What is split tunneling?

9 November 2026

With split tunneling, part of your device's traffic goes through a VPN while the rest leaves directly over your normal connection. The decision is made by destination address, by app, or by domain name.

It saves tunnel data and keeps local services working. The price is that whatever leaves outside the tunnel can reveal things you meant to hide.

How the system picks a path for each packet

Every operating system keeps a routing table. For each packet it finds the longest address prefix that matches the destination.

The packet leaves through the interface registered for that prefix. The default route, 0.0.0.0/0, catches everything that matches nothing more specific.

• With a full tunnel, the VPN client points the default route at the virtual interface. Every packet enters the tunnel except those addressed to the VPN server itself.
• With a split tunnel, the default route stays on the physical interface, and the client adds routes through the tunnel for specific prefixes only.

In WireGuard the difference is a single line. This setting sends only two internal networks through the tunnel, and everything else leaves over the normal connection:

AllowedIPs = 10.20.0.0/16, 192.168.50.0/24

The IPsec standards describe the same idea in terms of policy, in RFC 4301. Each entry in the Security Policy Database gives a packet one of three fates: protect, bypass or discard. A split tunnel is a policy that protects some traffic and bypasses the rest.

Some clients do not remove the original default route for a full tunnel. They add two routes that each cover half of the address space, 0.0.0.0/1 and 128.0.0.0/1. Being more specific than 0.0.0.0/0, they win, and the original route takes over again when the tunnel stops.

Three ways to split

• By destination address. The original method, working through the routing table as above. It is precise and cheap, but knows nothing about which app sent a packet.
• By app. You choose which apps enter the tunnel or are left out of it. Android lets VPN apps do this with lists of allowed or excluded apps. On desktop systems it usually needs software that hooks into networking at a deeper level.
• By domain name. The client watches DNS answers and adds a route for the address returned for a given name. This is the least precise method. Content delivery networks serve many sites from the same addresses, and an address can change from one lookup to the next.

Each method also has an inverted form: a list of what stays out, with everything else entering the tunnel. The inverted list is safer when protection is the default, because any new app goes through the tunnel automatically.

Full tunnel versus split tunnel

The risks

• DNS leaks. If the resolver sits outside the tunnel, the lookup for a site you open through the tunnel leaves over your normal connection. Your provider sees the name, and the resolver sees your real location. See DNS leaks.
• Two addresses in one browser. The WebRTC requirements document, RFC 8828, names split-tunnel VPNs as its most significant concern. The browser can discover both the VPN's public address and your provider's address, and expose both to a site.
• Two locations for one account. Suppose you open one service from an app inside the tunnel and a browser outside it. The service sees your account connecting from two countries at once, which fraud systems may treat as suspicious.
• A bridge between networks. NIST's Guide to IPsec VPNs (SP 800-77 Rev. 1), section 7.2.1.2, explains that a compromised host can become a path from the internet into a company network through its tunnel. Many companies forbid split tunneling on staff devices for that reason.

Why companies allow or forbid it

The same NIST guide also lists reasons to prefer it: staff's personal traffic stays off the company network, and less internet capacity is needed. A company may also have legal reasons not to handle traffic unrelated to its business. The guide treats phones as a special case, where the tunnel can be limited to the work app alone.

How to see which traffic goes where

Ask the system which interface will carry a packet to a given address. On Linux:

ip route get 1.1.1.1

On macOS:

route -n get 1.1.1.1

On Windows, in PowerShell:

Find-NetRoute -RemoteIPAddress 1.1.1.1

Then check from the websites' side:

1. Open the My IP tool in a browser that should be inside the tunnel, then in one that should be outside it. You should see two different addresses, as planned.
2. Run the DNS leak test in the browser inside the tunnel. The resolvers shown should belong to the tunnel's side, not your own provider.
3. Test the same browser for a WebRTC leak, since that is where both addresses tend to surface together.

How to split safely

• Start with the right question. Decide what must leave through the tunnel and what must stay local before choosing a method. Write the list down: rules added in a hurry get forgotten and surprise you later.
• Keep each service on one path. Everything tied to one account, its app and its website, should exit from the same place.
• Send DNS through the tunnel for every name you open through it. If you cannot, a full tunnel is the safer choice.
• Do not forget IPv6. A rule that covers IPv4 alone lets IPv6 traffic leave over the normal connection. See IPv6 leaks.
• Use a full tunnel for financial accounts where it works, and split only traffic that carries no account or sensitive data.

Splitting with syriaproxy

Our apps and WireGuard tunnel the whole device; the Chrome and Edge extension routes only the browser, with WebRTC set not to leak. A SOCKS5, HTTP or HTTPS proxy carries only the program you set it in. Because balance is counted per gigabyte, whatever stays outside the tunnel is not charged.

FAQ

Test your browser now with the free WebRTC leak test.