What Is Split Tunneling & How Does It Work?

Although VPNs are great for your online privacy and security, there might be times you don’t think you need one. This is where split tunneling comes in. Split tunneling lets you choose specific traffic to bypass the VPN tunnel, leaving the rest of your traffic encrypted. 

This gives you greater flexibility as you can customize your VPN according to your needs. You’ll be able to access your local network and VPN server network at the same time, and even browse local and foreign content content simultaneously. 

However, split tunneling comes with some risk. In this blog post, we’ll break down everything related to VPN split tunneling, and show you when and how to activate split tunneling safely. 

What Is VPN Split Tunneling?

Split tunneling is a VPN feature that lets you divide your internet traffic, giving you more hands-on control over where your traffic goes. You can choose specific traffic to route through the encrypted VPN tunnel, while the remaining traffic uses your regular network connection.

How Split Tunneling Works

When you enable split tunneling in your VPN, you can exclude specific traffic from the VPN tunnel. For example, you can set up split tunneling to exclude Gmail, Venmo, and DoorDash from the VPN tunnel, meaning these sites will be able to use your standard internet connection. None of this traffic will be encrypted by the VPN, and your real IP address will be visible. Everything else will be routed through the encrypted VPN tunnel. 

In terms of digital privacy, sending all your traffic through the VPN is the safest option as your connection is fortified against intrusion. However, split tunneling is a useful tool if you don’t want to disable your VPN every time you need to use your standard internet connection. 

What’s the Difference between a Split Tunnel and Full Tunnel?

A full tunnel is simply a standard VPN connection. All traffic is encrypted to and from your device. When you connect to a VPN, you automatically have a full tunnel setup. 

A split tunnel divides your internet traffic based on your selection. You can choose specific traffic to encrypt (or decrypt) based on your needs. 

Types of Split Tunneling

1. App-based split tunneling: This option lets you specify which apps to encrypt, while the rest of your traffic stays unencrypted. For instance, you can choose to encrypt specific banking apps to keep your sensitive financial data safe. Conversely, you might choose not to send your banking traffic so you’re using a local IP address to help reduce CAPTCHAs. This is the most common type of split tunneling.  
2. URL-based split tunneling: You can choose certain URLs to send through your VPN, while the rest of your internet traffic stays on a standard internet connection. For example, you can set up the VPN to exclude your local weather station’s site to ensure you see location-specific results. 
3. Inverse split tunneling: All your traffic is encrypted, bar any trusted programs you select. This option is useful in situations where speed is more important to you than security (like if you’re using a trusted gaming client and you want optimal performance).
4. IP-based split tunneling: You can exclude certain IP addresses from the VPN tunnel. This is a popular option for businesses. 
5. Protocol-based split tunneling: This splits your traffic based on protocols. For example, you can route HTTP traffic through the VPN but exclude HTTPS traffic. Another option is routing data-heavy traffic (like downloading or streaming) through UDP, while making online payments using TCP.

Pros and Cons of VPN Split Tunneling

Pros

• • ✅ Your real IP address is still active. You can use your ISP-assigned IP address at the same time as the VPN server’s IP address.
  • ✅ You can customize your connection. You can choose which traffic to redirect through the VPN server, and which traffic to exclude. Any excluded traffic will use your regular internet connection.
  • ✅ You can save bandwidth. Since VPN encryption can marginally slow down your connection, split tunneling helps you avoid encrypting any traffic that requires top speeds.

Cons

• • ❌ Your traffic is vulnerable to snoops and cybercriminals. Any unencrypted traffic won’t be protected by a VPN’s security measures (like security protocols, a kill switch, leak protection, and more).
  • ❌ You might need some tech skills. To set up split tunneling, you need to manually configure specific URLs, apps, and clients to bypass the VPN.
  • ❌ Your ISP can snoop on your activity. Since your real IP address is visible, your ISP can monitor your unencrypted traffic and see what you’re doing. It can even throttle your connection if you’re using a lot of bandwidth.

When to Turn On Split Tunneling

While it’s best practice to always use a VPN, you might not always need the extra layer of security. It’s important to understand your needs before deciding to activate split tunneling. 

1. Avoiding Slow Speeds

If you have slow internet speeds but still want the protection of a VPN, split tunneling can help speed things up. For instance, you can exclude your gaming client from the VPN tunnel. This allows you to game online without risking the additional lag that might come with a long-distance VPN connection, and still enjoy VPN protection over your remaining traffic.

2. Browsing in Two Locations 

Some websites and apps only let you view their content if you’re in a specific location. This includes news sites, government services, banks, and streaming platforms. 

You can set up split tunneling to access location-specific content and continue to view content in your current location simultaneously. For example, you can exclude YouTube from the VPN tunnel so your feed will display local results. The rest of your traffic would still be routed through the VPN, so you’ll see content from the VPN server’s location. 

3. Accessing Your Local Area Network (LAN)

Some local devices have been configured with your real IP address (like your printer or game console). When you connect to a VPN, your real IP address is masked behind one associated with your VPN’s server. This change can sometimes result in losing access to local devices like your printer. 

Split tunneling allows you to connect to LAN devices without disconnecting from your VPN. 

4. Avoiding VPN Blocks

Some websites can ban VPN usage. An example is Wikipedia, which restricts editing permissions if you have a VPN IP address. You can use split tunneling to exclude Wikipedia from the VPN tunnel. 

Is Split Tunneling a Security Risk?

it’s always safer to encrypt all your traffic rather than just some of it. Unencrypted traffic won’t be protected against snooping and intrusion, so you could be putting sensitive data at risk. That said, using a split tunnel VPN to ensure some of your traffic is protected is still safer than not using a VPN at all. 

How to Turn On Split Tunneling on a VPN

To configure split tunneling, you need a VPN with a split tunneling feature. CyberGhost offers split tunneling on Android and an Exceptions feature on Windows. 

How to Activate VPN Split Tunneling on Android

1. Launch the VPN and click the settings icon. Make sure you’re not connected to a VPN server.

2. Once you’re in settings, click on VPN from the panel under Manage devices. Select App Split Tunnel at the bottom of the screen.

3. Select Mode at the top left-hand corner.

4. Create your split tunneling rules. Choose to protect all apps or select Custom rules to choose the apps you want to encrypt. 

How to Configure Split Tunneling on Windows

The CyberGhost Windows VPN app has an Exceptions feature that lets you exclude sites (like Netflix) from the VPN tunnel.

1. Launch the VPN app and log in. Click on Smart Rules. 

2. In the Smart rules section, select the Exceptions tab at the top. 

3. The Make exceptions section will appear. Toggle the On button.

4. Enter the URL of the website you’d like to exclude from the CyberGhost VPN tunnel and click Add. For example, you can type Netflix.com if you want to stream Netflix on your normal, unencrypted internet connection. 

5. That’s it! The URL will now appear on the list of URLs that bypass the VPN tunnel. You can deactivate or delete this URL at any time.

How to Test If Your VPN Split Tunneling Is Working

Unsure if split tunneling has been activated? Here are some steps you can take.

• • Check your VPN settings. Log in to your VPN and verify split tunneling is active. 
  • Visit the unencrypted channels and check your IP address. Your real IP address should be visible. You can use this free tool to check your IP address. 
  • Visit the encrypted channels and check your IP address. Your real IP address should be masked, and you should have a new IP address in the same location as the VPN server you connected to. 
  • Access local devices (like your printer or local servers). If you can establish a connection while the VPN is on, then split tunneling is active.

Is Split Tunneling the Right Choice for You?

Split tunneling has both benefits and drawbacks. On the plus side, you have greater control over your VPN traffic. On the downside, you might expose any unencrypted traffic to snooping, cyberattacks, and other security risks. 

We strongly believe it’s always a good idea to encrypt all your internet traffic. However, if you do need to use VPN split tunneling, remember to stay security-conscious and ensure all your sensitive data still remains encrypted. 

FAQ