# VPN Split Tunneling: Convenience, Performance and Risk > Split tunneling sends selected traffic outside a VPN. Learn when that improves performance and when it weakens a security boundary. - Canonical article: [https://www.metacyber.guru/articles/split-tunneling-vpn](https://www.metacyber.guru/articles/split-tunneling-vpn) - Category: Network Security - Author: Muhammad Azhar - Published: August 14, 2026 - Last reviewed: 2026-08-14 Split tunneling routes some traffic through a VPN and some through the ordinary connection. It can preserve local printer access, reduce bandwidth use and keep latency-sensitive services direct. ## The security trade-off Traffic outside the tunnel uses the local network and public IP. On a corporate device, an untrusted local path may also become a bridge between internet services and protected resources if controls are weak. ## Choose explicit rules Document which applications or destinations bypass the VPN and why. Test DNS alongside application traffic; inconsistent routing can reveal destinations or break internal names. ## When to avoid it Privileged administration, sensitive remote work and high-risk travel may justify full tunneling. Follow the organization's policy rather than enabling split routing for convenience. Split tunneling is not inherently wrong. It is a routing decision that should have a named owner, a measurable benefit and a test showing which traffic goes where. ## Domain rules can be unstable Large services change addresses and use shared infrastructure, so a domain-based exception may route more or less traffic than expected. Application-based rules are easier to explain but still need update testing. ## Logging and support Record the intended route in support documentation. When a user reports that an internal service works only sometimes, split DNS and split tunnel policy should be checked together rather than troubleshooting the application alone. ## Classify traffic by sensitivity and dependency Internal administration, credentials and confidential data usually belong inside the tunnel. Video calls or local printers may be reasonable exceptions when policy allows. Record why each application is excluded and which network it will use; convenience alone is not a risk assessment. ## Expect interactions with DNS and identity An internal service may resolve only through corporate DNS while its application is mistakenly routed outside. A public service may see two addresses during one session and trigger fraud controls. Test updates, authentication, IPv6 and reconnect behavior after every policy change. For regulated work, central configuration and logs are preferable to user-selected exceptions. The objective is predictable routing, not the largest possible bypass list. ## Sources and further reading - [NIST: Enterprise network security guidance](https://csrc.nist.gov/pubs/sp/800/215/final) - [CISA: Remote access VPN guidance](https://www.cisa.gov/news-events/alerts/2021/06/14/cisa-releases-guidance-selecting-and-hardening-remote-access-vpn-solutions) --- This Markdown edition is provided for language-model retrieval. The canonical human-readable page is the HTML article linked above.