What is split tunneling, and what are the risks?
Show the answer
Say this first
With split tunneling, only traffic for company networks goes through the VPN and everything else goes straight to the internet. Full tunnel sends everything through the VPN. Split tunnel saves headend bandwidth and gives users faster SaaS and video, but internet traffic skips the company's web filtering and logging, and the laptop is on the internet and the company network at the same time. A common middle ground is full tunnel with exclusions for trusted, high-volume SaaS.
Go deeper
Variants
- Split include: only the listed company prefixes use the tunnel.
- Split exclude: everything uses the tunnel except listed prefixes, such as collaboration media.
- Dynamic split by domain in some clients, for SaaS whose addresses change often.
- Local LAN access: allows the home printer while the tunnel is up.
DNS is part of the design
Split DNS sends queries for company domains through the tunnel to internal resolvers and the rest to the local resolver. Without it, internal names fail or leak to public resolvers.
Historical note
When most staff moved to home working in 2020, many full-tunnel headends saturated and companies moved collaboration traffic to split exclude.
They will ask next
How do you keep web security with split tunnel?
Inspect on the endpoint or in a cloud security service the client always uses, so internet traffic is filtered wherever the user is, with or without the VPN.
What is split DNS in one sentence?
The client resolves company domains such as corp.example.com with internal DNS through the tunnel and everything else with its local resolver.
Traps
- Treating split tunnel as only a bandwidth setting. It is a security decision about where internet traffic is inspected.