A method includes detecting, at a device, a request for a network connection from an application running on the device; spawning first and second virtual machines for network connections that virtualize network capabilities of the device such that first and second virtual network connections are provided; using the first virtual network connection, establishing a first connection with another device over a first path; using the second virtual connection, establishing a second connection with the other device over a second path; determining that the second path represents a trusted path; determining that a first packet does not need to be routed via a trusted connection; transmitting the first packet using the first virtual network connection for communication via the first path; determining that a second packet needs to be routed via a trusted connection; and transmitting the second packet using the second virtual network connection for communication via the second path.