| I would agree with Andrew,
it sounds like you are referring to split tunneling not split DNS. You
need to assess the differences in client access when connected with a
full tunnel vs. a split tunnel. For example, if a compromised host
connects to the VPN, can it establish a connection back to a
command+control server whilst the VPN is live? It's easy to assume the
it won't be able to with a full tunnel but this may be unrealistic if
your proxy policy is weak. You may also have a local proxy in the branch
office in which case the security controls on the client's outbound
connections are the same whether connected via full or split tunnel. If the clients are accessing resources (printers etc.) on the branch local subnet then you can allow access to that subnet only and nothing on the other side of the client's default gateway. You could also create a policy that only enables split tunnelling if the client connects from a branch office IP (external NAT IP, not client IP) to guard against users connecting from home.
|
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
