Split tunneling is a VPN feature that sends some of your traffic through the encrypted tunnel while letting the rest use your normal internet connection. Instead of routing everything through the VPN, you pick which apps, sites, or networks go where. Your work browser can stay encrypted while your smart TV streams straight from your home network.
For remote workers and power users, that control solves real problems. You keep access to your local printer, log into your bank without tripping fraud checks, and avoid the speed hit on traffic that doesn't need protection. The catch? Anything you route outside the tunnel loses VPN protection and exposes your real IP. This guide explains the types, the use cases, and how to decide what to send where.
Key Takeaways
- Split tunneling routes selected traffic through the VPN and sends everything else over your regular connection.
- The three main types are app-based, domain or URL-based, and inverse (everything tunnels except what you exclude).
- It preserves local network access, reduces VPN overhead on excluded apps, and helps with geo-sensitive services like banking.
- The trade-off is real: any traffic outside the tunnel is unencrypted by the VPN and reveals your true IP address.
What Is VPN Split Tunneling?
Split tunneling is a client-side VPN setting that divides your traffic into two paths: one encrypted and routed through the VPN, the other sent directly over your default connection. You define the rules. The VPN client enforces them per app, per destination, or by inverting the logic so everything tunnels by default.
Compare that to a full-tunnel setup, where every packet leaves your device through the VPN. Full tunneling is simpler and safer because nothing slips out unprotected. But it forces all your traffic through one path, which can slow downloads and break connections to devices on your own network. Split tunneling trades a little of that blanket protection for flexibility.
Here's the part people miss. Split tunneling lives in the VPN client or your device configuration, not on the server. Because the logic runs locally, the same dedicated server can serve a full tunnel for one device and a split tunnel for another at the same time. The server just forwards what it receives; your client decides what to send.
How does it actually route traffic?
Your operating system uses a routing table to decide where each packet goes. A full-tunnel VPN rewrites that table so the tunnel becomes the default route. Split tunneling adds more specific rules: send traffic for App A or Domain B into the tunnel, and let the rest fall through to your physical network adapter. The decision happens before packets leave your machine.
What Are the Main Types of Split Tunneling?
There are three common approaches: app-based, domain or URL-based, and inverse (also called reverse) split tunneling. App-based routes by program, domain-based routes by destination address, and inverse flips the default so all traffic tunnels except items you specifically exclude. Each fits a different need.
The right type depends on how granular you need to be and which direction your default should point. App-based is the easiest to reason about on a laptop. Domain-based shines when one browser visits both protected and local sites. Inverse is the safest of the three because protection is the default state, not the exception.
| Type | How it works | Best use case |
|---|---|---|
| App-based | You choose which applications route through the VPN; the rest go direct. | Encrypt your work browser and email client while a backup app uploads at full local speed. |
| Domain / URL-based | Routing is decided by the destination address; specific sites tunnel, others bypass. | Send streaming or geo-restricted sites through the VPN while local banking stays on your home IP. |
| Inverse / reverse | Everything tunnels by default; you list only the apps or addresses to exclude. | Keep full protection but exempt one trusted local tool, like a network printer or NAS. |
If security is your priority, inverse split tunneling is usually the smarter default. A mistake means one excluded app leaks, not that your entire session runs in the clear. With app- or domain-based setups, anything you forget to add stays unprotected by design.
Why Would You Use Split Tunneling?
People use split tunneling to keep local network access, avoid VPN slowdown on traffic that doesn't need it, and reach geo-sensitive services that block VPN IPs. In our experience supporting remote workers, the most common driver is wanting encrypted work traffic without losing the printer, the NAS, or a smooth video call.
Keeping access to your local network
A full tunnel often cuts you off from devices on your own LAN. Your printer, network storage, smart speakers, and local media server all sit on private addresses that a fully routed VPN won't reach. Split tunneling lets you exclude that local range so you stay connected at home while everything else runs through the encrypted path.
Saving bandwidth and reducing overhead
Encryption adds processing and a few extra bytes to every packet, so routing heavy traffic you don't need to protect through the VPN wastes capacity. Backups, software updates, and large media transfers rarely need a tunnel. Sending them direct keeps your protected traffic snappy. For more on this, see our VPN speed optimization guide.
Using local services while staying protected
Some banks and government sites flag logins coming from a foreign or datacenter IP and trigger extra verification or block you outright. We've found the cleanest fix is domain-based split tunneling: route your bank's domain over your real home IP and keep everything else inside the tunnel. No more failed logins, no constant toggling of the VPN on and off.
What Are the Security Trade-Offs?
The core trade-off is simple: any traffic you route outside the tunnel gets none of the VPN's protection. It travels unencrypted by the VPN over your normal connection, and it carries your real IP address. For that traffic, your ISP, network owner, and the destination site all see who and where you are.
That exposure matters most on untrusted networks. On public Wi-Fi, traffic outside the tunnel can be intercepted by anyone on the same network unless the app itself uses HTTPS. Misconfiguration is the bigger risk, though. A rule that's too broad, or an excluded app that quietly opens new connections, can leak more than you intended.
Is the convenience worth that risk? On a trusted home network, often yes. On hostile or shared networks, lean toward a full tunnel or an inverse split that exposes as little as possible. If you handle sensitive work data, pair careful rules with the practices in our VPN for remote work guide.
DNS leaks deserve attention
Split tunneling can complicate DNS handling. If your excluded apps use a different DNS resolver than your tunneled apps, you may reveal which sites you visit even when the traffic itself is split correctly. Check that your VPN client routes DNS for tunneled traffic through the VPN, and confirm with a DNS leak test after you set up your rules.
When You Should (and Should Not) Use Split Tunneling
Split tunneling fits when you need local access or want to spare bandwidth on low-risk traffic, and it fits poorly when every byte must stay private. The deciding question is whether the traffic you plan to exclude can safely travel without VPN protection. If the answer is no, don't split it.
Good times to use split tunneling:
- You need to reach a local printer, NAS, or smart device while connected to the VPN.
- You're on a trusted home network and want to skip the VPN for backups or large downloads.
- A bank or local service blocks VPN IPs, and you want to route only that site directly.
- You want lower latency on video calls while keeping work apps encrypted.
Times to avoid it:
- You're on public or untrusted Wi-Fi where any exposed traffic could be intercepted.
- You handle regulated or confidential data that must never leave the tunnel.
- You can't confidently predict which connections an excluded app will open.
- You want the simplest, safest setup and don't need local access.
How Do You Set Up Split Tunneling?
Split tunneling is configured on the client, not the server, so the steps depend on your platform and VPN app. Most desktop clients expose it under settings as app-based rules, while mobile apps vary, and some platforms don't support it at all. The encryption itself, such as OpenVPN with AES-256-GCM, stays the same.
The general process is consistent. Open your client's split tunneling settings, choose the mode (include selected apps, exclude selected apps, or route by address), add your rules, and save. Then test: confirm the protected app shows the VPN IP and the excluded app shows your real IP, and run a quick DNS leak check.
Start narrow. Tunnel everything first, then exclude one app at a time and verify after each change. It's far easier to spot a leak when you've only just added a single rule than when you've configured a dozen at once and something quietly slips through.
Split tunneling is a routing choice, not an encryption upgrade. The traffic you keep inside the tunnel is exactly as protected as before; the traffic you push outside it has none of that protection at all.
Frequently Asked Questions
Does split tunneling slow down my VPN?
Split tunneling usually does the opposite for excluded traffic. Apps you route outside the tunnel skip the VPN's encryption overhead and the extra network hop, so they often run faster. Your tunneled apps perform the same as before. The trade-off is reduced protection on whatever you exclude, not reduced speed.
Is split tunneling safe to use?
It's as safe as your rules allow. Traffic inside the tunnel stays fully protected, but anything you exclude travels with your real IP and no VPN encryption. On a trusted home network that's usually fine. On public Wi-Fi or with sensitive data, a full tunnel or inverse split is the safer call.
What's the difference between split tunneling and a kill switch?
They solve different problems. A kill switch blocks all internet access if the VPN connection drops, preventing accidental exposure. Split tunneling deliberately sends chosen traffic outside the tunnel during normal operation. You can use both together: split your rules for convenience while a kill switch guards the traffic that stays protected.
Can I use split tunneling on any device?
Not universally. Support depends on your VPN client and operating system. Many Windows, macOS, and Android clients offer app-based rules, while iOS and router-level setups are more limited. Because the feature is client-side, check your specific app's settings rather than assuming the server supports or blocks it.
Does split tunneling expose my real IP address?
Yes, for the traffic you route outside the tunnel. Those connections use your normal internet path, so the destination site and your ISP see your real IP. Only the traffic kept inside the tunnel shows the VPN's IP. That's the whole point of the feature, and the reason to choose exclusions carefully.
The Bottom Line on Split Tunneling
Split tunneling gives you precise control over which traffic gets VPN protection and which takes the direct route. Used well, it keeps your local devices reachable, spares bandwidth on low-risk transfers, and sidesteps the geo-blocks that frustrate banking and local services. Used carelessly, it quietly exposes traffic you meant to protect.
The smart approach is to default to protection and exclude only what you're sure can travel safely. Inverse split tunneling and narrow, tested rules give you the convenience without the surprises. When you're ready for a private path you fully control, with a dedicated IP, full bandwidth, and zero logs from $8/month, deploy a dedicated VPN server with DediPN and configure your tunnel exactly how you want it.