Full Tunnel

How DNS and traffic routing works when using Banyan's Service Tunnel as a full tunnel

  • Updated on Apr 30, 2024
  • 5 minutes to read
  • Contributors

Full Tunnel Overview

Banyan’s Service Tunnel is a modern cloud-first VPN built on WireGuard. Banyan provides several domain-based configuration options (in addition to typical IP/CIDR and Port/Protocol configurations) to simplify tunnel management. You can configure private DNS resolution, domain-based routing and specify network policies in terms of Fully Qualified Domain Names (FQDNs).

Banyan Service Tunnels can be configured in “full tunnel” mode. In this scenario, the admin specifies that all traffic leaving a device should be tunnelled.

Full tunnels are suitable for the following use cases:

  • Drop-in replacement for an existing “remote access” full tunnel VPN
  • Security compliance mandates that all network traffic from a device needs to flow through on-premise security appliances (this also requires a Private Edge deployment model)

DNS Configuration

When configuring a full tunnel, we recommend explicitly setting the DNS server to be used when on the tunnel. You can use your own internal DNS server or a public DNS provider such as Google (8.8.8.8) or Cloudflare (1.1.1.1).

Example Setup

An example of a full tunnel configuration is depicted in the image below. We set the public CIDRs for the tunnel to be 0.0.0.0/1 and 128.0.0.0/1. DNS requests are sent to Google Public DNS at 8.8.8.8 and 8.8.4.4. In this example, we also exclude traffic destined for Zoom by excluding the domain zoom.us from the tunnel.

An example of a full tunnel configuration is depicted in the image below. We set the public CIDRs for the tunnel to be 0.0.0.0/1 and 128.0.0.0/1. DNS requests are sent to Google Public DNS at 8.8.8.8 and 8.8.4.4. In this example, we also exclude traffic destined for Zoom by excluding the domain zoom.us from the tunnel.

Note: Do not use 0.0.0.0/0 in the public CIDRs specification. A default route for 0.0.0.0/0 will already exists on the device and clobbering it can result in unpredictable behavior. Instead of replacing the default route, just override it with two more specific rules - 0.0.0.0/1 and 128.0.0.0/1 - that add up in sum to the default, but match before the default.

Can’t find what you’re looking for?

We’re happy to help. Contact our team.