Tunneling is the practice of wrapping one network protocol or data stream inside another to move traffic through systems that would otherwise block it. In security, it can support remote access or evade inspection, so defenders monitor for unauthorized tunnels, especially when they bypass policy, segmentation, or identity controls.
How tunneling works
Tunneling encapsulates one protocol inside another so traffic can traverse networks, devices, or policy boundaries that would otherwise stop it. The outer protocol carries the inner payload, which means the transport path and the inspected content can look different to controls that only evaluate one layer.
This is why tunneling is often discussed alongside remote access, proxying, and segmentation bypass. The key security question is not whether traffic moves, but whether the organisation can still see, classify, and govern what is being carried through that path.
Why tunneling changes security visibility
Tunneling can hide the real application, destination, or command channel from devices that rely on simple protocol checks. If the tunnel is approved, that may be acceptable; if it is shadow IT, malware, or an unauthorised remote route, the same mechanism becomes a control bypass that reduces visibility into who is connecting, where traffic is going, and what data is moving.
In practice, defenders care about tunneling because it can collapse the distinction between allowed network reachability and allowed business use. A path that appears legitimate at the transport layer may still violate policy, segmentation, data handling rules, or identity-based access expectations.
Common tunneling patterns and where they appear
Tunneling shows up in many forms, including VPNs, SSH port forwarding, HTTPS CONNECT proxies, dns tunneling, and application-layer encapsulation. Some are standard administrative tools, while others are used to smuggle traffic through restrictive environments or to blend covert communication into ordinary-looking network flows.
The same pattern can serve different purposes depending on context. In enterprise environments it may support secure administration, while in hostile or unmanaged environments it may be used to evade filtering, pivot deeper into a network, or establish persistence through a path defenders are not monitoring closely enough.
How defenders detect and govern tunneling
Defence starts with knowing which tunnels are authorised, which protocols they use, and which business cases justify them. That usually means aligning network policy with NIST Cybersecurity Framework 2.0 and enforcing secure connectivity controls from NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where access control, logging, and configuration management intersect.
For environments that use segmentation and zero trust principles, NIST SP 800-207 Zero Trust Architecture is relevant because it treats trust as something to verify continuously, not something granted by a network location. When the traffic itself is the concern, defenders also need inspection that can spot unusual encapsulation, unexpected destinations, and protocol abuse without breaking legitimate operations.
Risk and Threat Considerations
Tunneling becomes risky when it is used to bypass security controls, conceal command-and-control traffic, or move sensitive data out of a controlled network path. The danger is not the encapsulation itself, but the way it can defeat segmentation, monitoring, and policy enforcement while still looking like ordinary connectivity.
Failure mechanism: A tunnel can create a trusted-looking conduit that evades protocol-aware filtering, hides the real destination, and carries traffic that security tools cannot inspect at the right layer.
Impact: Organisations can lose visibility into exfiltration, lateral movement, and unauthorised remote access, which raises the chance of undetected compromise or policy violations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5, NIST Zero Trust (SP 800-207) and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Network Segmentation | Tunneling directly affects segmentation enforcement and trust boundaries. |
| Recommendation — Monitor and restrict tunnels that bypass segmentation boundaries. | ||
| NIST SP 800-53 Rev 5 | AC-4 — Information Flow Enforcement | Tunneling can move prohibited traffic through controls that must enforce flow policy. |
| AU-2 — Event Logging | Detecting unauthorised tunnels depends on logging the traffic, endpoints, and control decisions. | |
| Recommendation — Enforce flow restrictions for tunneled traffic and block unauthorised encapsulation. Log tunnel creation, endpoint changes, and anomalous encapsulation events. | ||
| NIST Zero Trust (SP 800-207) | ZT-CORE — Zero Trust Architecture | Tunneling is easier to govern when trust is continuously verified rather than assumed by network location. |
| Recommendation — Apply continuous verification to tunneled sessions and deny implicit trust. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Tunneling is a network defence concern because it can conceal hostile or unauthorised traffic patterns. |
| Recommendation — Detect and investigate unusual tunnels, ports, and protocol encapsulation patterns. | ||
Practitioner Guidance
Why practitioners should care: Treat tunneling as an allowlist problem, not just a network transport issue. The practical challenge is to distinguish approved administrative or remote-access tunnels from covert or policy-breaking ones.
What to watch for: Review unexpected protocol combinations, unusual port usage, recurring encrypted flows to unfamiliar endpoints, and tunnels that appear after segmentation changes or access exceptions. Those patterns often deserve closer inspection than the tunnel technology itself.
Practitioner takeaway: The safest tunnel is one you can justify, inventory, monitor, and revoke quickly when it no longer has a valid business purpose.
Related resources from NHI Mgmt Group
- How should security teams govern SSH tunneling in production environments?
- How do security teams know whether split tunneling is still undermining CUI protection?
- How should security teams detect DNS tunneling in enterprise networks?
- Why does DNS tunneling remain effective even when firewalls are in place?