Always-On VPN with full traffic tunneling and split-exclusion for authentication?

gg_fga — Thu, 15 May 2025 15:58:00 GMT

Hi everyone,

I'm looking to implement an Always-On VPN setup using a Check Point Remote Access VPN client. The goal is to ensure that:

The VPN connection is mandatory: if the client is not connected to the VPN, it should not have access to the internet at all (no split tunneling).
All traffic (internal and internet) is routed through the corporate firewall when the VPN is active.
Exceptions are made only for traffic related to authentication to the VPN gateway (e.g., DNS resolution, SAML login, etc.).
When the device is on-site (corporate network), the VPN should detect it and not initiate the tunnel.

Is this kind of setup achievable?

Thanks in advance for your insights!

Re: Always-On VPN with full traffic tunneling and split-exclusion for authentication?

PhoneBoy — Thu, 15 May 2025 17:11:08 GMT

This requires a few things:

Hub Mode be configured (this routes all traffic through the VPN)
- You can exclude locally connected networks from this (to allow your users to, for instance, print to their local printer): https://sc1.checkpoint.com/documents/RemoteAccessClients_forWindows_AdminGuide/Content/Topics-RA-VPN-for-Win/Excluding-Local-Networks-from-Hub-Mode.htm
- You can also exclude specific applications like Zoom from going through the VPN: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_RemoteAccessVPN_AdminGuide/Content/Topics-VPNRG/Dynamic-Split-Tunneling-for-SaaS.htm?tocpath=_____19
- You can also require this only on certain firewalls: https://support.checkpoint.com/results/sk/sk111995
Endpoint Firewall (necessary to block access when disconnected from VPN). Note that this feature requires either Harmony Endpoint or CPEP-ACCESS licenses.
Location Awareness (disables VPN when certain conditions are met)

Harmony SASE also supports this configuration.