Topic
VPN split tunneling
VPN split tunneling sends selected traffic through a VPN while other traffic uses the ordinary network path instead of sending everything through the tunnel.
At a glance
- Core behavior
- Some traffic uses the VPN and some bypasses it
- Tradeoff
- Performance and access versus uniform policy
Overview
Split tunneling is a routing choice. It can reduce bandwidth through the VPN and keep local or latency-sensitive services on a direct path, but it also means some traffic does not receive the routing and policy effects of the VPN. Organizations therefore need to decide whether convenience and performance justify the different security boundary.
Why people use it
A user may want corporate applications routed through an enterprise VPN while video streaming, local printers, or other services stay on the regular connection. This can reduce load and avoid routing traffic unnecessarily through a distant VPN gateway.
Why administrators may restrict it
Traffic that bypasses the tunnel can also bypass monitoring, filtering, or network controls provided by the VPN path. Security-sensitive environments may therefore disable split tunneling or permit it only for specifically approved destinations and applications.
Sources and review
MOOR's explanatory text is supported by the following source links.
- AnyConnect split tunneling guidance — Cisco
- VPN routing decisions — Microsoft Learn