VPN Split Tunneling.

A VPN configuration that routes only selected traffic (e.g. corporate subnets) through the encrypted tunnel while letting the rest reach the internet directly. It belongs to the Network Security category of cybersecurity.

A VPN configuration that routes only selected traffic (e.g. corporate subnets) through the encrypted tunnel while letting the rest reach the internet directly.

Split tunneling is configured on VPN clients (OpenVPN, WireGuard, IKEv2, Cisco AnyConnect, Windows Always On VPN, ZTNA agents) so that only specific destinations - typically internal IP ranges, DNS suffixes, or applications - traverse the encrypted tunnel. All other traffic uses the local internet uplink. The benefit is reduced VPN concentrator load, lower latency for SaaS, and avoidance of double-NAT for cloud services. The drawbacks are real: the endpoint is simultaneously on a trusted network and the public internet, which weakens the security boundary, complicates DLP and inspection, and can leak DNS via the local resolver. Modern designs counter this with full-tunnel for managed devices, ZTNA per-application policies, secure DNS to a corporate resolver, and EDR on every endpoint.

Defences for VPN Split Tunneling typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Split tunnel, Selective VPN routing.