Recently, our office VPN was taken down by our ISP after discovering a DDoS attack. Apparently an employee connected to our VPN is infected. There were no logs at the time of the event.

Besides advising everyone to use an AV, what are the solutions to mitigate or solve this from both server/client side? One idea is to ask them not to use our VPN as their default gateway so malicious traffic will not pass via our VPN server.

2 Answers 2


As you mention, you should definitely setup "split tunnel" VPN, wherein traffic only traverses the VPN when it needs to -- other traffic goes over the internet. That is likely the simplest solution to your issue. However, the caveat is that these infected computers can still be used as a hop-off point to access resources on your VPN; so you can have a security issue and not be aware with that solution.

There are many other, more complex ways of addressing the problem. Of course, not just advising but requiring VPN users have active, up to date AntiVirus is important. Many VPN concentrators (Cisco, Juniper, etc) have features in their VPN clients that allow for testing for compliance to a host profile -- e.g. see if updates are installed, antivirus is current, etc.

Moving up an order of magnitude, an IPS (Intrusion Prevention System) system is the ideal solution to this problem; if budget allows as these systems are prohibitively expensive and often require significant resources to setup. A properly configured IPS will immediately revoke VPN access if seriously anomalous activity is detected -- a DDOS attack will almost certainly trigger this.

In this case, you can still use a "full tunnel" VPN with all internet traffic using the VPN as the default gateway if you prefer. While speed may suffer on a full tunnel VPN connection, it will be more secure as all traffic will have to traverse the IPS system.


I suggest the following:

  1. Centralized Antivirus/Malware Management (Endpoint Security)

  2. Some sort of physical appliance for threat management-like a Dell Sonicwall. Enable Syn Flood protection at the very least. Utilize this appliance for secured VPN access. Enable net flow to gather view of Internet traffic on LAN.

  3. Audit all systems on network if possible, record what ports are open, closed and keep track of applications used.

  4. Use some kind of user A&A mechanism like Active Directory or LDAP.

  5. Ensure all systems on network are imaged in a similar repeatable process. Always know what updates are on machines and have a documented process for everything in between.

The idea is to figure out what gaps exist, enable security in-depth and hone over time. Don't let anything on your network become a bot net zombie.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .