A method is described for reducing a load placed on an endpoint server acting as an endpoint of a tunnel from a client device across a network. The method, implemented at the client device, comprises the following steps. A request to establish a new network connection is received. A risk of establishing the new network connection outside of the tunnel is determined based on a plurality of predefined criteria. The determined risk is compared with a predefined risk threshold and, if the determined risk is less than or equal to the predefined risk threshold, the new network connection is established directly via the network. If the new network connection fails before it is completed it is re-established via the tunnel. If the determined risk is greater than the predefined risk threshold, the new network connection is established via the tunnel. A client device and computer-readable medium configured to implement the method is also described.