Configure a split-tunnel VPN for corporate + local access

Quick answer

A full VPN sends all your traffic through the tunnel — which can break access to local devices (your printer, NAS) and slow everything down. Split tunnelling lets you route only what needs the VPN through it, keeping the rest on your normal connection. Here’s how it works.

What does split tunnelling do?

Instead of forcing every connection through the VPN, split tunnelling divides traffic by rule: some goes through the encrypted tunnel (e.g. to your company network), the rest goes directly out your normal connection (e.g. local devices and general browsing). You get VPN protection where you need it without the all-or-nothing cost.

The common use case

The classic scenario is remote work: route traffic to corporate resources (internal apps, file shares) through the company VPN so it’s secured and reaches the private network, while everyday browsing and local-network access (your home printer, smart devices) stay on your direct connection. Without split tunnelling, a full corporate VPN often blocks your local devices and routes your personal browsing through your employer.

The two ways to split

Split rules are usually defined one of two ways: by application (these apps use the VPN, others don’t) or by destination (traffic to these IP ranges/domains uses the VPN). Corporate VPN clients commonly route by destination — the company’s internal IP ranges go through the tunnel, everything else doesn’t.

Setting it up

Where you configure it depends on your VPN. Many commercial VPN apps have a “split tunnelling” setting where you pick included/excluded apps. Corporate VPNs are usually configured by IT with the split rules baked in — if your local devices vanish when connected, ask whether split tunnelling can be enabled for your local subnet. WireGuard-based setups split by the AllowedIPs ranges in the config.

The trade-off to understand

Split tunnelling is a convenience/security balance. Traffic outside the tunnel isn’t protected by the VPN — so if you split your general browsing out, it’s exposed as normal (your real IP, your ISP sees it). That’s fine for non-sensitive traffic and local access, but know that only the tunnelled portion gets the VPN’s protection. Verify what’s exposed with our WebRTC Leak Test and the IP shown on our homepage.