SplitTunneling

Split tunneling is a networking technique used with virtual private networks (VPNs) and other secure tunnels, also known as selective tunneling, in which only a portion of a device's traffic is sent through the encrypted tunnel while the remaining traffic accesses the internet directly. This arrangement contrasts with full tunneling, in which all traffic is routed through the VPN.

Configurations are typically policy-based. Route-based split tunneling uses routing rules to direct traffic for specified destinations or subnets through the VPN, while other traffic follows the ordinary gateway. Application-based split tunneling directs traffic on a per-application basis, allowing some programs to use the VPN while others bypass it.

Common use cases include corporate environments where employees need access to internal resources via VPN while keeping local network access or consumer internet traffic outside the tunnel for performance, cost, or region-specific services. It can also help conserve bandwidth and reduce load on VPN servers.

Security and privacy considerations follow from its design. Because traffic outside the VPN is not encrypted by the tunnel, it may be exposed to local networks, ISPs, or DNS resolvers, creating potential privacy and leak risks. Misconfigurations can negate security benefits, and many organizations restrict split tunneling to prevent data exfiltration or noncompliant traffic. VPN clients and operating systems may also mishandle IPv6 or DNS in split-tunnel setups, potentially causing leaks.

Implementation requires compatible VPN software and careful routing or policy configuration. The approach trades security for performance and flexibility and may be unsuitable for high-security environments.