What information is sent through companies VPNs?

Question

I'm currently working at home. My employer provides me a VPN access to the company resources: intranet, ssh access to computers, etc. I was wondering what exactly means to use a VPN, and what type of information my employer can "see" of my use of the internet. Is all traffic routed through my company, so they can see what I do with my internet connection? I doubt it for various reasons:

• there is some little information provided by the client that mentions the number of bytes transferred, which are a always small numbers
• when I check my IP through internet services, or even I try to geolocalise me, I get the same result before and after connecting the VPN.
• I doubt my company is willing to afford the resources required to route the traffic of all their employees (and my connection is not sensibly affected when I use the VPN)

I have the impression that only "relevant traffic towards the company" is routed through the VPN, whereas the general use of the internet such as Youtube, for instance, is not channeled through the VPN. Does this make any sense?

To give some details of my connection that can be used to resolve my question, I use Forticlient, although I have recently discovered I can also use openfortivpn, that has the advantage of being scriptable. Other than this, I don't know many details of the connection and how it is performed.

How can I gather more information of what information is exactly being sent to my employer through the VPN? Should I disconnect it whenever it is not strictly necessary for my work?

Answer 1

As I understand, what traffic is being sent through VPN is primarily depending on routing options specified after you connect to VPN. As this configuration depends upon the company's policy, it's impossible to predict how it is configured in your case. From my experience, usually only corporate resources (mostly 10.x.x.x) would be routed through VPN, but that may vary heavily.

To have a brief grasp of what's going on, you can reboot your computer (or just disconnect the VPN, but I personally prefer the good ol' reboot) and execute "route print" or "netstat /r" command to see how your routing works by default. Save this output to some file, connect to VPN, and issue the same commands again. Then compare the results - most probably, you'll notice some differences, and should be able to understand how your traffic goes.

Unfortunately, that's not the only thing to check. Many other things are there - for example, DNS servers are also usually switched to corporate, and in this case if you'll try to visit "PornHub.com", DNS request will actually go through the company's DNS server, allowing to see what website were you trying to browse.

Also, if your computer is managed by your company (e.g. it is domain-joined), your system proxy might be changed to company proxy, allowing the company full visibility over all the traffic generated by applications that are using system proxy. Of course, if your computer is managed and contains user monitoring software or EDR agent - all your actions are also in plain sight, probably even without VPN.

Lastly, all the above is related to "traditional" VPNs. There are also technologies that allow "software defined networks", which can route traffic individually for each selected application, but I don't know much about it.

Having said all that... I don't think the companies usually care that much about what end users are doing. Infosec divisions are always understaffed, and they have huge load apart from looking for websites any individual user is visiting. So nobody cares man, chill)

P.S. And yes, always worth disconnecting VPN if not needed, e.g. in the end of the day, just to be sure nothing is leaking)