing how the VPN is configured. If it tunnels all traffic (private and public) through it, yes they can see what you went to. If they don't (if it only routes private traffic through the tunnel but leaves internet traffic to route through your own provider), they could still see the DNS queries if they force you to use their DNS servers instead of your own or public servers. – Jesse P. Aug 25 '18 at 14:50
  • 2
    If you can connect to the VPN and grab a copy of the route table it provides to you once connected, we can answer more accurately. – Jesse P. Aug 25 '18 at 14:51
  • It does look like they advertise a default route to you. If you want to test it out just to be sure, while NOT connected to the VPN, go to whatismyip.com and note your IP, then connect to the VPN and do the same test. If the IP matches, they are not routing internet traffic through the VPN; if it doesn't match, they are routing internet traffic through the VPN (in which case they COULD see you what you went to, but it would still depend on if they have logging enabled for that purpose or if they have some kind of proxy they route traffic through that might log traffic). – Jesse P. Aug 25 '18 at 15:18
  • yeah the ip addresses are different...so that sucks – James Smith Aug 25 '18 at 15:25
  • 1
    It's possible that they killed the traffic due to over- utilization of bandwidth and maybe hurting other people's speeds but I'm not sure I would look too far into it being probable (that may just be me, though). – Jesse P. Aug 25 '18 at 16:10
2

I think they can. Assuming that the 192.168.1.0 network is your home-network and the 10.2.100.0 network the VPN network, this line in your routing table:

Network Destination Netmask Gateway Interface Metric

0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.158 25

0.0.0.0 0.0.0.0 On-link 10.2.100.225 1

Show that the VPN Gateway has a lower Metric value than your home gateway. This means that all routing to any IP address (0.0.0.0) will first be TRIED over the VPN.

If the VPN is configured to block this, your normal route will be followed, but, technically, your company can LOG packets incoming on the VPN interface.

So to your question, "CAN they see what I'm doing", the answer is, yes, likely.

  • If they were "blocking" it, it wouldn't be advertised in the first place. Also, in my opinion, this should not be listed as answer as nothing you said is conclusive and is all based upon assumption just as was discussed already in the above comments. – Jesse P. Aug 25 '18 at 15:41
  • So this is not a possible answer based on the routing tables? Could you also elaborate on it wouldn't be advertised in the first place ? – Nomad Aug 25 '18 at 15:44
  • When you define a client VPN, you essentially advertise which routes you want sent over the VPN. You can just route specific private networks/hosts over it, route ALL traffic through it (which is what we know this person's is doing), or route private and SOME public over it but not others). The presence of the default route means that the VPN is configured to receive all traffic originating from the client. If they don't actually want all traffic from the client the VPN appliance would not be set to tunnel ALL traffic - it would be set to only tunnel specific/explicit routes. – Jesse P. Aug 25 '18 at 15:48
  • 1
    I was talking about iptables -A INPUT -p tcp -i tap0 --dport 80 -j LOGNDROP kind of 'blocking'. Which wouldn't affect advertisement of routing tables as far as I know. Should've specified that. – Nomad Aug 25 '18 at 15:50
  • I say it's not an answer (as opposed to speculation) because it doesn't actually answer anything about whether the company can see what the use did, conclusively. There is no way to know that from the info the user is able to gather. Therefore, it should just be a comment, as far as I'm concerned. If you want to keep it as an answer, that's your call. It was just a suggestion. – Jesse P. Aug 25 '18 at 15:51
2

The simplest way to check is to go to whatismyip.com and find out your IP. Then connect to the VPN and try again. If you get the same IP, then they are using a "split tunnel" VPN which means only your traffic for the company network will go over it.

If you see a different IP, then it's likely they are doing "full tunnel" VPN and will have seen your traffic. You can do a WHOIS on the IP to confirm who it belongs to.

That said, if you are on your personal computer in your own time then they likely can't/won't do anything unless what you were looking at was actually illegal rather than just NSFW. Your security team might look at you funny though.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.