What Is VPN Split Tunneling? A Complete Guide

You’ve probably heard that a VPN encrypts everything you do online, but split tunneling lets you choose which traffic goes through the VPN and which goes directly to the internet. This guide explains how split tunneling works, its pros and cons, and when to use it.

Core function: Route selected traffic through VPN and rest directly to the internet ·
Supported by: NordVPN, Surfshark, ProtonVPN, and many others ·
Primary risk: Potential IP leaks and exposure of sensitive traffic if misconfigured ·
Typical use case: Accessing local printers or servers while using a VPN

A snapshot of the key facts about split tunneling.

What is VPN Split Tunneling?

Definition of split tunneling

• VPN split tunneling is a configuration that lets some of your device’s traffic flow through the encrypted VPN tunnel while other traffic goes directly to the internet (Microsoft Learn).
• AWS describes it as a setup where only traffic matching routes in the Client VPN endpoint route table is sent through the VPN tunnel (AWS Documentation).
• Fieldeffect calls it routing traffic through multiple paths simultaneously — typically one encrypted VPN path and one direct internet path (Fieldeffect).

How split tunneling differs from full tunneling

With full tunnel VPN, all traffic — every request, every app — goes through the VPN tunnel. Split tunneling breaks that model. The difference is control: you decide which traffic gets encrypted and which stays local.

TechRadar frames split tunneling as a way to balance enhanced security for sensitive activities with speed and unrestricted access for less sensitive activities (TechRadar).

This trade-off defines when split tunneling is useful and when it is not.

How does split tunneling VPN work?

Technical mechanism of routing traffic

• The VPN client selects which apps or destinations use the encrypted tunnel based on rules you set (TechRadar).
• Traffic is split based on configuration rules — either by application (app-based) or by destination IP/domain (IP-based) (Auvik).
• Microsoft documents that split tunnel configurations can specify routes to go over the VPN while all other traffic goes over the physical interface (Microsoft Learn).

Example: accessing a local printer while using a VPN

Imagine you’re connected to your corporate VPN from home. You need to print a document on your local network printer. Without split tunneling, the print request would travel through the VPN tunnel to the corporate network, then back to your home network — a round trip that often fails or lags. With split tunneling, you can exclude the printer app from the VPN, so the print job stays on your local network. AWS recommends split tunneling when you do not want all user traffic to route through the Client VPN endpoint, and it can also reduce data transfer costs.

The key is that split tunneling gives you targeted control over routing.

What are the disadvantages of split tunneling?

Security risks of split tunneling

• Can expose the user to malware from direct connections — traffic that bypasses the VPN is not encrypted by the VPN (McAfee).
• May bypass VPN encryption for sensitive apps if misconfigured (VPNPicked).
• Fieldeffect warns that careless split tunneling can create larger problems than the slow VPN complaints it was meant to solve (Fieldeffect).

Potential IP leaks

When you let some traffic go directly to the internet, your real IP address is visible to those sites and services. That can be a problem if you’re using the VPN for privacy. Additionally, misconfigured split tunneling can cause DNS leaks — where DNS queries go out over the direct connection, exposing your browsing activity (What Is My Location).

The warning is clear: misconfiguration can undo the benefits.

Should I use split tunneling on my VPN?

When split tunneling is beneficial

• Accessing local resources like printers or file servers while connected to a corporate VPN (AWS Documentation).
• Streaming services that block VPN IPs — you can route your streaming app directly (VPNPicked).
• Gaming, where low latency matters and VPN encryption can add lag (VPNPicked).
• Reducing VPN server load and data transfer costs for organizations (AWS Documentation).

When to avoid split tunneling

• Using public Wi-Fi — all traffic should be encrypted (VPNPicked).
• Online banking or handling sensitive personal data — you want everything inside the tunnel.
• When you’re not sure which apps might leak data — McAfee advises inverse split tunneling (only a few specified apps bypass the VPN) whenever possible (McAfee).

The pattern: split tunneling is a convenience feature, not a security upgrade. Use it when you clearly understand which traffic needs protection and which doesn’t.

How do I know if my VPN is split tunneling?

Check VPN client settings

• Look for options labeled “split tunneling,” “per-app VPN,” or “exclude apps” in your VPN’s settings menu — usually under Advanced or Connection options (Security.org).
• NordVPN calls it “Split Tunneling” and lets you add apps to a list of excluded or included apps.
• Surfshark provides a similar feature in its “VPN” settings.
• ProtonVPN offers split tunneling on Windows and macOS.

Tests to verify split tunneling is active

Use an IP leak test: check your IP address with and without the VPN active. Then, configure split tunneling so that one app is excluded, and check that app’s IP address — it should be your real IP, not the VPN IP. For DNS leaks, use a DNS leak test (What Is My Location).

Testing is the only way to be sure your configuration works as intended.

Split tunneling vs. full tunneling: a comparison

The choice between split and full tunnel comes down to a single question: what are you willing to leave unprotected? Here’s how the two approaches compare.

The implication: if you choose split tunneling, you accept responsibility for the traffic that goes outside the tunnel. For most users, full tunneling is the safer default.

How to set up split tunneling on Windows 11 (step-by-step)

Microsoft provides native VPN routing that can be used for split tunneling in enterprise environments. For consumer VPNs, the process is usually simpler.

1. Open your VPN client (e.g., NordVPN, Surfshark, ProtonVPN).
2. Go to Settings or Advanced settings.
3. Find the “Split Tunneling” option (may be called “App Exclusions” or “Per-App VPN”).
4. Toggle it on.
5. Choose which apps to include or exclude from the VPN tunnel.
6. Apply the changes and test with an IP check.

For Windows 11 native VPN (e.g., for corporate connections), Microsoft’s documentation explains how to configure route policies to achieve split tunneling (Microsoft Learn).

Setting up split tunneling is straightforward, but always test your configuration.

Confirmed facts and what’s still unclear

Confirmed facts

• Split tunneling is a standard VPN feature available in most major VPN providers (Security.org).
• Available in NordVPN, Surfshark, ProtonVPN, and many others.
• It can improve performance for non-sensitive traffic and reduce bandwidth costs (AWS Documentation).

What’s unclear

• How many VPN users actually enable split tunneling — adoption rates are not publicly reported.
• The full security implications of DNS leaks with split tunneling configurations are still debated in community forums.
• The effectiveness of split tunneling for bypassing geo-restrictions varies by streaming service and is not guaranteed.

These uncertainties highlight the need for careful testing.

Expert perspectives

VPN split tunneling lets you route some of your application or device traffic through an encrypted VPN, while other applications or devices have direct access to the internet.

Fortinet (cybersecurity glossary)

In computer networking, split tunneling allows a user to access distinct security domains at the same time, using the same or different network connections.

Wikipedia

For anyone considering split tunneling, the decision is clear: evaluate your threat model and your performance needs. If you’re on a trusted home network, split tunneling can improve speed and convenience. But if you’re on public Wi-Fi or handling sensitive data, keep the tunnel full. The practical trade-off: you gain flexibility, but you must manage the rules carefully — or the risk of exposure becomes real.

Related reading: What Is a Virus? Simple Definition, Examples & Symptoms · How to Read a Credit Report: Step-by-Step Guide

For a deeper understanding, a comprehensive split tunneling VPN guide outlines the best methods for maximizing privacy with split tunneling.

Frequently asked questions