What Is VPN Split Tunneling and How Does It Work

Split Tunneling Explained: What It Is, Why It's Used, and the Risks

Sep 26, 2026 · @Ken

What Split Tunneling Is

Split tunneling is a VPN configuration that sends some of a client's traffic through the encrypted tunnel and lets the rest go straight out to the internet. The client ends up with two paths at the same time: one to the corporate network, one to everything else.

Compare that to a full tunnel, sometimes called a forced tunnel. In a full tunnel, every packet the client sends goes through the VPN, including requests to public websites. The traffic reaches the corporate gateway, gets inspected and filtered, then exits to the internet from the company's connection. The reply comes back the same way.

The trade-off is the whole story. Split tunneling buys performance and saves bandwidth. Full tunneling buys visibility and control. Both exams expect you to explain that trade-off, not just define the term.

How the Traffic Actually Splits

The decision happens in the client's routing table. When the VPN connects, the client software installs routes that decide which destinations use the virtual adapter and which use the physical one.

There are three common ways to draw that line:

• Split include (inclusive): only the listed destinations go through the tunnel, usually the corporate subnets such as 10.0.0.0/8. Everything else goes direct. This is the default on most enterprise VPNs.
• Split exclude (exclusive or inverse): everything goes through the tunnel except a short list of exceptions, often Microsoft 365 or a video conferencing service. It is the safer of the two, because the default is protection.
• Application-based (dynamic): the client sends traffic based on which application generated it, or on hostnames rather than IP ranges. This handles cloud services whose IP addresses change often.

DNS deserves its own mention. A split tunnel client may use the corporate DNS server, a public resolver, or both, in what is called split DNS. If DNS is not configured to match the routing, a client can resolve an internal name with a public resolver, leak the query, and then fail to reach the host anyway.

Why Organizations Use It

Split tunneling exists because full tunneling puts every remote user's entire internet habit on the company's pipe and on the VPN concentrator.

• Bandwidth. A remote workforce streaming video, syncing files, and browsing sends it all through headquarters in a full tunnel. Split tunneling keeps that traffic off the corporate link.
• Latency and user experience. Voice and video are sensitive to delay. Hairpinning a Zoom or Teams call to the data center and back out adds latency and jitter. Sending it directly usually sounds and looks better.
• Concentrator capacity. Every tunneled session consumes CPU on the VPN appliance for encryption. Less traffic in the tunnel means the same hardware supports more users.
• Local resources. Users keep access to a home printer, a NAS, or a smart device on their own LAN while connected.
• Cost. Less traffic through the corporate circuit can mean a smaller circuit, and less egress billed at the data center.

The Security Risks

Every packet that skips the tunnel also skips the security stack sitting behind it.

• No inspection on direct traffic. The corporate firewall, web proxy, URL filter, TLS inspection, and DLP never see it. A user can download malware or upload a customer list to personal cloud storage, and no corporate control is in the path.
• The host becomes a bridge. A client connected to a hostile network, such as untrusted hotel Wi-Fi, is reachable from that network while it holds a live tunnel to the corporate LAN. If the host is compromised, the attacker has a route in. This is the dual-homed or bridging risk, and it's why many regulated environments forbid split tunneling outright.
• DNS leakage. Queries for internal hostnames sent to a public resolver expose internal naming to outsiders and can be used for reconnaissance.
• Blind spots in logs. Incident responders reconstruct activity from proxy and firewall logs. Traffic that went direct leaves no entry, so a CySA+-style investigation hits a gap.
• Compliance exposure. Frameworks that require monitoring or filtering of user traffic are hard to satisfy when a portion of it is never observed.

How to Reduce the Risk

The answer on the exam is rarely "never use it." It is to narrow it and compensate for it.

• Prefer split exclude over split include. Tunnel by default and carve out a short, named list of exceptions such as a conferencing service.
• Move inspection to the endpoint. An EDR agent, host firewall, and endpoint DNS filtering enforce policy on traffic the corporate gateway never sees.
• Use a cloud-delivered security stack. SASE and secure web gateways inspect direct-to-internet traffic in the cloud instead of hairpinning it, which removes most of the reason to choose split tunneling in the first place.
• Adopt ZTNA. Zero trust network access grants per-application access rather than dropping the user onto the corporate network, which shrinks what a compromised host can reach.
• Control DNS. Force corporate or filtered DNS for all queries so internal names stay internal and known-bad domains get blocked.
• Check posture and disable local bridging. Require patch level, disk encryption, and a healthy agent before the tunnel comes up, and block IP forwarding on the client.

Network+ Exam Tips

Network+ treats split tunneling as a remote access design choice, so questions lean toward connectivity and performance.

• Know the vocabulary pairs: split tunnel versus full tunnel, and client-to-site (remote access) versus site-to-site.
• Expect performance scenarios. Remote users complain that video calls are choppy while the VPN is connected, and the fix is to exclude the conferencing traffic from the tunnel or to stop hairpinning it.
• Expect routing symptoms. A user cannot reach an internal server while connected because the split-tunnel configuration is missing a route for that subnet.
• Watch for local access clues. If a user loses their home printer the moment the VPN connects, that is full tunneling, and split tunneling restores it.
• Be ready to name the trade-off in one sentence: split tunneling improves performance and saves bandwidth at the cost of visibility and control.

Security+ Exam Tips

Security+ frames the same feature as a risk decision, and it almost always wants the more secure answer.

• If a question describes traffic that avoided inspection, filtering, or logging, split tunneling is a strong candidate for the cause.
• When asked how to ensure all user traffic is inspected, disable split tunneling and force a full tunnel, not add another firewall rule.
• Know the compensating controls by name: SASE, secure web gateway, ZTNA, EDR, and endpoint DNS filtering.
• Do not confuse split tunneling with related distractors. Always-on VPN controls when the tunnel exists, not what goes through it. Network Access Control checks a device before admitting it. A jump box is a controlled path to internal systems.
• Remember the bridging risk: a host on a hostile network with a live tunnel can become a path into the corporate LAN.

Key Takeaways

• Split tunneling sends only selected traffic through the VPN and lets the rest go directly to the internet. A full tunnel sends everything through the VPN.
• The split is enforced by routes installed on the client, using an include list, an exclude list, or application and hostname rules.
• Organizations use it to save bandwidth, cut latency for voice and video, reduce load on the VPN concentrator, and keep local network access.
• The cost is visibility: direct traffic bypasses corporate firewalls, proxies, DLP, and logging, and a connected host on a hostile network can become a bridge into the LAN.
• Compensate with endpoint controls, cloud-delivered inspection such as SASE or a secure web gateway, ZTNA, controlled DNS, and posture checks.
• On Network+, think performance and routing. On Security+, think inspection and risk, and lean toward the full-tunnel answer.