Definition and simple model
Split tunneling is a setup where a device sends only part of its network traffic through a VPN, while the remaining traffic goes out directly through the regular internet connection.
A simple model is: the VPN client “looks at” each connection attempt and decides whether it matches a policy (for example, based on destination domains/IP ranges, or the application being used). If it matches, the traffic is routed into the VPN tunnel; if not, it takes the normal path.
How the VPN decides what to route
In practice, split tunneling is implemented using rules inside the VPN client and/or local networking components.
Common rule types include:
- Destination-based rules: specific IP ranges, subnets, or hostnames are sent through the VPN.
- Interface/route-based behavior: certain network routes are directed to the VPN tunnel, while others remain bound to the local network gateway.
- Application-based rules: selected apps are allowed to use the VPN, while other apps remain outside.
Because these rules vary by VPN client and operating system, the exact mechanism (and what you can configure) may differ. What stays consistent is the decision point: traffic is either matched to the VPN-handled set or it is not.
What “goes through the VPN” vs “bypasses the VPN” means
When traffic is sent through the VPN tunnel, the remote server you connect to will typically see the VPN’s exit IP address rather than your local IP.
When traffic bypasses the VPN, that connection generally uses your normal internet path, so it may expose your local IP characteristics to the destination. This is why split tunneling changes privacy and exposure in a way that depends on what you include in the “VPN-handled” set.
Differences, limits, and key exceptions
Split tunneling is not a single universal feature with identical behavior everywhere. Important limitations and differences include:
- Rule coverage matters: If the destination you care about isn’t matched by the split rules, it will bypass the VPN.
- DNS handling can affect results: Even if traffic routing is configured, name resolution and caching can influence which destination is actually contacted and how it is classified.
- Protocol and traffic types: Some VPN setups handle only certain traffic categories as tunneled; other traffic may follow a different path due to how routing rules are applied.
- Security trade-off: Keeping more traffic outside the VPN can reduce what is protected by the tunnel, even if it improves performance for the outside traffic.
If you are evaluating split tunneling for a specific goal (for example, accessing an internal network while keeping streaming outside), the deciding factor is whether the required destinations and apps are correctly included in the split rules.
Practical checks you can do
To verify how split tunneling is behaving on your device:
- Check which destinations are matched: confirm that the domain/IP/app you intend to tunnel is actually included by your configured split rules.
- Compare observable endpoints: for one tunneled and one bypassed scenario, compare external-facing indicators (for example, the apparent public IP seen by each destination).
- Test while rules are active: change one variable at a time (destination or app) to confirm the routing decision changes accordingly.
- Watch for DNS-related surprises: if behavior seems inconsistent, try clearing DNS cache (or using a fresh lookup) and re-test—especially when switching between tunneled and bypassed destinations.
Because implementations differ, if the behavior you see does not match your expectations, it usually points to a mismatch in rule criteria (what gets selected) or in name resolution and caching—not to split tunneling being inherently unpredictable.