VPN Split Tunneling

How VPN Split Tunneling Works

VPN split tunneling divides traffic into two paths, one protected by the encrypted tunnel and another sent directly to the internet. That makes it a routing and policy design choice, not just a performance setting. The security outcome depends on which destinations and applications are allowed outside the tunnel and how tightly those exceptions are controlled.

Why It Changes the Trust Boundary

Split tunneling changes where the organisation’s trust boundary begins and ends. Traffic that bypasses the VPN may avoid inspection, filtering, logging, or private network protections, while still originating from a managed endpoint. That can create inconsistent controls across the same device, which is why the setting matters even when the endpoint itself is well managed.

When the split is narrow and deliberate, it can reduce congestion and preserve user experience for low-risk traffic. When it is broad or poorly documented, it can silently move sensitive flows onto the public internet and undermine the assumptions behind remote access policy.

Common Traffic Paths and Policy Choices

Organisations usually decide split tunneling at the level of applications, subnets, or destination categories. Common examples include sending SaaS traffic direct while routing internal systems, admin portals, and sensitive business applications through the VPN. DNS handling, route exclusions, and local LAN access are especially important because they can override the intended policy if they are not aligned with the tunnel design.

Good design is less about whether split tunneling exists and more about which traffic classes are exempted. The safest approach is to make exceptions explicit, minimal, and reviewable, rather than allowing broad bypass rules that are hard to audit later.

Security Consequences of Bypassing the Tunnel

Split tunneling can expose data in transit, leak internal DNS or routing information, and create alternative paths that attackers can abuse after endpoint compromise. It also complicates monitoring, because some user activity is visible to the VPN stack while other activity is not. This is why split tunneling should be treated as a trust-boundary exception that needs deliberate control, not as a convenience feature that can be left broad by default.

If the organisation relies on the VPN for access control, inspection, or correlation, bypassed traffic weakens those assumptions. The more sensitive the application or the more hostile the network, the more carefully those exceptions need to be justified.

Risk and Threat Considerations

Split tunneling increases exposure when sensitive traffic, internal service discovery, or authentication-related flows escape the tunnel. It also creates a clearer opportunity for local network abuse, route manipulation, and traffic interception if the endpoint is on an untrusted network.

Failure mechanism: An exception route or application rule allows protected traffic to leave the VPN, where it can avoid corporate inspection and be exposed to a hostile network or a compromised local environment.

Impact: Attackers may gain visibility into traffic patterns, intercept data, tamper with connections, or exploit the bypass path to reduce the effectiveness of remote access controls.

Practitioner Guidance

Why practitioners should care: Split tunneling is a policy decision that changes both exposure and observability, so it should be owned as part of remote access architecture rather than left as a default client preference. Remote Access Identity Guide is a useful companion when the question is how remote access policy, MFA, and replacement options fit together.

What to watch for: Broad destination exclusions, undocumented app bypasses, and inconsistent DNS or route handling are common signs that split tunneling is wider than intended. The safest review lens is whether each exception is necessary, narrow, and consistent with the access model already in use.

Practitioner note: If the organisation cannot confidently explain why a flow may leave the tunnel, that flow should usually be treated as a candidate for forced tunneling or redesign.

Related resources from NHI Mgmt Group

• What are common mistakes with VPN Split Tunneling?
• What is an example of VPN Split Tunneling in practice?
• Why does VPN Split Tunneling matter for security teams?
• How do security teams know whether split tunneling is still undermining CUI protection?