10

I'm visiting China and plan to connect to the Internet via a VPN (e.g. ExpressVPN) to access some websites blocked in China such as Gmail. But for accessing my employer's internal websites from outside of the company, I have been using the company's own VPN service using a general-purpose VPN client. My question is how do I connect both VPNs at the same time so I could access both Gmail and my employer's website at the same time?

3 Answers 3

8

First, it's generally not possible to run two different VPN Client programs on the same host simultaneously. Conceptually this is possible, but in practice, different vendor's VPN Clients tend to step on each other.

But it's often possible to configure a single VPN Client with a policy that permits more than one destination to be reached. This is known as split-tunneling. For example, the VPN policy might say all traffic sent to 192.168.0.0/24 goes over LAN #1 in the clear (no VPN), and all other traffic goes over the VPN tunnel to Concentrator XYZ. Or it could say all traffic sent to 192.168.0.0/24 goes to Concentrator XYZ, all traffic sent to 10.0.0.0/24 goes to Concentrator ABC.

To accomplish this, you'll face two challenges: one technical, one political.

The technical challenge is whether you can come up with a VPN Client policy definition that reflects what you want to do. Are the IP addresses of the two private destinations you want to use non-overlapping and static? For example, if the remote host that connects to your machine has a dynamic address, configuring a policy could be tough.

The political challenge is whether whoever owns the VPN Concentrator will let you configure a VPN Client policy with split-tunneling. Split-tunneling is a security no-no for this very reason -- the configuration you want opens a back-door because (theoretically) traffic originating in network #1 could enter through tunnel A, route through your machine, then ride tunnel B into network #2. You could prevent this host routing through careful machine and VPN policy configuration, but the fact remains that some will consider this too risky.

One last point: I'm unclear about how you want to connect from a remote host to your machine. Your machine now runs a VPN Client to reach a VPN Concentrator. Your machine could use the same VPN Client to reach another VPN Concentrator, but that wouldn't let a remote host initiate an incoming connection to your machine. Or you could use a different client/server protocol to accept incoming connections to your machine -- for example, remote desktop access or a telnet server. In that case, you'll only have one VPN tunnel, not two. However, your VPN Client policy will still need to "have a hole" to exclude the client/server protocol from VPN tunneling.

Source: https://searchnetworking.techtarget.com/answer/Can-you-have-two-VPN-connections-to-the-same-machine-simultaneously

Some are also stating this is possible, surely slower but possible. You will also certainly need high IT skills to perform and also, full administrators access.

https://www.quora.com/How-many-VPN-services-can-one-run-simultaneously-on-Windows-10

0

Any easier solution would be to just ensure or ask that your companies VPN allows you to route to the internet from the company VPN. Then you only need one VPN. If your company has an IT department, they can probably offer you the simplest solution.

Alternately another simple solution that might work for you is to take a router with you that supports VPNs, get the router to connect to your expressVPN, then your device (once connected to the router) will be able to route a VPN through that without any real issues I expect. There is will overhead I expect, but hopefully it will be useable. I certainly have routers with VPNs that I can route a second VPN through.

0

These may not be the best options, but I just wanted to add that you may also consider installing a vpn client app and connecting to the email on your phone. That way you can have the company email on your phone and the rest on your laptop (essentially emulating having two machines, each with their own separate vpn client). I believe you could also run a small virtual machine on your laptop to get the same effect (though I haven't tested this, I would imagine it would work as it should act as a completely separate machine - and also vpn client).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .