Blocking Media over VPN

In fact, organizations deploying Lync Edge services should be going out of their way to avoid the possibility of clients connecting a media stream over the VPN tunnel. Lync clients always prefer a direct peer-to-peer connection when negotiating a call, but they don’t have any logic to determine whether they are on a VPN connection. So when a user establishes a VPN and then tries to call a user on the internal network, the two clients will think they should connect peer-to-peer instead of relaying their traffic through the Edge Server.

Depending on the VPN technology, organizations can use a combination of defined port ranges, IP address ranges, and source executable names to effectively block Lync clients from connecting over VPN. These blocks need to be put in place between VPN clients and internal network users, and between the VPN users and Lync Front End or Mediation server roles.

After these blocks are established, a user’s Lync client will continue to use the Edge Server for all signaling and media, as depicted in Figure 31.12, regardless of whether a user has a VPN connected. This does require split-tunnel access to the Edge server public addresses.

Figure 31.12. VPN deny rules.