I was using my own home personal computer on a weekend while connected to my work's VPN (it's called pulse secure), and was bored so I decided to look at some "non-work" related websites (possibly/definitely nsfw stuff). Am I exposed? Can they see all my activity? Obviously I don't know anything about this stuff so please help me out cause I'm kinda panicking.

Edit: Added Route Table Below

Interface List

13...02 05 85 7f eb 80 ......Juniper Networks Virtual Adapter

15...60 45 cb 81 cc d8 ......Intel(R) Ethernet Connection (2) I219-V
  1...........................Software Loopback Interface 1

IPv4 Route Table
Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric     25         On-link      1         On-link    256         On-link    331         On-link    331         On-link    331     25         On-link    281         On-link    281         On-link    281         On-link    331         On-link    281         On-link    256         On-link    331         On-link    281         On-link    256


Persistent Routes:



Via company's IT handbook: "All user activity on any County information system and County-approved mobile communications or fixed devices is subject to monitoring, logging, auditing, review, dissemination and archiving"

I'm pretty sure this quote answers my question.

  • 1
    There's no way to answer that question without knowing how the VPN is configured. If it tunnels all traffic (private and public) through it, yes they can see what you went to. If they don't (if it only routes private traffic through the tunnel but leaves internet traffic to route through your own provider), they could still see the DNS queries if they force you to use their DNS servers instead of your own or public servers.
    – Jesse P.
    Commented Aug 25, 2018 at 14:50
  • 2
    If you can connect to the VPN and grab a copy of the route table it provides to you once connected, we can answer more accurately.
    – Jesse P.
    Commented Aug 25, 2018 at 14:51
  • It does look like they advertise a default route to you. If you want to test it out just to be sure, while NOT connected to the VPN, go to whatismyip.com and note your IP, then connect to the VPN and do the same test. If the IP matches, they are not routing internet traffic through the VPN; if it doesn't match, they are routing internet traffic through the VPN (in which case they COULD see you what you went to, but it would still depend on if they have logging enabled for that purpose or if they have some kind of proxy they route traffic through that might log traffic).
    – Jesse P.
    Commented Aug 25, 2018 at 15:18
  • yeah the ip addresses are different...so that sucks Commented Aug 25, 2018 at 15:25
  • 1
    It's possible that they killed the traffic due to over- utilization of bandwidth and maybe hurting other people's speeds but I'm not sure I would look too far into it being probable (that may just be me, though).
    – Jesse P.
    Commented Aug 25, 2018 at 16:10

2 Answers 2


I think they can. Assuming that the network is your home-network and the network the VPN network, this line in your routing table:

Network Destination Netmask Gateway Interface Metric 25 On-link 1

Show that the VPN Gateway has a lower Metric value than your home gateway. This means that all routing to any IP address ( will first be TRIED over the VPN.

If the VPN is configured to block this, your normal route will be followed, but, technically, your company can LOG packets incoming on the VPN interface.

So to your question, "CAN they see what I'm doing", the answer is, yes, likely.

  • If they were "blocking" it, it wouldn't be advertised in the first place. Also, in my opinion, this should not be listed as answer as nothing you said is conclusive and is all based upon assumption just as was discussed already in the above comments.
    – Jesse P.
    Commented Aug 25, 2018 at 15:41
  • So this is not a possible answer based on the routing tables? Could you also elaborate on it wouldn't be advertised in the first place ?
    – Nomad
    Commented Aug 25, 2018 at 15:44
  • When you define a client VPN, you essentially advertise which routes you want sent over the VPN. You can just route specific private networks/hosts over it, route ALL traffic through it (which is what we know this person's is doing), or route private and SOME public over it but not others). The presence of the default route means that the VPN is configured to receive all traffic originating from the client. If they don't actually want all traffic from the client the VPN appliance would not be set to tunnel ALL traffic - it would be set to only tunnel specific/explicit routes.
    – Jesse P.
    Commented Aug 25, 2018 at 15:48
  • 1
    I was talking about iptables -A INPUT -p tcp -i tap0 --dport 80 -j LOGNDROP kind of 'blocking'. Which wouldn't affect advertisement of routing tables as far as I know. Should've specified that.
    – Nomad
    Commented Aug 25, 2018 at 15:50
  • I say it's not an answer (as opposed to speculation) because it doesn't actually answer anything about whether the company can see what the use did, conclusively. There is no way to know that from the info the user is able to gather. Therefore, it should just be a comment, as far as I'm concerned. If you want to keep it as an answer, that's your call. It was just a suggestion.
    – Jesse P.
    Commented Aug 25, 2018 at 15:51

The simplest way to check is to go to whatismyip.com and find out your IP. Then connect to the VPN and try again. If you get the same IP, then they are using a "split tunnel" VPN which means only your traffic for the company network will go over it.

If you see a different IP, then it's likely they are doing "full tunnel" VPN and will have seen your traffic. You can do a WHOIS on the IP to confirm who it belongs to.

That said, if you are on your personal computer in your own time then they likely can't/won't do anything unless what you were looking at was actually illegal rather than just NSFW. Your security team might look at you funny though.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .