How to Audit a VPN Gateway for Split Tunneling Risks

A VPN gateway can give remote staff secure access to corporate systems while allowing ordinary internet traffic to travel directly through a home router or mobile network. This split tunneling arrangement can improve performance, but it may also create an uncontrolled path between a protected environment and the public internet.

A security audit should determine whether split tunneling is intentional, limited to approved use cases, and supported by effective monitoring. The review should cover gateway configuration, endpoint behaviour, DNS resolution, routing tables, identity controls, logging, and the access needs of each business unit.

For Australian organisations, the assessment should reflect local privacy obligations under the Privacy Act 1988 and the risk expectations surrounding critical infrastructure under the Security of Critical Infrastructure Act. Financial services, healthcare providers and government contractors may also face sector-specific requirements for access control, audit trails and incident response.

The work should include users in Sydney, Melbourne, Brisbane and regional areas, where home broadband quality, mobile hotspots and managed devices can vary considerably. A practical audit accounts for staff who work from cafés, shared offices or rural locations, rather than assuming every connection behaves like a corporate network.

Establish The Intended VPN Design

Begin by documenting the approved VPN architecture. Record whether the gateway uses full tunneling, policy-based split tunneling or application-specific routing. Identify which subnets, SaaS platforms, cloud workloads and administrative services should be reachable through the encrypted tunnel.

Compare the documented design with the actual configuration on the VPN appliance, firewall, endpoint management platform and identity provider. Unapproved exceptions often appear as broad route entries, legacy access groups or device profiles created for temporary projects and never removed.

Define the security boundary clearly. If internet traffic bypasses the VPN, decide which controls still apply, such as secure web gateways, endpoint detection, DNS filtering, browser isolation and malware protection. A fast connection is not a sufficient reason to permit unmanaged traffic paths.

Inspect Routes, Policies And Gateway Settings

Export the gateway configuration and inspect route advertisements, access control lists, NAT rules, authentication policies and client profiles. Look for broad destinations such as 0.0.0.0/0, overlapping private ranges and rules that allow remote users to reach management interfaces or sensitive production networks.

The audit should also review IPv6 settings. An organisation may restrict split tunneling for IPv4 while leaving an unrestricted IPv6 route active. Check whether the VPN client disables local bridging, blocks unauthorised forwarding and prevents users from sharing a connection between a corporate device and another system.

Useful evidence to collect includes:

Approved and active VPN client profiles
Route tables from managed laptops and mobile devices
Firewall rules for VPN address pools
DNS server assignments and search domains
Exceptions granted to contractors or privileged administrators

Test the gateway from representative Australian locations and connection types, including NBN services, corporate offices and 4G or 5G hotspots. These tests can reveal policy differences caused by client versions, operating systems or network conditions.

Test Traffic Flow And DNS Resolution

Use controlled test accounts and approved tools to confirm where traffic travels. Check access to internal applications, public websites, cloud services, software repositories and administrative portals while the VPN is connected. Packet captures and route inspection can show whether sensitive traffic is encrypted and whether general browsing bypasses the tunnel as designed.

DNS deserves particular attention. A split tunnel can send internal name lookups to a public resolver, exposing hostnames or enabling spoofing. Confirm that corporate zones resolve only through trusted DNS services, while public queries follow an approved filtering and logging path.

Test for leaks after sleep, reconnection, roaming between Wi-Fi and mobile data, and switching between IPv4 and IPv6. Review what happens when the VPN drops. A reliable kill switch or fail-closed policy may be required for administrators, privileged users and devices handling regulated data.

Review Identity, Logs And Detection

A secure gateway depends on strong identity controls. Confirm that phishing-resistant multifactor authentication is required for higher-risk access, that device posture is checked, and that access is restricted according to role, location, device ownership and business need. Dormant accounts and shared credentials should be removed.

Correlate VPN authentication events with endpoint alerts, firewall records, cloud activity and security information and event management data. Alert on impossible travel, repeated connection failures, unusual countries, simultaneous sessions and access to sensitive systems immediately after a new device enrolment.

Email compromise can accompany suspicious remote access, so security teams may also benefit from learning how to interpret DMARC reports when investigating related attack activity. This helps connect identity events with spoofing, phishing and domain abuse.

Prioritise monitoring for the following conditions:

A device reaches internal services while its VPN client reports an error
DNS requests bypass approved resolvers
A user changes tunnel profiles shortly before accessing privileged systems
A VPN address communicates with unusual external destinations
A personal or unmanaged device receives a sensitive application route

Remediate, Retest And Record Evidence

Remediation may involve narrowing route lists, separating administrator profiles, enforcing endpoint firewall rules, blocking IPv6 leaks, updating VPN clients or moving selected applications to zero-trust access controls. Where split tunneling is necessary, document the business justification, data classification and compensating controls.

Retest after every material change. Verify traffic paths from different operating systems and locations, then confirm that alerts reach the security operations team. A managed security provider can support continuous SIEM monitoring, threat intelligence enrichment and 24/7 investigation when internal coverage is limited.

Retain configuration exports, test results, approval records and remediation evidence. This creates a defensible audit trail for internal governance, customer assurance and regulatory reviews. Reassess after major network changes, new cloud deployments, acquisitions or VPN gateway upgrades.

A focused audit can expose routes, DNS behaviour and access exceptions that routine configuration reviews miss. Engage Infoziant Security for a tailored VPN assessment, vulnerability testing or managed monitoring programme, with a practical review designed around your organisation’s Australian operations.