# What is Split Tunneling?

> Split tunneling is a remote-access routing arrangement in which selected traffic uses a protected tunnel to an organization while other traffic follows the device’s ordinary local or internet route.

- Canonical URL: https://yellowcube.eu/glossary/split-tunneling/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The split may be defined by destination prefixes, applications, domains, or policy. It changes which path traffic takes; it does not itself decide whether the traffic or endpoint is trustworthy.

Organizations use split tunneling to reduce gateway load, avoid indirect routes to nearby cloud services, or preserve local access. Its security depends on complete route definitions and consistent handling of DNS, IPv4, IPv6, updates, and failures.

### Key points

- **Policy scope:** Identify every corporate destination and supporting dependency that must use the tunnel. Treat local-subnet access, personal applications, and direct cloud paths as explicit decisions rather than defaults.
- **Endpoint and network controls:** Apply host firewall, patching, endpoint detection, identity controls, and secure DNS to both paths. A hostile local network remains a threat.
- **Operational checks:** Test route changes, reconnects, captive portals, IPv6, name resolution, software updates, and tunnel outages. Logs should show which policy selected each path without collecting unnecessary personal browsing data.
- **Important limitation:** Only traffic selected for the tunnel receives its protection and centralized inspection. Direct traffic may bypass organizational filtering and telemetry, while a compromised endpoint can communicate across both paths. Full tunneling removes that particular bypass but introduces gateway capacity and availability dependencies; it is not a complete security control either.

### Related terms

[Virtual private network (VPN)](<https://yellowcube.eu/glossary/virtual-private-network/>) · [Remote-access VPN](<https://yellowcube.eu/glossary/remote-access-vpn/>) · [Zero trust network access (ZTNA)](<https://yellowcube.eu/glossary/zero-trust-network-access/>) · [Secure web gateway (SWG)](<https://yellowcube.eu/glossary/secure-web-gateway/>) · [Network traffic](<https://yellowcube.eu/glossary/network-traffic/>)

### Sources

[NIST CSRC glossary: Split Tunneling](https://csrc.nist.gov/glossary/term/split_tunneling) · [NIST SP 800-77 Rev. 1: Guide to IPsec VPNs](https://csrc.nist.gov/pubs/sp/800/77/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.