How Split Tunneling Works and Why It Matters
Split tunneling lets you route some internet traffic through a VPN while sending other traffic directly to the internet.
It is useful for bandwidth-heavy apps, local network access, and latency-sensitive services, but it also creates a larger attack surface if configured poorly.
If you want the convenience of split tunneling without undermining privacy or security, the key is not just enabling the feature.
You need a clear policy for which traffic stays protected, which apps can bypass the tunnel, and how to prevent leaks if the VPN disconnects.
What Split Tunneling Changes in Your Network Path
With a full-tunnel VPN, nearly all device traffic goes through the encrypted tunnel to the VPN provider before reaching the public internet.
With split tunneling, only selected traffic is encrypted and routed through the VPN, while the rest uses your normal internet connection.
This can be configured in different ways depending on the VPN client and operating system:
- App-based split tunneling: Specific applications use or bypass the VPN.
- Destination-based split tunneling: Traffic to selected IP addresses or domains avoids the tunnel.
- Inverse split tunneling: Only chosen apps or traffic types use the VPN, while everything else stays direct.
The exact behavior varies across Windows, macOS, Linux, Android, iOS, and enterprise VPN platforms such as OpenVPN, WireGuard, Cisco AnyConnect, and Zscaler.
When Split Tunneling Is Appropriate
Split tunneling is best when you have a specific operational reason to bypass the VPN.
Common examples include:
- Streaming video or game traffic that does not need corporate network access
- Local printers, NAS devices, or smart-home devices on a home network
- Cloud services that perform better with direct routing
- Remote work setups that need access to both internal business tools and public services
For privacy-focused users, split tunneling can also help reduce unnecessary load on the VPN while keeping sensitive browsing, messaging, and account access encrypted.
The tradeoff is that any traffic excluded from the VPN is exposed to the normal risks of direct internet access, including ISP visibility and local network interception.
How to Set Up Split Tunneling Safely
The safest way to configure split tunneling is to start with a conservative rule set.
Route only the minimum traffic outside the VPN, and keep anything sensitive inside the tunnel by default.
1. Identify traffic that must remain protected
Before changing settings, classify your traffic.
Put financial accounts, email, password managers, work tools, medical portals, and administrative logins in the protected category.
Traffic that does not carry personal or business data can be considered for direct routing.
2. Prefer allowlisting over blocklisting
Allowlisting is safer because only approved apps or destinations can bypass the VPN.
Blocklisting, which sends everything through the VPN except a few excluded services, is easier to misconfigure and can accidentally expose more traffic than intended.
3. Use application-level controls when possible
App-based split tunneling is usually safer than destination-based rules because domains and IP addresses can change frequently.
Many services rely on content delivery networks, multiple subdomains, or dynamic infrastructure, which makes destination rules harder to maintain accurately.
4. Enable a kill switch
A VPN kill switch blocks internet access if the tunnel drops unexpectedly.
This is essential when using split tunneling because a brief connection failure can send protected traffic outside the VPN unless the client enforces fail-closed behavior.
5. Check DNS handling carefully
DNS leaks are a common split tunneling risk.
If your browser or operating system sends DNS queries outside the tunnel, websites can still be resolved by your ISP or local network even when the app’s traffic is protected.
Use VPN-provided DNS, secure DNS settings, or per-app DNS enforcement where available.
6. Test for leaks after configuration
After enabling split tunneling, verify that the right traffic is going where you expect.
Test your public IP address, DNS resolution, and WebRTC behavior.
Confirm that excluded apps truly bypass the tunnel and that protected apps remain inside it.
Common Security Risks to Avoid
Most split tunneling mistakes come from overconfidence.
A configuration that works in normal use may still leak traffic under edge conditions.
- Accidental exposure of sensitive apps: A broad exception list may include services that handle personal data.
- DNS leaks: Name resolution leaves the tunnel even when app traffic does not.
- IPv6 leaks: IPv4 may be protected while IPv6 traffic escapes through the local network.
- WebRTC leaks: Browser features can reveal network information or local addresses.
- Route conflicts: Corporate and home network routes may overlap, causing traffic to take an unintended path.
- Malware bypass: If unknown or compromised apps are allowed to bypass the VPN, they can communicate directly with command-and-control servers.
These risks are especially important in enterprise environments where split tunneling may be used on managed devices.
Security teams often pair it with endpoint detection and response, device posture checks, and strict least-privilege access rules.
Best Practices for Different Devices and Platforms
Safe split tunneling depends on the device and operating system.
Consumer VPN apps often provide simple per-app settings, while enterprise clients may support more granular policy controls.
Windows and macOS
On desktop systems, use the VPN client’s native split tunneling feature rather than manual route editing whenever possible.
Native controls are easier to audit and less likely to break after updates.
Check whether the client supports DNS protection, IPv6 handling, and kill switch enforcement.
Android and iOS
Mobile devices benefit from app-based split tunneling, but behavior can vary by vendor and OS version.
Some apps use system frameworks that make traffic classification inconsistent, so it is important to test specific services rather than assuming every app follows the rule correctly.
Linux
Linux users may configure split tunneling through routing tables, policy-based routing, or VPN clients such as WireGuard and OpenVPN.
This offers flexibility, but manual configuration increases the chance of mistakes.
Document your routes and verify them after system updates or network changes.
Questions to Ask Before You Turn It On
Before enabling split tunneling, ask whether the convenience is worth the reduced coverage.
In many cases, the safest setup is still a full tunnel with no exceptions.
- Does this app really need direct internet access?
- Will bypassing the VPN reveal sensitive metadata?
- Can the VPN client enforce a kill switch and DNS protection?
- Are there overlapping routes or multi-network situations to consider?
- Have I tested failover, reconnection, and sleep/wake behavior?
If the answer to any of these is unclear, keep the traffic inside the VPN until you can validate the behavior.
How to Verify That Your Setup Is Working Safely
Verification should be part of the setup process, not an afterthought.
Use a combination of network checks and real-world tests to confirm that the rules behave as intended.
- Check your IP address inside and outside the VPN.
- Inspect DNS requests using a leak test tool.
- Open an excluded app and confirm it uses your direct connection.
- Open a protected app and confirm it stays on the VPN IP.
- Disconnect the VPN and confirm the kill switch blocks sensitive traffic.
- Restart the device to ensure settings persist correctly.
For business use, log configuration changes and periodically re-test after VPN client updates, OS patches, and network policy changes.
When Not to Use Split Tunneling
There are cases where split tunneling is the wrong choice.
Avoid it when you need maximum confidentiality, when the device is unmanaged, or when the network environment is hostile.
Examples include public Wi-Fi use, travel in high-risk regions, regulated workloads, and any device that processes credentials or sensitive intellectual property.
In those situations, a full-tunnel VPN with strong DNS protection, a reliable kill switch, and modern protocols such as WireGuard or OpenVPN is usually the better choice.
Practical Rule of Thumb for Safer Configuration
The safest approach to how to set up split tunneling safely is simple: protect sensitive traffic by default, allow only clearly justified exceptions, and verify every rule under normal and failure conditions.
That discipline reduces the chance of leaks while preserving the performance and usability benefits that make split tunneling attractive in the first place.