0

Some of the VPNs at work block internet access once you are connected. I understand if the incoming (or even outgoing) traffic from some servers are not allowed. But why all the client machines that connect to the VPN have to be blocked?

Which threats is it preventing from?

Isn't it enough just to block the internet access of the servers?

3 Answers 3

1

Any device or service in your network is a potential point of attack, and attackers are not picky at this stage. Any compromise on your network is an opportunity to explore your network, to escalate privileges up and to launch new attacks from that device, as any account on that device.

So you'll find privilege escalation attacks, traversal attacks, attacks on domain servers, password reuse attacks ... the list goes on.

So anything you can do to restrict that attack surface - disallow connections directly to the internet - helps increase the security of the organisation.

2
  • Can you give me an example of how those attacks can be reduced or prevented if there is no connection to the internet? Because my idea is that if someone or some malware is going to exploit the network, it wouldn't stop the attack just because the host computer it is residing on doesn't have the internet access. Thanks.
    – gdenuf
    Apr 29 at 10:08
  • 1
    @code_nostalgic Most modern malware and ransomware actually depend on reaching out to the Internet. A lot of exploit vectors require small payloads. Once the initial foothold is established the malware will call out to their command and control for upgrades, and/or tasking.
    – RoraΖ
    Apr 29 at 13:58
1

The problem is that the VPN allows the client machine to be seen as if were inside the local corporate network. There are proxies and firewalls between that internal network and the broad internet, and those proxied and firewalls are managed by the security team. If your client machines could directly access the internet while being connected to the VPN this would completely defeats any rules of the proxies and firewalls. That is enough for any member of the sec. team to suffer nightmares...

Worse, if the client happened to be compromissed, it would open a direct access from the outside internet into the corporate network with no control nor logging by the security team. And that would be a major breach because it would not raise any alert.

For that reason a normally configured corporate VPN blocks any other network access once started and trying to circumvent that would be a major attack against the internal security, and on a legal point of view a serious professional fault with all the possible associated outcomes.

0

Let's say a client is accessing a corporate network over VPN.

If all traffic is routed over the VPN, the corporation may inspect network traffic using its existing security solutions (ie. IDS/IPS). So, if the client has malware that tries to connect to a known botnet, it will be detected.

When you are connected to the public Internet and the corporate network at the same time you basically bridge the two together. By restricting this, even if the client is infected with a remote access trojan, the connection will be broken, and a new one may be blocked from beeing established while connected to the corporate network.

It is not a perfect solution in that, malware and other tools installed by an attacker on the client, may be able to operate unattended. Ie. a keylogger logs all data and is extracted by the attacker at a later stage, or some malware detects that the client is logged into some system and then starts doing damage.

Some conditional access policies may prevent access to SaaS solutions from outside the corporate network. IPs of SaaS solutions can change without prior notice so by routing all traffic through the corporate network you don't risk users beeing suddenly blocked from logging in to those services.

The opposite of forced routing over VPN is called VPN Split Tunneling. The benefit of doing this is mainly performance related. In particular a reduction of latency from the client to Internet hosted services which may be important for some applications.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.