What is split tunneling?
Split tunneling is a remote access VPN configuration in which the client decides, by destination, whether traffic enters the encrypted tunnel. Traffic for the organization's internal networks goes through the VPN to the corporate gateway. Everything else, such as web browsing, streaming and many SaaS applications, leaves directly through the user's home, hotel or mobile connection. The alternative, full tunneling, sends all traffic through the VPN, including traffic bound for the public internet.
How it works
When the tunnel comes up, the VPN client adds routes to the device. In a full tunnel the default route, 0.0.0.0/0, points into the tunnel. In a split tunnel only the corporate ranges do, for example 10.0.0.0/8 plus the data center's public block, and the default route stays on the local network. DNS is often split the same way: queries for internal domains go to corporate resolvers through the tunnel, and everything else uses the local resolver. Inverse split tunneling flips the default: all traffic is tunneled apart from a few named, trusted destinations that carry heavy traffic, such as the company's meeting service.
Why organizations use it
- Performance: video calls and SaaS traffic take the direct path instead of hairpinning through headquarters and back out.
- Capacity: the VPN concentrator and the corporate internet link carry only internal traffic.
- Local resources: users can reach a home printer or other local devices while connected.
Demand rose sharply in 2020, when many organizations moved most staff to remote work and found that their concentrators could not carry everyone's internet traffic.
Security trade-offs
- Lost inspection: internet traffic bypasses the corporate web proxy, DLP, intrusion detection and logging. Malware on the laptop can reach its command-and-control server without crossing a single corporate sensor.
- Two networks at once: the device sits on the untrusted local network and the corporate network at the same time, so an attacker who compromises it over coffee-shop Wi-Fi has a path toward the tunnel.
- DNS leaks: a poorly configured split DNS setup can send internal hostnames to public resolvers.
- Policy gaps: files uploaded to a personal cloud service never touch the controls meant to stop them.
Example: choosing a design
A company with 2,000 remote staff sees call quality collapse because every video meeting runs through one concentrator. It moves to split tunneling, keeping only the internal application ranges in the tunnel. To avoid losing web inspection, it installs a cloud secure web gateway agent on every laptop, so internet traffic is filtered and logged at the provider's nearest point of presence, and it keeps EDR and the host firewall enforcing on each device. The VPN now carries a fraction of the load, and web traffic is still inspected, just not at headquarters.
Split tunneling vs. full tunneling
| Full tunnel | Split tunnel | |
|---|---|---|
| Internet traffic | Through the corporate network | Direct from the local connection |
| Inspection and logging | Corporate controls see everything | Internal traffic only, unless a cloud gateway or endpoint control covers the rest |
| Performance and bandwidth | More latency, heavy concentrator load | Faster, lighter load |
| Exposure of the device | Local network access often blocked | Connected to both networks |
Split tunneling on the CompTIA Security+ exam
Full and split tunneling are part of VPN and remote access design under SY0-801 objective 3.2. If a scenario says remote users' web traffic must be filtered, logged or covered by DLP, choose a full tunnel. If it stresses bandwidth, concentrator load or video call quality, choose split tunneling, often paired with a cloud-delivered secure web gateway or another security service edge component so internet traffic is still inspected. Always-on VPN is the related answer when the problem is users disconnecting the VPN rather than which traffic it carries, and choosing IPsec or a TLS VPN is a separate decision about protocols.