What Is VPN Split Tunneling?

VPN split tunneling sends selected traffic through a VPN while other traffic uses a different route, usually your normal internet connection. The split follows rules, such as a destination network or a particular app. It does not automatically divide your connection into equal halves.

The practical question is which connections need the tunnel and which are allowed outside it. On a workplace device, that decision belongs to the organization’s network and security team. On your own device, it still deserves more thought than simply turning on a feature labeled “faster.”

How does split tunneling change the route?

Imagine an approved work setup in which an internal file server is reached through the company VPN, while an allowed public website is reached directly. Both connections can exist at the same time. Your laptop still uses its underlying internet service to carry the VPN connection; split tunneling changes where particular traffic goes next.

Microsoft’s Windows VPN routing documentation distinguishes split tunneling from force tunneling. With split routing, specified routes use the VPN and other traffic uses the physical network interface. Force tunneling directs traffic through the VPN by default, although more specific routes can affect the actual result.

That is why a “VPN connected” indicator is not a promise that every app takes the same path. For the broader explanation of tunnels and their limits, see what a VPN does. Here, the important detail is the selection rule.

What do include and exclude modes mean?

An include list specifies the traffic that should enter the tunnel. Traffic outside that list follows the other route. An exclude list starts with traffic using the tunnel and names exceptions that should go outside it. The same destination entered into the wrong type of list can produce the opposite result from the one intended.

Cloudflare’s configuration guide illustrates both approaches using IP ranges and domains. It also warns that traffic outside its Gateway path will no longer receive the network or HTTP filtering policies applied there. Other products have their own controls, so read the documentation for the actual client rather than copying another service’s settings.

Before considering any change, write down the intended outcome in one sentence: “This approved resource should use this approved connection.” If you cannot explain what should happen to everything else, the proposed rule needs clarification.

Can split tunneling make a connection faster?

It can help when the existing route adds an unnecessary detour or a shared VPN gateway is congested. Sending suitable traffic directly can reduce load on that gateway. However, changing the route cannot guarantee an improvement for every app, network or location.

Microsoft’s Microsoft 365 guidance describes carefully scoped exceptions for high-volume, performance-sensitive cloud services. Its recommendation targets documented service endpoints rather than removing the VPN from all internet activity. Other traffic can remain on the organization’s established path.

Treat that as an example of an administrator-designed arrangement, not a reason to exclude your meeting app yourself. A useful support report says which task is slow, when it happens and whether colleagues see the same problem. “The call breaks up every afternoon” is more actionable than “the VPN is bad.”

Why do some employers prohibit it?

An organization may depend on its VPN route for inspection, filtering and access controls. Moving traffic away from that route can remove protections the security team expects to be present. A compromised device communicating with multiple networks can also create risks beyond the individual user’s browsing session.

The NIST Guide to IPsec VPNs, Revision 1, discusses these risks in its client-design guidance and strongly discourages split tunneling in that context. It also notes possible bandwidth and organizational reasons for using it. This is a security architecture decision with tradeoffs, not a universal preference switch.

Do not change managed routes, disable a firewall, install another VPN or alter security permissions to get around a workplace restriction. If a printer or service stops working, ask IT whether local access or a specific exception is permitted. A blocked setting may be intentional policy.

Do app rules and kill switches work the same everywhere?

No. A provider may support app selection on one operating system and different options on another. App-level rules can also interact with shared networking components. A feature appearing in one device’s menu does not establish that it works identically on your phone or another computer.

For example, Proton VPN’s split-tunneling documentation describes platform-specific behavior, including limitations involving WebKit-based apps on macOS. It also documents differences in whether split tunneling can be used alongside its kill switch. These details can change as software evolves.

Check the current support page for your exact operating system and app version. Confirm what happens if the tunnel drops, whether changes require reconnection or an app restart, and whether your intended rule is supported. Do not assume an excluded app receives the VPN’s protection simply because a kill switch is enabled elsewhere.

Does traffic outside the tunnel lose all privacy?

Traffic outside the tunnel does not receive that tunnel’s protection, but it may still have application-level encryption such as HTTPS. Conversely, traffic inside the tunnel is not automatically anonymous. Accounts, cookies and other identifiers can still connect activity to a person.

EFF’s VPN guidance explains that a VPN changes the network you trust and does not eliminate online tracking. Keep the questions separate: which route carries the connection, what encrypts its content, and who can identify the user? Split tunneling answers only part of that picture.

What should you check before using it?

Start with permission, then purpose. Identify the device owner, the approved VPN client and the exact resource involved. Read the provider’s current explanation of inclusion, exclusion and disconnect behavior. For work systems, give that information to IT and follow its approved process. For personal use, keep the intended exceptions narrow and understandable.

You do not need new hardware simply to understand split tunneling. If you want a broader networking reference, you can browse beginner networking books on Amazon. This is a browsing link, not a tested-product recommendation or a requirement for configuring a VPN.