Hacker News Reader

Comment by unfocused | Hacker News Reader

Agreed. Split-Tunneling is also a simple solution where you end up using home internet bandwidth for things like MS Teams/Zoom/etc. and the rest goes over the VPN. For generic large corporations or governments, this is a good enough solution. Email and documents are not bandwidth hogs.

That should be the first step, and after that, you start getting into detailed analysis as each business has its specific needs.

View on HN

Split tunneling is only simple if you can control the IPs everything is hosted at. If your SaaS uses generic EC2/Azure IPs, do you want to split tunnel ALL traffic to those providers? Probably not.

I thought that all access to EC2/Azure IPs is over HTTPS or SSH so you don't need to tunnel to it. We use split tunnel for my work, all of my work's IPs go through the tunnel. Everything else is the individual HTTPS or SSH connection. If you were within your corporate wall, you'd still need HTTPS to get to Azure from inside, right?

Aside from accessing intranet resources: Is the corporate VPN for encrypting Internet traffic, or is it for proxying and monitoring employee traffic?

Without answering that question, you can't discuss what makes sense.

our corp VPN is for accessing internal sensitive documents. I'm sure there is some level of monitoring, but it isn't the first priority. I work for a large US Corp so we have lots of design, specs, reviews and other paperwork to access.

but all the VPNed resources would be under private IPs anyways? In that case you only need your VPN to route traffic to your company's subnet.

Most companies want all general internet traffic to go through the VPN so they can filter/record/do whatever to it. The sites that are split tunneled are usually trusted internal (in that they're owned by the company, or used for a known service like email) or known high bw but safe (like youtube)

Not always, thankfully... Newer versions of Cisco AnyConnect (for example) can do name-based split tunnel. The client resolves the address then dynamically adds a route for the split tunnel as it's needed.

It works excellently for cloud-hosted stuff.

Ah that's quite interesting. There how do they work around the client controlling the DNS server? I suppose part of the session setup could be sending anyconnect a known trusted DNS server address.

I believe the DNS gets assigned to the client during the VPN session setup. And this is watched, and if something tries to change it, it shuts down the tunnel.

Split-tunnel has solved all of our bandwidth and performance issues, and it's so easy.

We recently moved _away_ from split tunneling. It's still giving me headaches. Not just performance, but things like docker containers don't always work right.

We run our own hardware (due to security concerns, our work is in mobile infrastructure) and have both a split and full VPN; I'm usually on the split one. Our code, task management and dev/test VMs go through the VPN, the rest over the open internets.

The security argument we have is a bit hit and miss though, since our e-mail is at a random hosting provider (doesn't even have calendar support) and most of our other comms goes through services like Skype, Zoom, etc.

Reply on news.ycombinator.com