Hi Michael - thanks for your reply, however my question really is when the client VPN establishes a connection to a remote site there are two active connections opened on that PC - the local connection and a virtual connection, this sort of bridges the two networks together. What I would like to know is how could the security of our network be compromised as the virtual VPN connection to the remote subnet would allow all packets back to the originating host due to the VPN - what's to stop a hacker at the remote end dropping a script onto the VPN PC from the remote site that would allow malicious traffic to jump the virtual connection to physical subnet - does this make sense?

Regards

Rod

If you look at the Transport tab of the Connection Properties, you will see a checkbox for a feature called "Allow Local LAN Access". The help file suggests leaving this "unchecked" provides the protection you are seeking.

The Options menu also provides access to a Stateful Firewall.

When you say "sort of bridges the two networks together", are you suggesting that packets are freely forwarded from one interface to the other? If so, I don't agree. I don't think the host will do this without a routing function installed, or being compromised.

Still comes back to protecting the host for me.

Absolutely...

Protect the host and nothing will route