A method for routing a communication in a multiple forwarding information base, MFIB, user equipment, UE, comprising: determining (418, 718, 1018, 1318, 1328) that a binding interface (118, 318, 518, 818, 1118) is assigned for a communication session based on a forwarding information base, FIB (108, 308, 508, 808, 1108), and a destination for the communication session, the communication session being from an application (112, 312, 512, 812, 1112) running on the MFIB UE (102, 302, 502, 802, 1102), the MFIB UE having two or more perimeters (103, 303, 503, 803, 1103; 105, 305, 505, 805, 1105) each defining respective logical separations of resources, the application being included in one of the two or more perimeters, the FIB being assigned to the one of the two or more perimeters of the application and associating destinations with communication interface information, and the binding interface being a physical interface a virtual private network, VPN, tunnel is established over; and determining whether to filter (422, 724, 1024, 1322, 1334) the communication session to prevent direct access to the binding interface based on: which of the two or more perimeters includes the binding interface; which of the two or more perimeters includes an Internet Protocol security, IPsec, interface (114, 314, 514, 814, 1114) the VPN is established through; and whether the application is granted access to interfaces in another perimeter of the two or more perimeters. determining (418, 718, 1018, 1318, 1328) that a binding interface (118, 318, 518, 818, 1118) is assigned for a communication session based on a forwarding information base, FIB (108, 308, 508, 808, 1108), and a destination for the communication session, the communication session being from an application (112, 312, 512, 812, 1112) running on the MFIB UE (102, 302, 502, 802, 1102), the MFIB UE having two or more perimeters (103, 303, 503, 803, 1103; 105, 305, 505, 805, 1105) each defining respective logical separations of resources, the application being included in one of the two or more perimeters, the FIB being assigned to the one of the two or more perimeters of the application and associating destinations with communication interface information, and the binding interface being a physical interface a virtual private network, VPN, tunnel is established over; and the communication session being from an application (112, 312, 512, 812, 1112) running on the MFIB UE (102, 302, 502, 802, 1102), the MFIB UE having two or more perimeters (103, 303, 503, 803, 1103; 105, 305, 505, 805, 1105) each defining respective logical separations of resources, the application being included in one of the two or more perimeters, the FIB being assigned to the one of the two or more perimeters of the application and associating destinations with communication interface information, and the binding interface being a physical interface a virtual private network, VPN, tunnel is established over; and determining whether to filter (422, 724, 1024, 1322, 1334) the communication session to prevent direct access to the binding interface based on: which of the two or more perimeters includes the binding interface; which of the two or more perimeters includes an Internet Protocol security, IPsec, interface (114, 314, 514, 814, 1114) the VPN is established through; and whether the application is granted access to interfaces in another perimeter of the two or more perimeters. which of the two or more perimeters includes the binding interface; which of the two or more perimeters includes an Internet Protocol security, IPsec, interface (114, 314, 514, 814, 1114) the VPN is established through; and whether the application is granted access to interfaces in another perimeter of the two or more perimeters.