Split tunneling

Short description: Computer networking concept

In computer networking, split tunneling allows a user to access distinct security domains at the same time, using the same or different network connections.[1] This connection state is usually facilitated through the simultaneous use of a LAN network interface controller (NIC), radio NIC, Wireless LAN NIC, and virtual private network client software application. Split tunneling is most commonly configured via the use of a remote-access VPN client, which allows the user to simultaneously connect to a nearby wireless network, resources on an off-site corporate network, as well as websites over the internet.

A split tunnel configured to only tunnel traffic destined to a specific set of destinations is called a split-include tunnel. When configured to accept all traffic except traffic destined to a specific set of destinations, it is called a split-exclude tunnel.[2][3][4]

Not every VPN allows split tunneling.[5][6][7] Advantages of split tunneling include alleviating bottlenecks, conserving bandwidth (as internet traffic does not have to pass through the VPN server), and enabling a user to not have to continually connect and disconnect when remotely accessing resources.. Disadvantages include potentially bypassing gateway-level security that might be in place within the company infrastructure.[8] Internet service providers often use split tunneling to that implement for DNS hijacking purposes.

## Contents

* 1 Variants and related technology
* 1.1 Inverse split tunneling
* 1.2 Dynamic split tunneling
* 1.3 IPv6 dual-stack networking
* 2 References
* 3 Further reading
* 4 External links

## Variants and related technology

### Inverse split tunneling

An "inverse" split tunnel is one that allows all datagrams to enter the tunnel, except those destination IPs explicitly allowed by VPN gateway.[9] The criteria for allowing datagrams to exit the local network interface (outside the tunnel) may vary from vendor to vendor. This keeps control of network gateways to a centralized policy device such as the VPN terminator. This can be augmented by endpoint policy enforcement technologies such as an interface firewall on the endpoint device's network interface driver, group policy object or anti-malware agent.[10] This is related in many ways to network access control (NAC).[11]

### Dynamic split tunneling

A form of split-tunneling that derives the IP addresses to include/exclude at runtime-based on a list of hostname rules/policies.[12][13][14]

### IPv6 dual-stack networking

Internal IPv6 content can be hosted and presented to sites via a unique local address range at the VPN level,[15] while external IPv4 & IPv6 content can be accessed via site routers.[16]

## References

1. ↑ "What is VPN Split Tunneling?" (in en). https://www.fortinet.com/resources/cyberglossary/vpn-split-tunneling.
2. ↑ Jeffery, Eric (2020-06-19). "VPN Split-Tunneling – To Enable or Not To Enable". https://www.infosecurity-magazine.com:443/opinions/vpn-split-tunneling/.
3. ↑ Mackie, Kurt (March 26, 2020). "Microsoft Touts Split Tunneling with VPNs To Support Remote Workers" (in en-US). https://redmondmag.com/articles/2020/03/26/microsoft-touts-split-tunneling-vpns.aspx.
4. ↑ Michael Cooney. "Cisco, others, shine a light on VPN split-tunneling" (in en). Network World. https://www.networkworld.com/article/3543298/cisco-others-shine-a-light-on-vpn-split-tunneling.html.
5. ↑ "VPN split tunneling". https://nordvpn.com/features/split-tunneling/.
6. ↑ Long, Moe (2021-07-22). "Best VPN for Split Tunneling" (in en-US). https://techuplife.com/best-vpn-split-tunneling.
7. ↑ "What is VPN split tunneling? All you need to know" (in en-US). https://surfshark.com/features/split-tunneling.
8. ↑ Remote Access VPN and a Twist on the Dangers of Split Tunneling, May 10, 2005, http://techgenix.com/2004fixipsectunnel/, retrieved 2017-12-05
9. ↑ Newman, Justyn (2025-08-20). "What Is Split Tunneling? The VPN Superpower You’re Probably Not Using". PCMAG. https://www.pcmag.com/explainers/what-is-split-tunneling-the-vpn-superpower-youre-probably-not-using.
10. ↑ "Reverse Split Tunnel Use Case in XenMobile Server and NetScaler Integration". 2024-12-07. https://support.citrix.com/external/article/CTX227491/reverse-split-tunnel-use-case-in-xenmobi.html.
11. ↑ Richard Bramante; Al Martin; James Edwards (2006). Nortel Guide to VPN Routing for Security and VoIP. Wiley. pp. 454. ISBN 9780470073001.
12. ↑ "AnyConnect Split Tunneling (Local Lan Access, Split Tunneling, Static & Dynamic (Domain)". March 24, 2020. https://community.cisco.com/t5/security-documents/anyconnect-split-tunneling-local-lan-access-split-tunneling/ta-p/4050866.
13. ↑ Cooney, Michael (2020-05-12). "Cisco, others, shine a light on VPN split-tunneling". Network World. https://bamboovpn.com/.
14. ↑ "Configure ASA/AnyConnect Dynamic Split Tunneling". 2023-09-19. https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215383-asa-anyconnect-dynamic-split-tunneling.html.
15. ↑ "Understanding Dual Stacking of IPv4 and IPv6 Unicast Addresses" (in en-us). 2023-11-24. https://www.juniper.net/documentation/us/en/software/junos/is-is/topics/concept/ipv6-dual-stack-understanding.html.
16. ↑ Kerner, Sean Michael (2025-02-27). "StarlingX bridges IPv4-IPv6 gap with dual-stack networking support" (in en). Network World. https://www.networkworld.com/article/3834095/starlingx-bridges-ipv4-ipv6-gap-with-dual-stack-networking-support.html.

## Further reading

* Juniper(r) Networks Secure Access SSL VPN Configuration Guide, By Rob Cameron, Neil R. Wyler, 2011, ISBN 9780080556635, P. 241
* Citrix Access Suite 4 Advanced Concepts: The Official Guide, 2/E, By Steve Kaplan, Andy Jones, 2006, ISBN 9780071501743, McGraw-Hill Education
* Microsoft Forefront Uag 2010 Administrator's Handbook, By Erez Ben-Ari, Ran Dolev, 2011, ISBN 9781849681636, Packt Publishing
* Cisco ASA Configuration By Richard Deal, 2009, page 413, ISBN 9780071622684 , McGraw-Hill Education

## External links

* "Split Tunneling in Linux". https://web.piyushgarg.in/2019/08/split-tunneling-in-linux.html.
* Split Tunneling in 2025

* v
* t
* e

Virtual private networking

Communications protocol|

* SSTP
* IPsec
* L2TP
* L2TPv3
* PPTP
* Split tunneling
* SSL/TLS
* (Opportunistic: tcpcrypt)

Free software|

* Cloudvpn
* FreeLAN
* FreeS/WAN
* Libreswan
* n2n
* OpenConnect
* OpenIKED
* Openswan
* OpenVPN
* Social VPN
* SoftEther VPN
* strongSwan
* tcpcrypt
* tinc
* VTun
* WireGuard
* Shadowsocks

Vendor-driven protocols|

* Layer 2 Forwarding Protocol
* DirectAccess

Proprietary software|

* Avast SecureLine VPN
* Check Point VPN-1
* Cisco Systems VPN Client
* LogMeIn Hamachi
* Microsoft Forefront Unified Access Gateway
* Hola
* Tunnelbear
* NordVPN
* SaferVPN
* ExpressVPN
* ProtonVPN
* PureVPN
* VPN.ht
* Private Internet Access

Risk vectors|

* Content-control software
* Deep content inspection
* Deep packet inspection
* IP address blocking
* Network enumeration
* Stateful firewall
* TCP reset attack
* VPN blocking

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Split tunneling. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Split_tunneling&oldid=4297134"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template