Re: Do you allow your vpn clients to do split tunneling?

[Jeff Kell <jeff-kell () UTC EDU>]

The "textbook" explanation of split-tunnel says it should be avoided
because of the possibility of bridging/routing external traffic through
the tunnel.

However, if the end-user is smart enough to do that wholesale (other
than the XSS possibilties) they're probably smart enough to bypass your
captive tunnel (depending on the client).

Split-tunnel advantages:

* you can advertise only a portion of your internal network via the tunnel,
* any "other traffic" is untouched (if you have a multi-tasking user
that needs the regular network),
* if you're NATed inside, you can test inside and outside connectivity
(by using inside/outside IPs)

Captive tunnel advantages:

* all traffic gets encrypted (very useful for WiFi or other open wireless),
* better control over what enters the tunnel (depending on the client)

We allow split-tunnel, but our current VPN is primarily ITD personnel.
I might be more biased toward captive if serving a broader audience.

Jeff