Split Tunneling Explained: What It Is & When to Use

What is split tunneling?

Split tunneling is a VPN configuration that sends some traffic through the encrypted VPN tunnel while other traffic goes directly to the internet or to your local network. Instead of routing every packet from your device through a single VPN gateway (a full-tunnel configuration), split tunneling lets you choose which apps, IP ranges, or destinations use the VPN and which do not.

There are several common flavors of split tunneling:

• App-based (per-app) — you choose individual applications to tunnel through the VPN (for example, only your browser or only a specific file-sync client).
• Destination/IP-based — traffic to particular IP ranges or destination networks is routed over the VPN while all other traffic follows the normal gateway.
• Inverse / exclude rules — the VPN sends everything through the tunnel except for explicitly excluded destinations or apps.
• Policy-based routing — rules based on protocol, port, source, or other packet attributes decide which interface to use; commonly used on routers and gateways.

How split tunneling actually works (technical overview)

At a technical level, split tunneling is implemented by changing routing behavior on the device so selected destinations use the VPN interface and all other traffic uses the system default gateway. That can be done in a few ways:

• Modifying the operating system routing table so that specific networks are routed into the VPN's virtual network interface (tun/tap, or a Windows NDIS adapter).
• Creating per-application rules in the VPN client or OS that bind a process to the VPN adapter.
• Using policy-based routing on a router, where traffic matching a policy is forwarded to the VPN gateway.

DNS handling is important and often overlooked. With split tunneling, DNS queries can flow outside the VPN unless the client provides DNS leak protection or split-DNS. In practice that means the VPN either forces DNS lookups over the tunnel or supplies a split-DNS service that resolves internal names via corporate DNS and public names via public DNS. Without this, an application routed over the VPN might still resolve hostnames using your local DNS, leaking which domains you queried.

To illustrate routes: a full-tunnel VPN typically pushes a default route such as 0.0.0.0/0 into your route table so all IPv4 traffic goes through the VPN. Split tunneling instead adds specific routes, for example

10.0.0.0/8 -> via 
203.0.113.0/24 -> via 

and leaves the system default route pointing to your usual gateway. On Linux you might see commands like ip route add 203.0.113.0/24 dev tun0. On Windows the client would update the routing table via the Windows networking APIs. The important point is: specific traffic is diverted into the tunnel; everything else follows the original default path.

Benefits and security trade-offs

Split tunneling has practical advantages but it also introduces trade-offs. Understanding both sides helps you pick the right configuration.

Benefits

• Lower latency for local services: traffic to printers, NAS devices, casting devices, or local game servers doesn’t detour through a distant VPN server.
• Reduced bandwidth and CPU usage: encrypting and routing everything adds load. By excluding high‑volume or local traffic you conserve bandwidth and battery/CPU resources.
• Selective geolocation: tunnel only the apps that need to appear in another country while keeping local services on your normal connection.
• Access to local network: exclude LAN traffic so you can still reach printers, file shares, and IoT devices while connected to a VPN.

Risks

• Exposed traffic: any traffic excluded from the tunnel is not protected by the VPN and can be observed by the local network or ISP.
• DNS leaks: name lookups may reveal destinations even for tunneled apps unless DNS is handled correctly.
• Weakened corporate controls: for managed networks, split tunneling can allow sensitive data to bypass corporate monitoring and data-loss prevention tools.
• Split-path attacks: an attacker on the local network could attempt to influence the non-tunneled path or spoof DNS responses for traffic that is not routed through the VPN.

Mitigations

You can reduce risk by combining controls:

• Enable DNS leak protection or configure split-DNS so queries for internal resources use the company DNS while others are blocked or routed securely.
• Prefer per-app split tunneling for user devices so only the intended process bypasses the VPN.
• Use a kill switch for sensitive apps so if the VPN drops those apps are blocked from sending traffic outside the tunnel.
• Avoid using split tunneling on untrusted public Wi‑Fi for apps that handle sensitive data.

When to use split tunneling — practical use cases

Split tunneling is a pragmatic tool. Use it when you need selective protection or better performance, and avoid it when you require complete coverage.

Practical scenarios where split tunneling helps:

• Streaming and banking: route your streaming app through a VPN to access region-restricted content, while keeping banking and payments on your local connection to reduce multi-factor authentication friction.
• Gaming and real-time apps: exclude the game client from the VPN to lower ping and jitter while still tunneling voice/chat or launcher traffic if needed.
• Work-from-home hybrid: connect to corporate resources over the VPN for domain-joined file servers or internal web apps, while still accessing local printers and smart home devices on your LAN.

When to avoid split tunneling:

• If you need full anonymity or privacy guarantees on a public or untrusted network.
• In compliance-bound environments where policy requires all traffic to be inspected or logged by corporate controls.
• When dealing with highly sensitive data that must not traverse untrusted networks.

How to set up and troubleshoot split tunneling

Basic setup steps

1. Decide the split method your client supports — per-app or per-destination.
2. Configure rules in the VPN client (for per-app choose which apps; for per-destination add the IP ranges or CIDRs to tunnel).
3. Enable DNS leak protection or configure split-DNS if the client offers it.
4. Test routing and DNS using tools such as traceroute/tracert, ping, and an external leak test like ipleak.net.

Platform notes

Many Android and Windows VPN apps provide per-app toggles that are easy to use. On macOS you may need an advanced client or manual route configuration. On routers you usually configure policy-based routing or static routes in the firmware (OpenWrt, pfSense, or vendor GUI). Router-level split tunneling affects every device on your network, which is useful but requires care.

Common issues and how to resolve them

• Excluded apps still use the VPN: check OS-level proxy settings, VPN client settings, or system-wide proxy that forces traffic through the tunnel. Verify which adapter the process is bound to.
• DNS queries leaking: enable the VPN’s DNS leak protection or set the device to use the VPN-supplied DNS. If your app supports it, use split-DNS so internal names resolve on the internal DNS server.
• Firewall or route conflicts: local firewall rules can override VPN behaviour. Inspect the OS routing table — ip route (Linux), route print (Windows), or netstat -nr (macOS) — to confirm which routes are active.
• IPv6 leaks: test both IPv4 and IPv6. If the provider doesn’t handle IPv6, either disable IPv6 on the device or ensure the VPN supports IPv6 routing to avoid bypasses.

Practical tip: always test both IPv4 and IPv6 paths, and if your provider supports it, use split-DNS and a kill switch. VPN4All’s apps include per-app split tunneling and DNS leak protection in settings to help manage these issues consistently across devices.

Choosing a VPN for split tunneling (what to look for)

If split tunneling is a feature you plan to use regularly, pick a VPN that treats it as a core capability rather than an afterthought.

Look for the following features:

• Per-app and per-destination rules: both are useful for different scenarios; per-app is easy for consumer devices, per-destination is better for routers and advanced routing.
• DNS leak protection and split-DNS: the provider should offer controls to prevent name-resolution leaks or to selectively forward internal name queries.
• Reliable kill switch: especially for inverse or per-app exclusions — if the VPN drops, the kill switch prevents sensitive apps from falling back to the unencrypted path.
• Cross-platform support and clear UI: split-tunneling controls should be visible and manageable on Windows, macOS, Android, iOS, and router platforms you use.

Privacy considerations

Read the provider’s logging policy and run your own leak checks. Free VPNs often lack robust split-tunnel controls or have weaker leak protection, which increases risk when you rely on split tunneling. Also verify vendor support for your OS or router firmware and check server locations for the routes you plan to tunnel.

Performance and support

Test latency and server selection for the destinations you’ll route through the VPN. If you rely on split tunneling for gaming or streaming, confirm that the provider offers low-latency servers for those geographies and provides responsive support for troubleshooting routing issues.

Split tunneling is a practical tool when you need selective protection, better performance, or access to both remote and local networks simultaneously. Use it deliberately, test your setup (including DNS and IPv6), and combine it with safeguards like DNS leak protection and a kill switch for the best balance of convenience and security.