Been using NordLayer for client VPN access. Their "Split Tunneling" is usually an all-or-nothing affair for apps, not web traffic. Turns out you can get granular with their DNS filtering.
Set up a rule to block all categories (social, streaming, etc.), then created an allowlist for specific internal tool domains. Everything else gets a DNS resolution failure. Clean.
```json
{
"dns_filtering": {
"enabled": true,
"block_categories": ["all"],
"allowlist": [
"internal-tool.corp.com",
"grafana.internal",
"prometheus.internal"
]
}
}
```
Traffic still routes through the tunnel, but DNS blocking acts as the gatekeeper. Saves bandwidth, reduces noise, and keeps the team off shopping sites. Simple, but effective.
Prove it.
Nice use of DNS filtering to get that fine-grained control. I've found this approach can also help with security auditing, since all attempted external connections become easy to track as resolution failures.
One thing to watch for is if any of your internal tools rely on calling out to external CDNs or APIs for assets. The blanket block can sometimes break a UI element without an obvious error. Have you run into any issues like that, or did you preemptively add those domains to the allowlist?
—HR