| Some vpn have a concept of inverse split tunnelling. It implements a policy as follows: 'I am the VPN terminator. I have a kernel driver on your PC. All your packets are belong to the tunnel except specific IP addresses, as dictated by me.' Regarding DNS... If you are not allowing split tunnelling then you are backhauling all surfing through your vpn terminator, so I hope you are also doing some content inspection, spoofing ssl and re-encryptiong so you csn inspect that too. You're not? Oh well. Dont sweat spit tunnelling that much then. And in some cases IP:protocol destinations can be done with client policy enabled. So if you wan to allow 9100/udp to your local inkjet, tell'em its gotta be on 10.1.1.69 or no printy. This works nicely on Avaya / Nortel when coupled with GPO and windows firewall when those PCs are on your domain. It wont work for your C=64 though (byod ya know). Nothing is perfect, but there is something to be said for being somewhere far away from the extremes of gross negligence and preventing all IT services altogether. Like allowing some use, but monitoring and managing the risk. As usual, YMMV depending in risk appetite, business need and threat environment. W Sent from my BlackBerryΒ� PlayBookβ’ www.blackberry.com From: "Colin Edwards" <[email protected]> To: "'PaulDotCom Security Weekly Mailing List'" <[email protected]> Sent: March 5, 2013 9:34 AM Subject: Re: [Pauldotcom] VPN Split DNS βSimple question: does the "datacenter" network want to trust the entire remote network? If so, go for split tunneling. If there is anything on the remote network that you dont want to trust, disallow split tunneling.β And to add to that, if your branch officeβs network canβt be trusted, then itβs probably time to address the security of that network. I expect admins to disable split tunneling when host are connecting from potentially hostile networks (i.e. an employeeβs home network where there is no knowledge or control over the security of the other hosts or firewall on that network). But if there are concerns about your branch officeβs network being hostile, then the first step should be implementing some baseline security requirements so all of your networks can be considered trusted. From: [email protected] [mailto:[email protected]] On Behalf Of Herndon Elliott > Subject: [Pauldotcom] VPN Split DNS > What are the security concerns of using split DNS to allow them to access Split DNS = split tunneling, I think you mean. Simple question: does the "datacenter" network want to trust the entire remote network? If so, go for split tunneling. If there is anything on the remote network that you dont want to trust, disallow split tunneling. My experience is split tunneling is very, very high-risk for the target of the VPN. |
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
_______________________________________________ Pauldotcom mailing list [email protected] http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom Main Web Site: http://pauldotcom.com
