VPN split tunneling security risks and how to avoid them

Most of split tunneling’s security risks can be avoided by carefully considering what traffic needs to be protected. As long as you don’t send sensitive info over an unsecured connection or circumvent corporate security, you’ll likely be fine. If you’re interested in learning more about the dangers of split tunneling, keep reading. I’ll discuss some potential pitfalls and explain how to use your VPN’s split tunneling feature safely.

How to stay safe when split tunneling with a VPN

Normally, Virtual Private Networks (VPNs) encrypt all of your internet traffic, but split tunneling lets us exclude specific apps or websites. The key to staying safe is ensuring sensitive data remains encrypted and not undermining existing security processes.

Done correctly, split tunneling can maximize download speeds and allow you to access geo-blocked sites from two locations at once. If you’re not careful, though, your privacy may be at risk. Before creating an exception for a website or app, ask yourself the following questions:

• Would I care if someone could see what I did on this site/app?
• Do I use this app to process or interact with sensitive information (e.g. bank details or customer data)?
• Am I using a corporate VPN?
• Does the site still rely on HTTP instead of the more secure HTTPS?
• Will I be using public wifi hotspots?
• Am I able to use the site/app properly with the VPN active?

If you answered “yes” to any of these, it’s probably best to avoid split tunneling. Generally, the enhanced security a VPN provides is more valuable than a small performance boost.

Obviously, everyone’s situation is different, and split tunneling may be required in some cases. That said, in business settings, I strongly suggest running your concerns by the company’s IT team before taking action. They’ll make sure you’re still compliant with data-protection requirements and aren’t revealing information that’s supposed to be kept private.

What are the dangers of split tunneling?

Split tunneling can be dangerous because it removes protections against surveillance, reveals your true IP address, and may expose private data. Let’s discuss why that’s a problem and, more importantly, what you can do to avoid these issues.

1. Bypassing corporate network security

Businesses often mandate VPN usage to make sure that all corporate traffic and devices are adequately protected. Enabling split tunneling means some traffic will not be encrypted, increasing the risk of interception. Depending on how the network is set up, unencrypted traffic may not have the same protections against malicious domains or malware either.

Here’s the good news: your organization’s IT department almost certainly has a policy on VPN usage and split tunneling. If there’s a legitimate reason split tunneling is required, they should work with you to make it possible.

2. Exposing sensitive data

Allowing a site to bypass the VPN has an impact on privacy too. Most websites now use HTTPS, meaning they encrypt your traffic even without a VPN, but this doesn’t stop your ISP or the owner of a public wifi hotspot from seeing which sites you visit.

Worse, if you’re using a site that still relies on HTTP, anyone observing the network can see every page you visit. That’s a real problem, especially if the site makes information visible in the URL. They’ll also see any searches performed there, and the contents of any sent messages. Poorly-implemented split tunneling may even result in non-compliance with data privacy legislation like HIPAA, CCPA, or GDPR.

So how can we reduce the risk of data exposure when split tunneling? There are a few methods, including limiting public wifi usage and only using sites that support HTTPS. Try not to perform sensitive tasks like online banking or accessing confidential information either. Split tunneling exceptions should only be made in cases where it’s not a big deal if your traffic is intercepted.

3. Revealing your real IP address

One of the biggest advantages of VPNs is that they hide your real IP address. This prevents attackers from targeting your router or identifying your real location and service provider, so it has huge privacy benefits.

Split tunneling means you willingly give up this protection for certain websites and apps. For that reason, it’s vital to carefully evaluate the risk of each exception you make.

Here are several examples showing why revealing your IP address can be a problem:

• Torrenting without a VPN means every other person sharing the same file can find your IP address and approximate location. It also makes you more vulnerable to copyright trolls. If you’re interested, check out our guide to setting up a split tunnel for torrenting.
• VPN servers have built-in DDoS protection. If an attacker sends thousands of requests to your home router instead, you may be unable to use the internet until they stop.
• Criminals can use your real IP address to perform port scans and other tests designed to find vulnerabilities in your network. If they succeed, they may be able to remotely install viruses or access other devices such as unsecured cameras or printers.

Which VPNs offer secure split tunneling?

Not every VPN supports split tunneling, so if this is a feature you’re interested in, you’ll have to choose carefully. Additionally, providers may not offer this functionality in every version of their app. You can manually set up split tunneling on your router, though, which lets you work around this limitation. Below, I’ll discuss the best split tunneling VPNs and provide a short description of what makes each worthy of your time.

• NordVPN: Best overall split tunneling VPN. Lets users include or exclude specific apps on Windows and Android, with domain exclusion in its browser extension. Ranks highly on speed, security, and streaming, but its renewal pricing is a bit steep.
• Surfshark: Best value VPN with split tunneling support. No connection limits and its Bypasser feature is available on all platforms except Linux. Has cheap long-term subscriptions but also the most expensive month-to-month plans.
• Proton VPN: No-logs service that offers split tunneling on every platform but iOS. Tops our value rankings but could be slightly more consistent where speed is concerned.
• ExpressVPN: The only major VPN that allows split tunneling in all of its apps. Ranked #1 for speed and works anywhere in the world but lacks advanced functionality.
• IPVanish: Supports split tunneling in all versions of the app except Linux. One of our top performers on streaming and ease of use but slightly slower WireGuard speeds.

Conclusion

Split tunneling is a tool that should be used sparingly, and only if you’re having problems accessing a given service with the VPN active. For instance, it can be helpful for downloading updates as quickly as possible or accessing local geo-blocked websites. Because you’re giving up protection, though, it’s best avoided in corporate settings and shouldn’t be used for financial transactions or when working with sensitive information.

VPN split tunneling: FAQs