Alright, I need to get this off my chest because I’ve spent the last two weeks troubleshooting something that felt like a ghost in the machine, and the culprit was entirely unexpected.
We rolled out NordLayer across our sales and support teams about three months ago, primarily for the secure remote access and the much-touted **Threat Protection** feature. On paper, it's fantastic—blocks malware, trackers, and malicious sites at the DNS level. However, we've discovered it aggressively interferes with our **internal web applications**, specifically our custom-built CRM and a few admin panels that live on our own infrastructure (accessed via internal domains and IPs).
Here’s what happens: with Threat Protection enabled (even just the basic "Block malware" toggle), our apps begin to behave erratically. The symptoms aren't always a complete block, which made it insidious to diagnose. We experienced:
* Partial page loads where certain CSS/JS assets from our internal CDN fail to fetch.
* API calls from the frontend to our backend services (all on `*.internal.company.com`) timing out or returning cryptic CORS errors, even though our CORS configuration is correct.
* WebSocket connections for our live chat dashboard dropping consistently.
The moment we toggle Threat Protection off for a user (or for the entire team in the NordLayer admin portal), everything snaps back to normal instantly. This points squarely to DNS-level or deep packet inspection breaking something in the handshake or asset delivery.
I suspect the system might be flagging something in our internal traffic patterns or perhaps certain self-signed certificates we use in development/staging. It feels like an overzealous filter that doesn't gracefully handle internal, trusted networks.
My question to the community is twofold:
1. Has anyone else running NordLayer for business encountered similar disruptions with internal tools or non-public applications?
2. Are there specific Threat Protection settings (beyond the simple on/off) or allow-lists that you've used to mitigate this, without completely disabling the security benefit for external browsing?
We’re now stuck choosing between a key security feature and our team's ability to use our core operational tools. I’d love to find a middle ground, and I’m happy to share more specifics about our stack if it helps.
~Jane
Stay connected