My company is using on premise DMZ proxy servers to limit internet access to employees working from home. When they use company laptop, they are automatically configured to go through the proxy server for all traffic. The proxy will then block access to malicious and other unwanted site.

This solution works but is very bandwidth intensive as all traffic is multiplied by 2x. The proxy server is also under heavy ddos attacks (we're trying to figure this out too)

Is there another solution that can help us protect our company laptops and data by blocking dangerous traffic without using proxy servers? How does your company monitor work from home laptop traffic?

Thank you folks

2 Answers 2


There are several ways to secure and restrict internet access to mobile workers. One major idea is to filter at the DNS level, i.e. block name resolution for harmful domains. For example there are products from Cisco and Cloudflare in this area, probably others too. Since this is only filtering the DNS access these solutions are very lightweight. But on the other hand they cannot do any actual content inspection, like scanning the traffic for malware.

Such content inspection can be achieved by a proxy though and this is what you currently use. But instead of having a single proxy installation central in the company with all the overhead and scalability issues you experience, it might be better to have a proxy nearby to the mobile worker.

Nearby can mean on the endpoint itself, usually as part of some centrally managed endpoint protection or antivirus suite. Nearby can also mean in the cloud though. Several classic firewall vendors let you for example install their products in the cloud, but there are also cloud-native managed security solutions from ZScaler, Cloudflare and others.


Another option is to use a cloud-based firewall for remote workers. Palo Alto have Prisma Access (https://www.paloaltonetworks.com/prisma/access) - other firewalls are available, don't want to be a PA shill but they're what I work with.

GlobalProtect portal sits on the Prisma bit, traffic to your on-prem servers routed via there, managed from the same admin portal as your on-prem firewalls.

Not something I've implemented yet but in the distant plans.

Sympathies on the DDOS bit, just jumped through that myself. Multiple ISPs to compare response with...the difference between our best and worst providers was an absolute yawning chasm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .