What Is VPN Split Tunneling and How Does It Work

 What Is VPN Split Tunneling?

Split tunneling is a VPN feature that lets you decide which network traffic goes through the encrypted VPN tunnel and which traffic goes directly to the internet without the VPN.

Think of it as creating two separate “paths” for your device’s traffic:

• Path A: Encrypted → Goes through the VPN to a remote network
• Path B: Direct → Uses the normal internet connection (no VPN encryption)

Without split tunneling, all your traffic normally flows through the VPN tunnel.

Why Split Tunneling Exists

Split tunneling solves a common problem:

When you connect to a work VPN, you often don’t need everything (Netflix, personal browsing, software updates) to go through the corporate network. Doing so can:

• Slow your internet connection
• Overload the VPN
• block services (e.g., streaming, gaming)
• increase latency for apps like Zoom or Teams

Split tunneling lets you use the VPN only when needed.

How Split Tunneling Works (Technical Deep Dive)

A VPN creates an encrypted tunnel between your device and the VPN gateway. Split tunneling modifies system routing so that:

• Selected IP ranges or applications are routed through the VPN gateway
• Everything else uses the standard network gateway (your ISP router)

Two Types of Split Tunneling

Inclusive Split Tunneling

Only selected traffic uses the VPN.

You choose what to send over the tunnel, e.g.:

• Only apps like Outlook, SAP, and SSH
• Only traffic to a corporate IP range
• Only a specific browser window

Everything else bypasses the VPN.

Exclusive Split Tunneling

Everything uses the VPN EXCEPT specific traffic.

Example exclusions:

• Streaming services
• Gaming services
• Banking websites
• Local LAN devices (printers, NAS)

Practical Examples

Example 1: Corporate Environment

You're working from home, connected to a company VPN.

Traffic that goes through the VPN:

• Internal servers (10.x.x.x or 172.16.x.x)
• Corporate tools like SharePoint or Teams
• Intranet pages

Traffic that bypasses the VPN:

• YouTube
• Personal browsing
• OS updates
• Smart home devices

Example 2: Using a VPN for Privacy

You want your web browsing to be private, but want local apps (like printers or smart TVs) to be accessible.

• Browser traffic → through VPN
• Local device traffic → bypass VPN

How It’s Implemented (Routing Behavior)

When split tunneling is enabled, the OS routing table is modified:

• Routes to corporate subnets → next-hop = VPN gateway
• Routes to local LAN and most public traffic → next-hop = local gateway

This is done using:

• Windows Routing Table
• Linux ip route / iptables
• macOS network routing
• Mobile OS VPN APIs (Android VpnService, iOS NEPacketTunnelProvider)

VPN clients apply these rules dynamically when the tunnel is established.

Benefits of Split Tunneling

Risks and Considerations

When You Should Not Use Split Tunneling

• When working with sensitive financial or government data
• On untrusted public Wi-Fi networks
• When full anonymity is required
• If your organization uses zero-trust principles

In these cases, force all traffic through the VPN ("full tunneling").

Summary

Split tunneling = selectively routing traffic through or outside a VPN.

• Gives performance, flexibility, and reduced load
• BUT also introduces security trade-offs
• Can be inclusive (only certain traffic goes through VPN)
• Or exclusive (everything except selected traffic goes through VPN)