E-mail routing over VPN

Chris Barnabo schrieb:

What kind of vpn software do You use that allows split tunneling in the first place?

Good VPN Software routes *all* traffic through the vpn tunnel without You having to configure anything!

Hello Martin,

I'm using SafeNet's SoftRemote VPN product. It allows you to specify which range of IP addresses should be directed down the VPN path, everything else goes down the direct pipe to the internet provider.

When I was working at IBM the SINE and AT&T MTS remote access products did a similar split, directing only the IBM internal traffic down the VPN path and leaving everything else on the internet path - otherwise the internet traffic simply congested the internal network (in through the VPN, then back out through the SOCKS servers ...)

As it happens, I've resolved the immediate problem by pumping the POP and SMTP traffic through OpenSSH to a server at home, and I may even tear down the VPN entirely in favor of SSH at some point - but I'm still curious how to setup the split tunnel properly.

-- Chris ________*________ Chris Barnabo, snipped-for-privacy@spagnet.com ____________ \\_______________/

Chris Barnabo schrieb:

How in this case do You prevent malicious software downloaded from the internet frim infecting the corporate network through the VPN?

Bear in mind that I'm a VPN user, not a network engineer ... :-)

I can't speak for SafeNet's capabilities in this regard, but the other products I've used that provide for split tunneling are supposed to block any routing of traffic from the internet pipe to the VPN pipe (and vice-versa). Of course, that only works presuming that the person at the keyboard isn't trying to actively subvert it, but then if they were planning to do that you're already exposed by virtue of them having access to the network at all.

The VPN network would also be exposed to the posibility of malware infection through the connected machine - someone could pick up bad code down the internet path that turns around and tries to connect down the VPN path. But that risk could also exist if the user were solely connected to the VPN - e.g. the user could surf to a site which installs malicious code by going through the VPN and out through that network's proxy servers, etc. A clear case where defense in depth is needed - reliable code on the user workstation to prevent infections, AND reliable mechanisms within the VPN network to defend against problems. Too many folks think that the firewall is going to protect their internal network, only to have it compromised when they plug an infected machine into it from the inside.

-- Chris ________*________ Chris Barnabo, snipped-for-privacy@spagnet.com ____________ \\_______________/

I think you mean "Inflexible" rather than "Good" here. There are times when sending everything over the vpn is the right thing to do, but in many cases you are trying to access remote system, not use some remote site as your one and only connection.

OpenVPN allows specification of the routing it provides, as an example. It allows multiple offices to connect seamlessly while not pushing outside traffic over the vpn and then out a single WAN pipe to the net in general. At least with Linux I have the ability to put firewall rules in place on each vpn, to provide the level of access needed.

If you are doing split-tunnel, normally you can specify how to route things out. If you dont have a route for it, then it defaults to your gateway.

Whats the platform you are using?

Mart> Chris Barnabo schrieb: