My IT ButlerVisit Website →
← Back to blog

Split tunneling VPN: what it does and when to use it

August 26, 2026
Split tunneling VPN: what it does and when to use it

A split tunneling VPN routes some of your traffic through an encrypted tunnel while sending the rest straight to the internet on your normal connection. NIST's own glossary flags the trade-off plainly: you gain speed and convenience, but you lose visibility over the traffic that never enters the tunnel.

Here's the one-line verdict: use split tunneling for high-bandwidth tasks like video calls, streaming, or reaching a printer on your home network. Skip it on public Wi-Fi, hotel networks, or anything touching sensitive company data.

  • Use it for: video conferencing, local file/printer access, streaming, low-risk browsing
  • Avoid it for: banking, admin logins, work on airport or café Wi-Fi, anything under compliance rules
  • Available in several variants (app-based, URL/domain-based, route-based) — NordVPN documents these forms
  • If you manage a distributed team, a partner like Myitbutler can set the rules once and audit them properly

Key Takeaways

Split tunneling improves speed and local access by design, but every excluded app or domain is a gap that needs a matching mitigation, not just a convenient shortcut.

PointDetails
Match type to taskUse app-based for simple exclusions, route-based for enterprise networks, inverse/include for mixed-use devices.
DNS leaks are the top failureMismatched app and DNS routing causes leaks; test with a dedicated DNS leak checker after every update.
Ban it on regulated dataFull-tunnel VPN should be the only option for financial, health, or compliance-bound work.
Verify, don't assumeCheck IPs, DNS resolvers, and kill-switch behaviour before trusting any split tunneling setup.
Myitbutler handles the ongoing partMyitbutler designs, documents, and audits split tunneling policy for distributed teams under Australian standards.

Table of Contents

How does split tunneling VPN routing actually work?

Every packet your device sends gets a routing decision made in a fraction of a second: tunnel or no tunnel. The VPN client checks a rule set, usually built around apps, domains, or IP ranges, and shunts matching traffic into the encrypted tunnel. Everything else goes out your regular connection, visible to your ISP the same way it always was.

The mechanism usually works one of four ways:

  1. App-based — the VPN client watches which application generated the traffic and tunnels or excludes it accordingly.
  2. URL/domain-based — specific web addresses are tunnelled or bypassed, useful for keeping SaaS tools on the open connection.
  3. Route-based — traffic destined for particular IP ranges or subnets follows a fixed path, common in enterprise setups.
  4. Inverse/include — everything is tunnelled by default, with a short, deliberate exclusion list.

DNS is where this gets messy. An app might bypass the tunnel while its DNS queries still route through the VPN's resolver, or vice versa. That mismatch is a frequent cause of streaming services blocking access or corporate tools failing to load, because the site sees a location that doesn't match the traffic it's actually receiving, according to Fractional CISO's breakdown of the problem.

Split tunneling comes in several forms — NordVPN lists app-based, URL/domain, and route-based as the three common implementations, and most consumer VPN apps only expose one or two of them in their settings menu.

Hands connecting network cables in server rack

Which type of split tunneling suits your situation?

Not every variant suits every job. Matching the type to the task is where most people go wrong, either locking down too much or leaving too much exposed.

  • App-based — exclude Zoom, Netflix, or a game client from the tunnel while everything else stays protected. Simple, consumer-friendly, and the most common option in retail VPN apps.
  • URL/domain-based — route specific SaaS domains (Salesforce, Microsoft 365) outside the tunnel for speed, while everything else stays encrypted. Good for organisations chasing performance on cloud apps without opening the whole device.
  • Route/subnet-based — direct traffic to a defined IP range, like a corporate data centre or a site-to-site link, while general browsing stays local. This is standard in enterprise network design.
  • Inverse/include — tunnel everything by default and carve out a short exclusion list. Security, since it limits how much can go wrong from human error.

For a work laptop that occasionally does personal browsing, inverse/include is usually the better call. For a dedicated streaming device, app-based exclusion is enough.

How do you set up split tunneling on your device?

Configuration varies more by platform than most guides admit, and skipping the caveats is how leaks happen.

  1. Windows — most VPN clients offer an app-based split tunneling toggle in settings. Add the apps you want excluded, then run a DNS leak test straight after.
  2. Android — per-app controls exist in most VPN apps, but background processes (sync services, notifications) can slip outside the rule you set. Check battery optimisation settings too.
  3. macOS — Apple's sandboxing restricts how deeply a VPN client can intercept per-app traffic, so options are more limited than Windows. ProtonVPN's own documentation confirms this platform gap.
  4. Linux — split tunneling usually means manual route and subnet rules via the command line. You need to be comfortable with ip route and firewall tables, because most desktop VPN GUIs don't expose this cleanly.

For most organisations, the inverse/include model beats app-based exclusion lists. Fewer things to forget, fewer gaps.

Pro Tip: Write down every split tunneling rule you create, including why it exists. Six months later, nobody remembers why Slack was excluded from the tunnel, and an undocumented rule is a security review's worst nightmare.

What are the real benefits of using split tunneling?

The appeal isn't abstract. It solves specific, everyday friction points for anyone working across a VPN daily.

  • Lower latency on video calls, since call traffic skips the extra encryption hop
  • Less load on the VPN server, which matters when a whole team is connected at once
  • Direct access to local devices like printers, NAS drives, or smart home gear that a full tunnel would otherwise block
  • Faster response times for cloud-first SaaS tools when routed outside the tunnel deliberately

OpenVPN's own guidance on tunnel types frames this as the core trade, sacrificing some encryption coverage in exchange for a connection that actually feels responsive.

What security risks come with split tunneling and how do you mitigate them?

The convenience comes at a cost, and it's worth naming plainly. Traffic that bypasses the tunnel loses whatever protection the VPN was providing, and that gap is exactly what attackers look for.

The main threats:

  1. DNS leaks — mismatched routing exposes your real location or ISP to sites and services.
  2. Public network exposure — untunnelled traffic on café or airport Wi-Fi is visible to anyone else on that network.
  3. Bypassing corporate controls — an employee's excluded app might dodge the content filtering or logging IT relies on.
  4. Malware bridging — a compromised device can use the untunnelled path to reach command-and-control servers, sidestepping VPN-level monitoring.

Comparitech's security guide on split tunneling risks recommends a mitigation set worth adopting wholesale: force DNS through a trusted resolver, run endpoint detection on every device, keep an approved-app allowlist, and gate access on device compliance status rather than trusting the connection blindly.

Pro Tip: If a device fails a compliance check, its default should be full tunnel or no access at all, not split tunneling. Never let a non-compliant laptop keep its exclusion rules while it's out of policy.

Some scenarios call for banning split tunneling outright. Handling health records, financial data under compliance rules, or government contracts usually means full-tunnel VPN is the only acceptable configuration, no exceptions carved out for convenience.

Why do DNS leaks happen and how do you catch them?

DNS leaks happen because app routing and DNS routing are two separate decisions, and split tunneling rules often only account for one of them. An app might be excluded from the VPN, but its DNS queries still go to the VPN's resolver, or the reverse. Streaming platforms and geofenced tools notice the mismatch immediately and either block access or serve the wrong regional content.

Hands testing network DNS routing with device

Testing is quick: compare the IP address shown by a browser tool against the IP an excluded app reports, then run a dedicated DNS leak test. If the results disagree, your DNS routing needs realigning with your app rules. Retest after every VPN client update, since patches occasionally reset split tunneling configurations without warning.

When should you configure this yourself versus call in support?

DIY works fine for a single device with a handful of excluded apps. It stops working once you're managing more than a few laptops, mixed operating systems, or any compliance obligation.

Ask yourself:

  • How many devices and operating systems are involved?
  • Does your business handle regulated or client-sensitive data?
  • Can you currently see which devices are compliant and which aren't?

If any answer gives you pause, managed support earns its cost. A proper managed service should deliver documented split tunneling rules, ongoing monitoring, compliance enforcement tied to device posture, and scheduled audits, not a one-off setup and silence.

This is exactly where Myitbutler's remote support model fits. Distributed teams across time zones get policy design and monitoring coordinated over WhatsApp or email, backed by certifications including CCNA and CompTIA Security+, without a long-term contract locking you in.

What should you test before you trust the configuration?

Configuration without verification is just guesswork with extra steps. Run these checks before you consider the setup finished:

  1. Check the IP address reported by each excluded app against your real connection IP.
  2. Confirm which DNS resolver each app is actually using, not just which one you configured.
  3. Run a full DNS leak test and compare results against expectations for tunnelled versus excluded traffic.
  4. Simulate a VPN drop and confirm the kill switch behaves correctly, blocking traffic rather than falling back to plain internet.

PCMag's explainer on split tunneling recommends treating this as a recurring task, not a one-time box to tick. Document results each time and set a calendar reminder to retest after major client updates.

The honest gap between split tunneling and true security

Split tunneling gets sold as a set-and-forget performance boost, and that framing undersells the ongoing attention it actually needs. Every exclusion rule is a small, permanent decision that someone has to remember exists, justify later, and re-check every time software updates. The convenience is real. So is the maintenance burden nobody mentions in the marketing copy.

The sharper long-term view, backed by Field Effect's analysis of split tunneling risk, is that split tunneling is a stopgap on the way to proper zero trust architecture, where access is granted per application based on device posture rather than blanket tunnel-or-bypass rules. For most small teams that's a future project, not today's fix. Today's fix is getting the rules right, documenting them, and testing them properly rather than assuming they still work six months on.

— Thomas

How Myitbutler helps you get split tunneling right

Getting split tunneling configured correctly across a mixed device fleet, remote staff in different countries, and varying compliance needs isn't a weekend project, and getting it wrong quietly leaves gaps nobody notices until something goes wrong. Myitbutler builds the policy, sets device compliance gates, and runs the ongoing monitoring so your exclusion rules don't turn into forgotten liabilities.

Myitbutler

Our remote support model follows Australian standards regardless of where your team sits, backed by certifications including CCNA, CompTIA Security+, and PRINCE2. You get transparent fixed pricing, no long-term contracts, and coordination through WhatsApp, email, or direct message across whatever time zones your team spans. If you're weighing up a managed IT services approach against doing it yourself, the practical difference usually comes down to whether anyone is actually watching the rules after week one.

Book a free chat with Myitbutler to walk through your current VPN setup and find out whether split tunneling is helping you or quietly leaving a door open.

Sources

FAQ

Should I use split tunneling on my VPN?

Use it for low-risk, high-bandwidth tasks like video calls or local device access, and switch to full tunnel on public Wi-Fi or when handling sensitive data.

What are the disadvantages of split tunneling?

The main risks are DNS leaks, exposure on untrusted networks, bypassed corporate security controls, and malware using the untunnelled path to reach outside servers.

Which VPN is best for split tunneling?

The right choice depends on your platform: Windows and Android generally offer the broadest app-based controls, while macOS is more limited and Linux typically needs route-based configuration.

How do I tell if my VPN is using split tunneling?

Compare the IP address and DNS resolver reported by an excluded app against your main connection, then run a DNS leak test to confirm the routing matches your rules.

Should I hire managed IT support for split tunneling setup?

If you're managing multiple devices, mixed operating systems, or compliance requirements, a managed provider like Myitbutler can document rules and audit them properly rather than leaving configuration to guesswork.