Split Tunneling

How split tunneling changes VPN traffic paths

Split tunneling divides traffic into two routes, one protected by the private tunnel and one sent directly to the internet. That design can improve user experience, but it also changes which traffic is visible to central controls and which traffic depends on the endpoint’s own security posture.

In practice, split tunneling is not a simple performance tweak. It is a routing decision that affects whether traffic is inspected, filtered, or correlated with remote access policy, and it can create inconsistent trust boundaries across the same device session.

Why split tunneling is used

Organisations use split tunneling to reduce latency, avoid saturating the VPN concentrator, and keep high-volume non-business traffic off the corporate path. That can be useful for video, updates, cloud services, and other workloads that do not need to traverse the private network.

The benefit is operational efficiency, but the trade-off is selective control. Once some traffic bypasses the tunnel, the remote device is no longer fully mediated by the same inspection, logging, or egress policy that applies to tunneled traffic.

Security implications of split tunneling

The main security concern is that the endpoint becomes a bridge between two trust zones at once. If the device is compromised or connected to an untrusted network, traffic that bypasses the VPN can provide a path around monitoring, content filtering, or DNS and web controls.

This is why split tunneling often raises questions about policy enforcement, leak prevention, and lateral exposure. It may be acceptable for low-risk environments, but it is harder to justify where remote devices handle sensitive data, privileged access, or regulated workloads.

When split tunneling is a poor fit

Split tunneling is usually a weak choice when the organisation depends on central inspection, uniform logging, or strict control of where traffic can go. It is also a poor fit when the endpoint may be used on hostile networks, because local network exposure and direct internet access increase the chance of unsafe traffic paths.

Where the security model depends on all remote traffic passing through the enterprise control plane, a full-tunnel approach or a more granular zero-trust access pattern is usually a better fit. The key question is not whether split tunneling is faster, but whether the organisation can safely tolerate traffic that is intentionally outside the protected path.

Risk and Threat Considerations

Split tunneling increases the chance that unmanaged network traffic, malicious redirects, or endpoint compromise can bypass enterprise inspection. It can also create inconsistent visibility, which makes it harder to spot suspicious behavior or enforce the same controls across all sessions.

Failure mechanism: An attacker or unsafe local network abuses the direct-to-internet path while the VPN session remains active, so some traffic never reaches the security stack that would normally inspect or block it.

Impact: Exposed endpoints, policy bypass, reduced monitoring, and a higher chance of data leakage or compromise through the non-tunneled path.

Practitioner Guidance

Governance implication: Decide at the policy level which traffic classes may bypass the tunnel, and tie that decision to device trust, user role, and data sensitivity rather than convenience alone. Split tunneling should be an explicit exception model, not a default assumption.

What to watch for: Review whether DNS, security tooling, and logging still see the traffic that matters most. If the answer is no, the design is probably weakening the controls you rely on for remote access assurance.

When split tunneling is permitted, document the security boundary it creates and treat that boundary as part of the access design, not merely the network design.

Related resources from NHI Mgmt Group

• Guide: VPN Security Guide
• How do security teams know whether split tunneling is still undermining CUI protection?
• When should organisations prioritise forced tunneling over split tunneling for remote users?
• What are common mistakes with VPN Split Tunneling?
• What is an example of VPN Split Tunneling in practice?