Background
As many others I am working from home and we use a VPN to access services from the company intranet (SMB fileshares, git repo, project management etc). To improve things like video calls I suggested to our IT to enable split tunneling to allow traffic not determined for the company intranet to use the home internet connection directly. However this was rejected with the reason that "split tunneling increases the risk for the company intranet".
I tried to understand the risks that arise from split tunnelling, but besides reading "it increases the risk" I did not really find any concrete explanations how an attacker can leverage the split tunnel.
Question
Give a couple of boundary conditions
- employee productivity monitoring or blocking certain sites (unless obviously malicious) is not the reason to require a full tunnel.
- Connecting to the VPN requires a compliance check on the endpoint.
- but: Despite best-effort compliance checks an endpoint might be infected/insecure (e.g. due to a 0day).
- employee himself doesn't do something obviously stupid like bridging the internet connection to the VPN connection.
- Unless requiring services from the intranet endpoints don't use the VPN and use the home internet connection.
- endpoints are not connected directly to the internet but are behind a NAT.
My question is: What are attack scenarios that an attacker can exploit when using a split tunnel, and how would the full tunnel protect from that?
Edits / additions
- On what is monitored, inspected, restricted:
- Terabytes of data flowing out to a suspicious domain might cause raised eyebrowes. But large uploads to popular filesharing sites (e.g. weshare), are normal.
- No deep packet inspection.
- certain ports are blocked (such as, no outgoing ssh or SMTP).
isn't the "blocking ... obviously malicious" not already an argument for using the full tunnel?
and
Do you mean by this that the same system which is used with full VPN to access the company, has at other times unrestricted (and unprotected) access to the internet?
Yes, correct. Endpoints can easily visit any site when they disconnect from the VPN, so while they would be protected when using the you cannot rely on that protection.