Remote Access VPN Design: Split Tunnelling, Always-On, and What Replaced Them

A remote access VPN places a user's device onto the corporate network from wherever they are. The design decisions — what traffic goes through it, whether it is always connected, and what the device reaches once it is on — determine both the security posture and whether people work around it.

Full tunnel and split tunnel

Full tunnel sends all of the device's traffic through the VPN, including internet-bound traffic, which then exits through the corporate perimeter.

The benefit is that every inspection and filtering control applies to a remote user exactly as it does in the office, and the organization has visibility of what the device does. The cost is that every video call and cloud application takes a detour through headquarters, adding latency and consuming concentrator and internet capacity that scales with the remote population.

Split tunnel sends only corporate-destined traffic through the VPN and lets everything else go direct.

The benefit is performance and far lower concentrator load. The cost is that internet traffic bypasses corporate inspection entirely, and — the part that matters more — a compromised device is simultaneously connected to the internet and to the internal network, which is a bridge an attacker can use.

The workable middle is selective split tunnelling: corporate applications and inspection-worthy destinations through the tunnel, well-known low-risk services direct. It requires maintaining the exclusion list, and it is what most organizations settled on once remote work became the norm.

Always-on and pre-logon

Always-on VPN establishes the connection automatically whenever the device is online and does not let the user disable it. That guarantees policy applies and removes the gap where someone forgets to connect.

It has to handle captive portals, or a user in a hotel cannot authenticate to the network to establish the VPN in the first place — a permitted pre-connection window with restricted access is the usual solution, and getting it wrong is the most common support complaint.

Pre-logon or machine tunnels connect using the device's own certificate before any user signs in, which allows domain authentication, policy application and management from a remote device that has never been on the corporate network. Without it, a remote user who forgets their password cannot be helped, because the device cannot reach the domain to accept a reset.

The concentrator is a chokepoint

Everything routes through it, which makes it a capacity constraint, a single point of failure and a high-value target in one device.

Size it for concurrent sessions and for the throughput full tunnelling implies, deploy it redundantly, and keep it patched aggressively — VPN appliances have been a repeated source of exploited internet-facing vulnerabilities, and they are exposed by definition. Authenticate with certificates or phishing-resistant factors rather than passwords alone, since the concentrator's login page is scanned continuously, as under exposed remote access.

The underlying protection is usually IPsec in tunnel mode with ESP, or TLS — the modes compared under IPsec transport and tunnel mode. TLS-based VPNs traverse restrictive networks more easily because they look like web traffic, which is why they dominate remote access while IPsec dominates site-to-site.

Network access is the underlying problem

The structural weakness of the whole model: a VPN grants a device a position on the network, and from that position it can reach whatever the network permits. Authentication happens once at connection, and lateral movement afterwards is a network question rather than an identity one.

Posture checking helps at the margin — verifying patch level, disk encryption and endpoint agent before granting access — and it is a point-in-time check on a device you do not fully control.

Which is why zero trust network access is displacing it. The broker authenticates user and device per application and proxies that application only; no network position is granted, so there is nothing to move laterally across. Applications are not reachable at all without an authorized session, which also removes them from internet-wide scanning.

Most organizations run both during a long transition: zero trust access for applications that support it, VPN for the legacy protocols and administrative access that do not.

Exam angles

Distinguish full tunnel (all traffic through the VPN, full inspection, higher latency and load) from split tunnel (only corporate traffic, better performance, bypasses inspection and bridges the device between networks). Know always-on VPN and pre-logon machine tunnels and what each enables. Recognize the concentrator as a capacity constraint and a high-value internet-facing target, and zero trust network access as granting per-application access without a network position.