Force VPN use on Windows whenever connected to the internet?

Question

The worker bees take our XP/Vista/Win7 laptops around the world. They connect to the Internet via wired, wireless or dialup connections (whatever is available in the area). How can I make it impossible for them to use the internet unless they are also connected via VPN back to the home nest?

Example: If they open Outlook (or leave it open and polling every 30 mins) the VPN connection might not be up and they would be using the unsecure local internet connection instead. I would like to avoid this possibility completely and only allow connections through the VPN. Is there an easy (one click?) solution for them that doesn't require any retraining?

Answer 1

This is strange. It took me a while to even comprehend the problem.

Are your Exchange servers exposed to the world (non-private ip)? I thought, the common architecture of an email solution would be a "dumb" MTA like Sendmail (yes, sendmail), that "just works", on the outside, and everything else (standalone anti-spam, Exchange, Lotus) on the inside. This way, the clients from the outside world can not connect to your internal email infrastructure, simply because they have nothing to connect to (nothing is exposed)!

A user is forced to first establish a VPN connection in order to do anything. You can also expose mailboxes through some web-mail thing (I know, Lotus and Exchange provides such solutions).

This way, you are making absolutely sure, that no insecure communication takes place between the users and the internal infrastructure AND you are not putting your users through tortures, such as forcing them to use non-administrator accounts, restricting DNS and so on. And it just works no matter what (cannot be circumvented from the user side).

Answer 2

IE: Use a proxy that's inside your own network, and disable the users ability to 1) change proxy settings and 2) install alternative web browsers. On the same connections tab, specify the VPN connection to use when connecting to the internet

Outlook: make the mail account use the same settings as IE

Answer 3

ipUnplugged Mobile VPN from Radio IP Software. This is an IPSec mobile VPN based on Mobile IP standards and is always on. The user doesn't have to start/stop the VPN; it is intelligent enough to know when the user is in the office and when they are outside your secure network. You can also force the policy where all IP data goes back to from the mobile computer goes back to your secure network. No complicated settings. www.ipunplugged.com

A shameless plug but it really does work.

Answer 4

What I did was set their DNS to my internal DNS (e.g. 10.x.x.x) and give them user privledges only. When they are on the VPN they will be able to access my internal DNS to resolve HTTP request. With user priv, they cannot reset the DNS IP.

This wasy they also get filtered by my OpenDNS filter. It works excellent!