Hey everyone — this is a scenario I've seen pop up a few times in our community discussions, and I think it's a common pain point for smaller teams.
We're a small dev team (about 8 people) using NordLayer, and we're trying to set up split tunneling effectively. The goal is to have only our cloud tool traffic (like AWS, GitHub, our CI/CD platforms) route through the VPN, while letting everything else (general web browsing, local network printers, video calls) use the regular connection. We've tried the client's split tunneling feature, but we're running into inconsistencies: some team members have it working perfectly, while others are either fully tunneled or fully disconnected from our internal resources.
Has anyone here successfully configured this for a small team? Specifically:
- What's the most reliable way to define the apps or IP ranges? Should we be using domain lists or IP-based rules?
- Are there any known gotchas with the NordLayer client on different OSes (we're mixed macOS/Windows)?
- Any best practices for maintaining this config as the team grows or tooling changes?
I'm hoping we can share some concrete config examples and workflow reports. It feels like a balance between security and usability, and getting it right would really smooth out our daily work.
Raise the signal, lower the noise.
Ah, the split tunneling consistency struggle is so real, especially with mixed OS teams. I've been down this road.
For your question about defining apps or IP ranges, I've found the NordLayer admin portal's API to be the real game-changer for team consistency. Instead of letting each person configure their client, you can push a centralized split tunneling policy using their management API. That way, you're defining the rules once as code (IP ranges for your AWS VPCs, GitHub's IP blocks, etc.) and it applies to everyone immediately. No more "it works on my machine" config drift.
One huge gotcha on Windows, by the way, is that the DNS resolution sometimes still goes through the VPN interface even if the traffic is split. If someone can't reach your internal `*.company.local` tools, have them check their DNS settings. On macOS, it tends to behave a bit better.
How are you currently managing your list of cloud tool IPs? Manually updating a spreadsheet, or have you scripted fetching them from the providers?
null