2

I'm using a SSL VPN (F5's 'big-ip edge client') to access a client's network.

I noticed that addresses that relate to its network are routed through the VPN:

foobar@mac:~$ traceroute subdomain.client.xxx
traceroute to subdomain.client.xxx (10.254.193.78), 64 hops max, 52 byte packets
 1  10.248.5.15 (10.248.5.15)  78.741 ms  78.458 ms  78.295 ms
 2  10.248.5.11 (10.248.5.11)  85.875 ms  78.786 ms  78.515 ms
 3  10.248.4.5 (10.248.4.5)  78.976 ms  79.368 ms  81.728 ms

While addresses that aren't on their network aren't routed through the VPN:

foobar@mac:~$ traceroute google.com
traceroute to google.com (172.217.17.46), 64 hops max, 52 byte packets
 1  192.168.1.1 (192.168.1.1)  0.613 ms  0.326 ms  0.281 ms
 2  x.qwest.net (207.109.x.x)  194.434 ms  178.721 ms  60.471 ms
 3  x.inet.qwest.net (207.109.y.y)  40.290 ms  20.537 ms  20.901 ms
 4  cer-edge-17.inet.qwest.net (67.14.8.90)  30.016 ms  29.993 ms  31.269 ms
 5  216.111.90.126 (216.111.90.126)  103.049 ms  104.267 ms  101.551 ms
 6  209.85.244.1 (209.85.244.1)  30.493 ms
    209.85.143.148 (209.85.143.148)  30.415 ms
    209.85.143.188 (209.85.143.188)  30.039 ms
 7  72.14.237.130 (72.14.237.130)  30.311 ms
    209.85.241.47 (209.85.241.47)  30.380 ms  30.432 ms

In comparison, I've used Juniper's VPN at another client. There, all traffic was routed via the VPN.

Is this (split routing?) a property of a SSL VPN, or just how the client has configured it?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 5:31
5

This is a feature that most VPN platforms have. It's called 'split-tunneling'. And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't.

| improve this answer | |
  • Why would an administrator choose not to send traffic through the VPN? I know that it adds extra traffic to the VPN, but is it a security concern not doing so? – craig Nov 21 '16 at 23:03
  • Extra traffic is one reason. Another is that the VPN client may want/need to retain access to local resources. Privacy may be another. Not wanting to be responsible for the VPN client's internet traffic may be another. – Peter Green Nov 22 '16 at 1:33
  • @PeterGreen is right. It happened one time with us when all traffic was going thru VPN and a user on the VPN was sharing a content protected with copyright (via BitTorrent) and our IP address was showing as the one that shared it. – Algeriassic Nov 22 '16 at 16:47
3

To answer your question: it depends on how the SSL VPN profile is configured.

I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through the VPN.

The SSL Client software may be able to tell you what "networks" or "subnets" are entering the tunnel. Cisco's AnyConnect Secure Mobility Client will specifically list the networks it includes into the tunnel. "Non-Secure Routes" are routes not included in the tunnel while "Secured Routes" are networks included in the tunnel.

I suggest looking into Split-Tunnel or Full Tunnel VPNs for more details.

| improve this answer | |
  • A SSL VPN has the same routing capabilities as other VPN protocols? – craig Nov 22 '16 at 1:58
  • Yes, SSL is only referring to the protocol used to tunnel the traffic. – John K. Nov 22 '16 at 15:46
2

A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface.

Don't confuse VPN client software, which is really off-topic here. Some host software prevents split tunneling as a security measure.

| improve this answer | |
  • Would mind elaborating on the security-measure aspect of your answer? – craig Nov 22 '16 at 1:56
  • If you are a company that lets your employees VPN to the corporate network, you do not want to let an employees set up a connection from home that could be used to bypass the corporate firewall. A split tunnel can be configured to do that by allowing someone on the corporate network connect to the Internet through the home connection to the Internet without going through a corporate firewall. – Ron Maupin Nov 22 '16 at 1:58
  • Is the security concern about a rouge element accessing the corporate network via the 'unsecured' connection? Or this about controlling people's behavior (i.e. no social net works, etc.)? – craig Nov 22 '16 at 2:03
  • It is primarily about a security risk, but sometimes it may be about controlling things like streaming video that consumes expensive network resources. A company will spend large amounts of money to protect the network and hosts, and someone getting malware, purposely or not, through an unsecured connection can have a devastating effect on the company; look at what happened to Target because of something like this. Employees don't always understand this, and they simply feel as if their rights are being infringed, or Big Brother is trying to control their social networking. – Ron Maupin Nov 22 '16 at 2:09
  • @craig, why would a company even bother to set up a firewall to protect its network if it is simply going to allow backdoors into the network wherever and whenever any user wants? Firewalls protect company resources, and allowing even one backdoor compromises the security and integrity of the network. – Ron Maupin Nov 22 '16 at 2:14
0

It's called split tunneling, is configurable, and should be enabled. There is no [good] sense in routing Internet bound traffic through a centralized location.

In fact, I'm beginning to believe that network-device based VPN's (and firewalls) make no sense at all. ...y'all heard it here first!

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.