0

I'm currently working at home. My employer provides me a VPN access to the company resources: intranet, ssh access to computers, etc. I was wondering what exactly means to use a VPN, and what type of information my employer can "see" of my use of the internet. Is all traffic routed through my company, so they can see what I do with my internet connection? I doubt it for various reasons:

  • there is some little information provided by the client that mentions the number of bytes transferred, which are a always small numbers
  • when I check my IP through internet services, or even I try to geolocalise me, I get the same result before and after connecting the VPN.
  • I doubt my company is willing to afford the resources required to route the traffic of all their employees (and my connection is not sensibly affected when I use the VPN)

I have the impression that only "relevant traffic towards the company" is routed through the VPN, whereas the general use of the internet such as Youtube, for instance, is not channeled through the VPN. Does this make any sense?

To give some details of my connection that can be used to resolve my question, I use Forticlient, although I have recently discovered I can also use openfortivpn, that has the advantage of being scriptable. Other than this, I don't know many details of the connection and how it is performed.

How can I gather more information of what information is exactly being sent to my employer through the VPN? Should I disconnect it whenever it is not strictly necessary for my work?

2
  • 1
    I assume that you can successfully connect to internal company resources, confirming the VPN is actually working? Assuming yes, then your other descriptions suggests they are using split tunneling whereby only company internals are routed through the VPN. While split tunneling is very flexible and minimizes company resources, it is also considered more risky than a dedicated tunnel. Large corporations I've dealt with in the past don't allow split tunneling for this reason. Sep 24 '21 at 17:39
  • Thanks for the hint. I was reading about split tunnelling and certainly this has to be the case. I'd still like to know what is exactly being filtered through the tunnel and what not. Do you think it is possible to figure it out from the client side?
    – Onturenio
    Sep 27 '21 at 15:50
2

As I understand, what traffic is being sent through VPN is primarily depending on routing options specified after you connect to VPN. As this configuration depends upon the company's policy, it's impossible to predict how it is configured in your case. From my experience, usually only corporate resources (mostly 10.x.x.x) would be routed through VPN, but that may vary heavily.

To have a brief grasp of what's going on, you can reboot your computer (or just disconnect the VPN, but I personally prefer the good ol' reboot) and execute "route print" or "netstat /r" command to see how your routing works by default. Save this output to some file, connect to VPN, and issue the same commands again. Then compare the results - most probably, you'll notice some differences, and should be able to understand how your traffic goes.

Unfortunately, that's not the only thing to check. Many other things are there - for example, DNS servers are also usually switched to corporate, and in this case if you'll try to visit "PornHub.com", DNS request will actually go through the company's DNS server, allowing to see what website were you trying to browse.

Also, if your computer is managed by your company (e.g. it is domain-joined), your system proxy might be changed to company proxy, allowing the company full visibility over all the traffic generated by applications that are using system proxy. Of course, if your computer is managed and contains user monitoring software or EDR agent - all your actions are also in plain sight, probably even without VPN.

Lastly, all the above is related to "traditional" VPNs. There are also technologies that allow "software defined networks", which can route traffic individually for each selected application, but I don't know much about it.

Having said all that... I don't think the companies usually care that much about what end users are doing. Infosec divisions are always understaffed, and they have huge load apart from looking for websites any individual user is visiting. So nobody cares man, chill)

P.S. And yes, always worth disconnecting VPN if not needed, e.g. in the end of the day, just to be sure nothing is leaking)

1
  • 1
    Thanks for the explanations. I'm not very concerned with the risk that they see what I do with my internet. It's more an issue of taking the learning oportunity. I always wanted to know more about proxies, netstat and things like that. And "my security" could be a good excuse to dig deeper in this world :) For instance, thanks to the comment above in my question I got to learn about split tunnelling...
    – Onturenio
    Sep 27 '21 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.