A system comprising: a virtual private network, VPN, gateway (255, 500, 600) configured to: receive a domain name system response through a physical coding sublayer; fetch a table entry corresponding to the domain name system response, wherein the table entry comprises a fully qualified domain name; fetch one or more access control list rules from an access control list table for a specific user account corresponding to the table entry; in response to the one or more access control list rules including an ACL policy of allow, install an Internet protocol, IP, address provided in the domain name system response in an allow table of an ipset rules module operating in a kernel space; in response to the one or more access control list rules including an ACL policy value of deny, install a deny entry in the ipset rules module; and handle requested data traffic to the IP address based on ipset rules on the ipset rules module that enforce the one or more access control list rules; and a client device (100, 505) configured to: create a virtual tunnel interface route between the client device and a port of a transmission control protocol, TCP, listener device; parse a domain name system response packet, received from the VPN gateway, for the fully qualified domain name and an Internet protocol, IP, address; update a domain name system cache with the fully qualified domain name and the IP address; determine whether exit data network traffic corresponding with one or more user applications should be routed to the VPN gateway over a secure communication channel or whether the exit data network traffic should be directly routed to a destination IP address thereof over a virtual interface tunnel route; and send unencrypted network traffic to the TCP listener device over the virtual tunnel interface route. a virtual private network, VPN, gateway (255, 500, 600) configured to: receive a domain name system response through a physical coding sublayer; fetch a table entry corresponding to the domain name system response, wherein the table entry comprises a fully qualified domain name; fetch one or more access control list rules from an access control list table for a specific user account corresponding to the table entry; in response to the one or more access control list rules including an ACL policy of allow, install an Internet protocol, IP, address provided in the domain name system response in an allow table of an ipset rules module operating in a kernel space; in response to the one or more access control list rules including an ACL policy value of deny, install a deny entry in the ipset rules module; and handle requested data traffic to the IP address based on ipset rules on the ipset rules module that enforce the one or more access control list rules; and receive a domain name system response through a physical coding sublayer; fetch a table entry corresponding to the domain name system response, wherein the table entry comprises a fully qualified domain name; fetch one or more access control list rules from an access control list table for a specific user account corresponding to the table entry; in response to the one or more access control list rules including an ACL policy of allow, install an Internet protocol, IP, address provided in the domain name system response in an allow table of an ipset rules module operating in a kernel space; in response to the one or more access control list rules including an ACL policy value of deny, install a deny entry in the ipset rules module; and handle requested data traffic to the IP address based on ipset rules on the ipset rules module that enforce the one or more access control list rules; and a client device (100, 505) configured to: create a virtual tunnel interface route between the client device and a port of a transmission control protocol, TCP, listener device; parse a domain name system response packet, received from the VPN gateway, for the fully qualified domain name and an Internet protocol, IP, address; update a domain name system cache with the fully qualified domain name and the IP address; determine whether exit data network traffic corresponding with one or more user applications should be routed to the VPN gateway over a secure communication channel or whether the exit data network traffic should be directly routed to a destination IP address thereof over a virtual interface tunnel route; and send unencrypted network traffic to the TCP listener device over the virtual tunnel interface route. create a virtual tunnel interface route between the client device and a port of a transmission control protocol, TCP, listener device; parse a domain name system response packet, received from the VPN gateway, for the fully qualified domain name and an Internet protocol, IP, address; update a domain name system cache with the fully qualified domain name and the IP address; determine whether exit data network traffic corresponding with one or more user applications should be routed to the VPN gateway over a secure communication channel or whether the exit data network traffic should be directly routed to a destination IP address thereof over a virtual interface tunnel route; and send unencrypted network traffic to the TCP listener device over the virtual tunnel interface route.