What is Tunneling?

Tunneling encapsulates one network protocol within another, used legitimately for VPNs and secure communications, but also exploited by attackers to bypass security controls.

What is tunneling in cybersecurity?

Tunneling is a networking technique that encapsulates one protocol's packets within another protocol's payload, creating a logical communication path through otherwise incompatible or restricted networks. Legitimate uses include VPN connections, IPv6 over IPv4 transit, and secure remote access. Attackers exploit tunneling to bypass firewalls, exfiltrate data through allowed protocols like DNS or HTTPS, and establish covert command-and-control channels.

What are common tunneling protocols?

Common tunneling protocols include IPsec for secure VPN connections, GRE (Generic Routing Encapsulation) for site-to-site connectivity, SSH tunneling for encrypted port forwarding, WireGuard for modern high-performance VPN, SSL/TLS tunneling through HTTPS proxies, VXLAN for data center overlay networks, and DNS tunneling abusing DNS queries for covert data transport. Each serves different legitimate networking needs with varying security implications.

How do attackers use DNS tunneling?

Attackers use DNS tunneling by encoding data within DNS query and response fields, exploiting the fact that DNS traffic is rarely blocked or thoroughly inspected. Malware communicates with command-and-control servers by embedding commands in DNS TXT records and exfiltrating data through subdomain labels. Since DNS resolution typically passes through firewalls uninspected, this technique effectively bypasses most network security controls.

How do you detect malicious tunneling?

Detect malicious tunneling by monitoring for anomalous DNS query volumes and entropy in query names, unusually large DNS responses, high-frequency beaconing to specific domains, unexpected ICMP payload sizes, SSH connections to non-standard ports, TLS connections with unusual certificate characteristics, and protocol behavior deviating from specifications. Network behavioral analysis and deep packet inspection tools identify tunneling through statistical anomaly detection.

What is SSH tunneling?

SSH tunneling creates encrypted channels through SSH connections, enabling local port forwarding (accessing remote services through local ports), remote port forwarding (exposing local services remotely), and dynamic port forwarding (creating SOCKS proxy through SSH). While legitimate for secure remote access, attackers use SSH tunnels to bypass firewall restrictions, pivot through compromised hosts, and create encrypted channels that evade network monitoring.

How does split tunneling affect security?

Split tunneling routes only designated traffic through VPN tunnels while sending remaining traffic directly to the internet, reducing VPN bandwidth requirements. However, it creates security risks by exposing endpoints to direct internet threats while connected to corporate networks, potentially enabling attackers to reach internal resources through compromised endpoints. Organizations must weigh performance benefits against increased attack surface from split tunnel configurations.

What is ICMP tunneling?

ICMP tunneling encodes data within ICMP echo request and reply (ping) packets, exploiting the fact that many firewalls allow ICMP traffic for network diagnostics. Attackers embed command-and-control communications or exfiltrate data through ICMP payload fields that normally contain random padding data. Detection requires monitoring ICMP packet sizes, frequency patterns, and payload entropy for anomalies inconsistent with legitimate ping traffic.

How do you prevent unauthorized tunneling?

Prevent unauthorized tunneling through DNS inspection and filtering blocking suspicious query patterns, ICMP rate limiting and payload inspection, application-aware firewalls detecting tunneled protocols, SSL/TLS inspection identifying non-standard traffic within encrypted channels, egress filtering restricting outbound protocols, endpoint controls preventing unauthorized tunnel software installation, and network behavioral analysis detecting anomalous communication patterns indicating covert channels.