Remote Work VPN: Two Tunnels, Two Different Jobs
- The Company Tunnel Is an Access Door
- Full Tunnel and Split Tunnel Tell Different Stories
- Identity Still Has to Pass the Check
- The Captive Portal Comes Before the Private Route
- Failure Blocking Needs a Real Failure
- Calls Expose a Bad Route Quickly
- Physical Privacy Doesn't Travel in the Tunnel
- Travel Rules Don't Move With the Exit Server
- You Should Be Able to Draw the Route
“Use the VPN” sounds like one instruction. It isn't. A company VPN can open a controlled door into work systems; a consumer VPN usually sends public internet traffic through a provider's server. Same tunnel icon. Different destination, operator, and rules.
Priya opens her managed laptop on hotel Wi-Fi without either VPN. The hotel can observe connection metadata and the services contacted, while HTTPS protects the contents of ordinary secure sites. A work service sees the hotel's public IP plus Priya's account, device, and anything she submits.
She starts the company VPN in full-tunnel mode. The hotel now sees an encrypted connection to the employer's gateway. The organization can apply its access controls, monitoring, and logging there, and public destinations may see a company-controlled IP.
Now replace it with a consumer VPN. The hotel still sees a tunnel, but it ends at a commercial provider. That provider takes the intermediary position, public websites see its exit IP, and the private company file server still has no reason to admit Priya.
The Company Tunnel Is an Access Door
Use the employer's VPN when policy or IT requires it for code, files, administrative tools, regulated data, or private dashboards. The organization controls the gateway, account, certificates, routes, and permissions behind that connection.
A consumer VPN can't substitute for any of those controls. Choosing an exit server near headquarters changes a public location signal; it doesn't produce a company certificate or an authorized identity.
Install the official client or managed profile from the employer's approved channel. If an unexpected page asks you to accept a certificate, install a profile, or enter a work password, stop and verify the request with IT through a known contact.
NIST's telework guidance starts with the same unglamorous rule: know the organization's policy and use its VPN when required. The policy, not a VPN advertisement, defines the route for work data.
Full Tunnel and Split Tunnel Tell Different Stories
A full-tunnel company VPN may send both internal and public internet traffic through the business gateway. The hotel sees the tunnel. The employer can inspect or log traffic at its endpoint according to policy, and public sites may see the employer's egress address.
A company split tunnel sends defined work traffic to the gateway while other traffic uses the normal internet connection. The hotel or ISP can then observe the direct connections outside the tunnel, while the organization sees what reaches its protected route. Public sites reached over that direct route see the local connection's public address rather than the employer's egress address.
Neither design is automatically a promise of personal privacy. Ask which mode the client uses, read the workplace policy, and keep personal browsing off a managed device. Endpoint monitoring, device management, browser policies, and account records can reveal activity without relying on the network path.
Don't create your own exclusions to make a slow call faster. A split-tunnel decision changes which security controls see the traffic and belongs to the team responsible for that risk.
A strict tunnel may also block a local printer, development device, or storage box. Use only an employer-approved local-network exception.
Identity Still Has to Pass the Check
The tunnel protects a route. It doesn't prove that the person at the keyboard should open payroll, production, or customer records.
Use a unique account password and the strongest multifactor method the organization supports. Keep recovery codes somewhere you can reach without the work laptop, and report a lost device quickly so IT can revoke its certificate, tokens, and sessions.
A hardware security key can make compatible sign-ins far harder to phish. It won't encrypt the hotel connection or replace the company VPN; it strengthens the identity check at a different layer.
- Connects through USB-C or NFC, covering many newer computers and compatible phones
- Adds a phishing-resistant physical check to passkeys and supported multi-factor logins
- Works without a battery, code display, or wireless pairing process
The device matters just as much. Use a strong screen lock, current updates, disk encryption, and the employer's endpoint protection. A perfect tunnel can't protect files copied to an unapproved personal cloud service or a laptop left unlocked in a conference room.
The Captive Portal Comes Before the Private Route
Hotel and airport networks often require a local sign-in page before they allow internet access. Connect to the correct network, complete that portal without entering work credentials, and then start the approved VPN before opening work apps.
A fake hotspot can copy the venue's name. Confirm the network with staff when the choice is ambiguous, and don't click through certificate warnings to make the portal disappear. A VPN can't repair credentials already handed to an impostor.
After the tunnel connects, verify the work service and a harmless public IP check. Close and reopen apps that started before the VPN; background mail and sync tools may have raced onto the direct route.
Repeat the check after sleep, a move between access points, and a switch to mobile data. Those handoffs are where a reassuring green icon can lag behind the operating system's new route.
Failure Blocking Needs a Real Failure
A kill switch or operating-system “block without VPN” control should stop covered traffic when the tunnel disappears. The setting name isn't the test.
Use harmless traffic, interrupt the VPN, sleep and wake the laptop, change networks, and close the client unexpectedly. Watch whether traffic pauses or silently falls back to the ordinary route. Then test the documented recovery steps so a strict block doesn't become an improvised reset during a deadline.
Company and consumer clients can each install firewall and routing rules. Running both can break DNS, internal routes, authentication, or the kill switch itself. Don't stack tunnels unless IT has approved and tested that exact design.
Our kill-switch guide shows how to test the failure rather than trust the label. For a company device, stop before changing managed rules and take the evidence to support.
Calls Expose a Bad Route Quickly
Video meetings care about latency, jitter, packet loss, and upload stability. A distant gateway can make people sound robotic even when a download test looks healthy.
Test the approved nearby gateway with the same camera, microphone, and meeting app you'll use for work. Compare Ethernet and Wi-Fi where practical. Record whether the failure affects audio, video, screen sharing, or the whole connection.
If calls fail only through the company tunnel, give IT the gateway, time, network, client version, and repeatable symptom. “The VPN is slow” hides the clue they need.
Conferencing may be deliberately split outside the company tunnel, but that should be an organizational choice. The local network then sees the direct service connection, the meeting provider sees the hotel or home IP, and employer gateway controls don't cover that stream.
Physical Privacy Doesn't Travel in the Tunnel
A coworker, passenger, or café customer beside you doesn't need to crack encryption to read a visible spreadsheet. Sit with the screen away from foot traffic, lock it when you stand, and use a private room for sensitive calls.
A fitted privacy filter can narrow useful side viewing on a compatible laptop. Measure the screen and check the aspect ratio before buying one; it reduces casual shoulder surfing, not the need for a lock screen or sensible seating.
- Limits clear side-angle viewing on compatible 15.6-inch widescreen laptops
- Helps protect messages, account details, and work documents in crowded spaces
- Pairs privacy with an anti-glare finish and removable mounting choices for daily use
Headphones protect the room from hearing colleagues, but your microphone can still carry the room back to them. Check the selected input, mute deliberately, and don't discuss restricted work where strangers can listen.
Travel Rules Don't Move With the Exit Server
Install and update the approved client before departure. Save offline support contacts, recovery instructions, and the correct gateway names. A provider or employer help page may be inaccessible after you arrive.
Confirm whether the destination permits the required tools and whether company policy allows work from that country. Data residency, export controls, employment rules, and customer commitments aren't solved by selecting a server somewhere else.
Keep one legitimate fallback, such as a managed mobile connection approved by the organization. Test captive portals, sleep, reboot, and network handoffs before the first time-sensitive meeting.
At home, put work devices on a separate trusted network from poorly maintained smart products when the router supports it. A VPN protects the onward route to its endpoint. It doesn't make every device on the local network safe.
You Should Be Able to Draw the Route
Use the company VPN for company access. Add a consumer VPN only for a separate privacy need, on a permitted device and route, with the employer's approval where required.
Before work depends on it, answer four questions: which traffic enters the tunnel, who operates the far endpoint, what that operator can observe, and what happens when the tunnel drops. If the answer is “I see two green shields,” the setup isn't ready.