Use full tunnel when you must inspect or control all traffic from a device, and split tunnel when you only need to protect access to internal resources and bandwidth matters. Neither is universally better. The right choice depends on what you can monitor elsewhere and how much risk the open path creates.
What each mode actually does
With full tunnel, every packet from the laptop goes into the VPN and exits through your network. Your firewall, proxy and logging see all of it.
With split tunnel, the client sends traffic for listed networks through the VPN and lets everything else go straight out the user's own connection. Video calls, software updates and SaaS traffic skip the gateway.
A third pattern is inverse split tunnel, where everything goes direct except a short list of destinations. It is the same idea with the list flipped.
The case for full tunnel
Full tunnel gives one choke point. If you filter DNS, block known bad destinations or run data loss rules at the gateway, those controls only see traffic that passes through it.
It also removes a subtle risk. A device on a split tunnel is connected to your internal network and to an untrusted home or cafe network at the same time. Malware on the laptop can bridge the two. Full tunnel narrows that, though it does not remove it.
The cost is load. Every user's streaming, updates and cloud traffic hairpins through your gateway. That means bigger gateway capacity, added latency, and more users blaming the VPN for slow calls.
The case for split tunnel
Split tunnel keeps the gateway for what it is good at: reaching private apps. Cloud services keep their direct path, and performance usually improves.
It works best when the device itself is well managed. If you have disk encryption, an up to date operating system, endpoint protection from your own stack and DNS filtering on the device, you are not relying on the gateway to catch things.
Be careful with the route list. A list that grows by accident, with whole address ranges added to fix one ticket, slowly turns split tunnel into something nobody can reason about. Review it on a schedule.
A quick decision guide
Pick full tunnel if most of these are true:
- Staff use unmanaged or personal devices.
- You depend on gateway side filtering or logging.
- A regulator or customer contract expects traffic inspection.
- You have the bandwidth budget.
Pick split tunnel if most of these are true:
- Devices are managed and checked before connecting.
- Most work happens in SaaS tools reached directly.
- Gateway capacity is limited.
- Private app access is a small, well defined list.
Many teams end up with a hybrid: full tunnel for high risk roles such as administrators, split tunnel for everyone else. That is a fine answer if the groups are defined in policy and enforced, not left to user choice.
Mistakes to avoid
- Letting users toggle the mode themselves.
- Splitting by hostname without checking that DNS answers match the route.
- Assuming split tunnel is "less secure" without asking what the gateway was inspecting in the first place.
- Never testing what traffic actually goes where. Run a packet capture on one laptop and look.
If you are weighing whether a tunnel is the right model at all, see VPN or ZTNA: which fits your company.
Quick check
Does split tunnel mean traffic is unencrypted?
No. Traffic that goes direct is still protected by whatever the application uses, such as TLS. It just does not get the extra VPN layer or gateway inspection.
Can I use different modes for different groups?
Yes, most gateways support group based policy. Document who gets which mode and why, and review it when roles change.
Last reviewed: 19 October 2026.
