Remote Work from Another Country Using a Company Laptop

Posted by Gullible_Tangelo214@reddit | sysadmin | View on Reddit | 42 comments

I’d like to work from another country, but my employer prohibits it under company policy. I understand the reasons behind the rule, but I find the restriction frustrating and have been wondering whether there are any practical ways to spend some time working from abroad without causing issues or drawing attention. I currently have two ideas that I’d like to discuss. 1. Buying a travel router, such as a GL.iNet GL-MT3000, and configuring it so that all traffic is routed through my home network. I would get a static IP at home and set up a VPN there. In theory, if everything is configured correctly, both DNS and IPv4/IPv6 should appear as if they are coming from my home connection. However, this raises other questions, since location might potentially be inferred through means other than just IP address. For example, I could disable the WLAN module in BIOS and use Ethernet only, but I suspect that may not be the only thing to worry about. 2. The second option would be to leave the work laptop at home and buy a KVM-over-IP device, such as a PiKVM Mini V4. My assumption is that, if configured properly, it should not be obvious that it is a KVM rather than a regular mouse and keyboard. But this also raises questions. First, what would need to be configured to avoid obvious red flags? Also, I’m not very excited about dealing with latency, setting up automatic reboot/power-on, and handling disk encryption on the corporate laptop. Since full-disk encryption is enabled, I would likely have to enter the password blindly, because it probably would not be visible through the KVM screen. I’d like to hear your opinions and experiences. How realistic is this plan overall? What are the main risks, and are there any ways to reduce them?

Reply to Post

42 Comments

[-]

Substantial-Fruit447@reddit

1. have you even asked for a temporary exception? If it's just for a short period of time, exceptions can and have been made as long as permission is sought. 2. Don't do it without anyone knowing or granting permission. If someone said no, and you did it anyway, you will lose your job. If company policy prohibits it, you didn't ask, and did it anyway, you're still violating the company policy and will likely result in your termination.

[-]

Gullible_Tangelo214@reddit (OP)

Management asked for it. As far as I can tell, it's more of a company preference than a hard legal requirement. We don't have any government contracts or other regulatory obligations that would prevent employees from working from abroad.

[-]

Substantial-Fruit447@reddit

That you know of... See #1

[-]

bageloid@reddit

You will eventually get found out and fired.

[-]

Viper896@reddit

Came here to say this. Our tools would detect this pretty quickly. We detect logins from VPN providers and flag them for follow-up with users. Additionally, we can pretty easily see when a users mfa device checks from in out of the country. This is a very quick way to get fired. The KVM idea only works until you have to push the power button for some reason or in our environment enter the bitlocker pin. The moment you needed any actual support for your device, this falls apart quickly.

[-]

Livid-Setting4093@reddit

Bounced off home router should work, but MFA use or email on the phone can expose OP. KVM though is almost bulletproof. If it looks like there is no reason for this policy then asking for an exception may work.

[-]

Automatic_Mulberry@reddit

Fired **for cause**, and no other company will want to hire OP, because the rules are clearly for Other People.

[-]

Gullible_Tangelo214@reddit (OP)

Fair enough. I'm not looking to make this a long-term setup or abuse the system—I'm mainly thinking about occasional trips abroad. But overall, I think you're right.

[-]

publicdomainadmin@reddit

This is so stupid.

[-]

bigpacks@reddit

Let me guess, a couple comments below this is a "new" account hawking some great AI slop that solves all OPs problems??!

[-]

publicdomainadmin@reddit

Nah, I think OP is trying to do something that is actually as stupid as the post is, like they won't get caught. All it takes is 1 colleague to be a whiff of suspicious and you are toast when someone really looks and pay attention for a few days. It's such a joke too I stopped reading after around static IP. I stopped and thought to myself: OP is bulletproof having thought of that, I needn't read know further, clearly they have it figured out with their static IP and this reddit post, you do you Stu. I hate it when my colleages suck and do shitty things.

[-]

bigpacks@reddit

Same man. Made it a few sentences in and scrolled down to see the 1st comment But it did remind be of a funny support call I got on a few years ago... Dude was complaining about WebEx not working on the open internet or VPN. So, long story short he was in Iran visiting family & didn't tell anyone or understand why everything was Blacklisted

[-]

usps_lost_my_sh1t@reddit

are you a sys admin? this gives corporate peon who wants to cheat out and get a mouse jiggler while in Cancun vibes . try it. report back how it goes. I use a riverbed endpoint agent, that would run through enough I believe it would still show where you are geographically (which all my assets do) i.e I use a very similar setup to your first through work. I travel with the little router. riverbed still shows me in Japan.. Europe ECT. tho I'm tunneled into my job .. and if I go to weather. com or by location based thing shows me in Atlanta or new York based on where I was load balanced

[-]

Lemonwater925@reddit

Incredibly bad idea. There will be some fingerprints of the apps somewhere. Not to mention your organization can likely remote into your machine at any time and review logs or run monitoring software.

[-]

MsAnthr0pe@reddit

How about you do everyone involved a favor and find a job that lets you work from other countries instead of trying to find a way to circumvent company policy because you think you should be an exception for some reason. FFS I hate users like you.

[-]

elkalada@reddit

Imagine if he was able to cover his tracks properly and got fired because of this reddit post instead lol would be ironic

[-]

su_A_ve@reddit

OP looking for a quick way to get fired.. /s

[-]

cruz878@reddit

Really depends on the employer and how aggressively they are tracking it. For example they could force 2FA to a locked down mobile phone that coughs up location data. All traffic routed stateside back through your home internet will probably suffice for most companies. But if they ship you a new laptop for any reason be prepared to hop on a plane. You are risking being terminated though if they find out so make sure you accept that fate.

[-]

Gullible_Tangelo214@reddit (OP)

Fair enough, I get your point. The idea is probably not as smart as I initially thought. You're right.

[-]

First_Slide3870@reddit

Couple of solutions here,, You could VPN to your home network, and then RDP or use VNC client (tight vnc) to take control of your machine. Any half decent EDR might block or detect this, so you’ll have to test it out. The advantage of the vnc client is you may not have to log out of your current session with another user. RDP you’ll have to use your company credentials contso\username. Honestly, test it out. You could use a KVM but I think it’s pretty clear that it’s hard to do any meaningful work on a KVM. I have a piKVM and I use it just to get me out of trouble. I would equate to trying to do meaningful work on an idrac but worse.

[-]

Ferro_Giconi@reddit

This post is so bad I thought I was on r/shittysysadmin

[-]

8und1e5@reddit

secops edr/siem will have indicators that will generate alerts if you use a kvm device. In my company we have several detections for usb /video feed emulation, mouse jigglers etc. here is a doc further explaining https://www.runzero.com/blog/oob-p1-ip-kvm/. Now for a travel router depends what you have setup at home and yes your network/firewall admins most probs have detections for wireguard traffic. Again I don’t know your companies architecture or your position. But I would advise against this as it’s a clear breach in your companies polices, go speak to your manager and see they can help. In my company we are allowed to work aboard for up to a month and my manager is cool with allowing me once a year work remotely aboard to visit my family.

[-]

Certain_Egg605@reddit

I would say you could get away with it. You'd also have to route what ever device you use for mfa through the vpn. I would probably remove the sim to do so. I'd have a wap, connected to a router which had its default route set down the tunnel and connect both laptop and mfa device to it. The thing people haven't mentioned is tax. You may end up in court or prison over tax laws. Good luck were counting on you.

[-]

hobovalentine@reddit

Most companies will block or flag VPN usage but you might be able to fool them if your data plan has roaming coverage overseas in which case your IP address is based in the country it originated in.

[-]

Gullible_Tangelo214@reddit (OP)

I'm not entirely sure how a company could technically detect a VPN if it's running on my router. As far as I understand, the laptop should see the same public IP address as my home network in either case.

[-]

hobovalentine@reddit

If you’re using a commercial VPN the IP addresses are fairly well known but if you have custom routing then yes it’s much harder to be detected.

[-]

Gullible_Tangelo214@reddit (OP)

Im not, vpn is my on home router

[-]

Substantial-Fruit447@reddit

If your org requires a company VPN to access certain resources, they will know the source IP address of the network you're connecting from. Every device needs an origin IP, and every country has its own band of IPs assigned. If it's not a company VPN, and you're using your own, there is still data that can be extracted to say what type of VPN you're using. That's an even bigger issue if your company does not allow VPN use/non-approved VPN use.

[-]

Humpaaa@reddit

Depending on the tooling used, they can very easily detect this.

[-]

ScarcityReal5399@reddit

No way is this a sys admin, while I find policies to be painful, they are there for a reason, our jobs as administrators is to make sure those policies are followed. I see you mentioning making changes to BIOS and configurations, most companies would have these locked down to a standard user. Hypothetically let's say you do this, what country are you going to be working remotely? Is this country blacklisted? If a blacklist country and your employer has federal contracts, you are in some serious shit

[-]

AltTabMafia@reddit

I think you should find another career path.

[-]

Router_RIP@reddit

Do not do this. You are actively breaking company policy. You will be fired. Companies are actively monitoring for this and crowdstrike will block and alert on IP KVMs such as glinet and pi kvms.

[-]

BuffaloRedshark@reddit

>I understand the reasons behind the rule, Do you really though? There are tax implications, VISA implications, all sorts of legal and compliance implications.

[-]

AlexHuntKenny@reddit

There is still time to delete this post.

[-]

askoorb@reddit

This will go great until your laptop is "inspected" by border control, or just stolen.

[-]

WiskeyUniformTango@reddit

You're so fired. ![gif](giphy|3EAYL7KCtZJOJGtli6)

[-]

BBO1007@reddit

You absolutely can get away with it. . . . . Until you get caught. My guess is a slip up and your email tries to connect while not on vpn.

[-]

SystemsDadmin@reddit

This is more than a fireable offense. You very much could find yourself in court, especially if you have elevated access. Happened where I work. The AS/400 administrator decided he was going to work from the middle east during covid. He was immediately flagged by our VPN. It wasn’t but 5 minutes later I was disabling his account and placing him on litigation hold.

[-]