Reducing load at a proxy server

1. A method for reducing a load placed on an endpoint server acting as an endpoint of a tunnel from a client device across a network, the method, implemented at the client device, comprising:

receiving a request to establish a new network connection;

determining a risk establishing the new network connection outside of the tunnel, the risk based on a plurality of predefined criteria relating to the new network connection;

comparing the determined risk with a predefined risk threshold;

when the determined risk is less than or equal to the predefined risk threshold, establishing the new network connection directly via the network outside of the tunnel, when the new network connection fails before it is completed it is re-established via the tunnel; and

when the determined risk is greater than the predefined risk threshold, establishing the new network connection via the tunnel.

2. The method of claim 1 further comprising attempting to re-establish the new network connection directly via the network outside of the tunnel before re-establishing the new network connection via the tunnel.

3. The method of claim 2 , wherein the attempt to establish the new network connection is limited to a predefined number of attempts.

4. The method of claim 1 , further comprising forcing the new network connection to close if it fails before it is completed.

5. The method of claim 4 , wherein the new network connection is forced to close by injecting a network event into the new network connection.

6. The method of claim 5 , wherein the network event is in in-bounds message or an out-of-bounds message.

7. The method of claim 1 , wherein the predefined criteria include one or more of a security policy, traffic type, interface status or consequence of failure.

8. The method of claim 7 , wherein the security policy identifies which type of data can be offloaded from the tunnel without violating the purpose for the tunnel.

9. The method of claim 7 , wherein the traffic type indicates whether or not new network connection is expected to be a short duration.

10. The method of claim 7 , wherein the interface status indicates one or both of a potential for motion of the client device or a quality of signal.

11. A client device configured for reducing a load placed on an endpoint server acting as an endpoint of a tunnel from the client device across a network, the client device comprising:

a processor, and

a computer-readable medium having stored thereon instructions which, when executed by the processor, cause the processor to:

receive a request to establish a new network connection;

determine a risk establishing the new network connection outside of the tunnel, the risk based on a plurality of predefined criteria relating to the new network connection; compare the determined risk with a predefined risk threshold;

when the determined risk is less than or equal to the predefined risk threshold, establish the new network connection directly via the network outside of the tunnel, when the new network connection fails before it is completed it is re-established via the tunnel; and

when the determined risk is greater than the predefined risk threshold, establish the new network connection via the tunnel.

12. The client device of claim 11 further comprising instructions for attempting to re-establish the new network connection directly via the network outside of the tunnel before re-establishing the new network connection via the tunnel.

13. The client device of claim 11 , comprising further instructions for forcing the new network connection to close if it fails before it is completed.

14. The client device of claim 13 , wherein the new network connection is forced to close by injecting a network event into the new network connection.

15. The client device of claim 14 , wherein the network event is in in-bounds message or an out-of-bounds message.

16. A non-transitory computer-readable medium having stored thereon instructions for reducing a load placed on an endpoint server acting as an endpoint of a tunnel from a client device across a network, the instructions, when executed by a processor, cause the processor to implement:

receiving a request to establish a new network connection;

determining a risk establishing the new network connection outside of the tunnel, the risk based on a plurality of predefined criteria relating to the new network connection; comparing the determined risk with a predefined risk threshold;

when the determined risk is less than or equal to the predefined risk threshold, establishing the new network connection directly via the network outside of the tunnel, when the new network connection fails before it is completed it is re-established via the tunnel; and

when the determined risk is greater than the predefined risk threshold, establishing the new network connection via the tunnel.

17. The non-transitory computer-readable medium of claim 16 comprising further instructions for attempting to re-establishing the new network connection directly via the network outside of the tunnel before re-establishing the new network connection via the tunnel.

18. The non-transitory computer-readable medium of claim 16 , comprising further instructions for forcing the new network connection to close if it fails before it is completed.

19. The non-transitory computer-readable medium of claim 18 , wherein the new network connection is forced to close by injecting a network event into the new network connection.

20. The non-transitory computer-readable medium of claim 19 , wherein the network event is in in-bounds message or an out-of-bounds message.