To configure split tunneling on Windows 11 so that your VPN only routes traffic for specific servers while leaving local internet access active, you must disable the "Use default gateway on remote network" option within the IPv4 properties of your VPN adapter. This simple toggle ensures that only the designated corporate or licensed server IPs travel through the encrypted tunnel, while all other web traffic continues to use your standard ISP connection.
Understanding Split Tunneling Mechanics
By default, most Virtual Private Network (VPN) clients are configured to route
all outbound traffic through the secure tunnel. While this provides maximum privacy and security, it creates significant bottlenecks for users who need to access high-bandwidth local resources, such as streaming media or local file shares, simultaneously with their work tasks. Split tunneling resolves this by allowing a hybrid approach where specific traffic is isolated in the tunnel and the rest is exposed directly to the internet.
In the context of accessing licensed server software, the primary goal is often to ensure that the authentication handshake and data transfer required by the application go through the secured corporate network, while general browsing remains fast and uncapped. Without split tunneling, your entire home broadband connection is forced through the potentially slower corporate uplink, leading to latency issues and reduced productivity.
Configuring Split Tunneling via Native Settings
Windows 11 provides built-in controls to manage this behavior without requiring third-party routing tables or complex command-line interventions. The most effective method involves modifying the TCP/IPv4 settings of the established VPN connection.
First, open the
Settings application and navigate to
Network & internet. From the left-hand menu, select
Vpn to view your list of configured connections. Locate the specific VPN profile used for your licensed server software and click on it to expand the options. You will see an
Edit button; click this to modify the connection properties.
Within the configuration window, look for the checkbox labeled
Use default gateway on remote network. Unchecking this box is the critical step that enables split tunneling at the operating system level. When this option is disabled, Windows stops adding a
0.0.0.0/0 route to the routing table, which is responsible for capturing all non-local traffic. Instead, it relies on the specific routes pushed by the VPN server or any static routes you manually define.
After unchecking the box, click
Save and reconnect to the VPN. Your local internet should resume normal speed immediately, while attempts to reach the internal server addresses will still be directed through the tunnel interface.
Verifying Route Behavior
To confirm that split tunneling is working correctly, you can verify the active routing table using the Command Prompt. Open
cmd.exe as an administrator and run the following command:
route print
Look for the
Active Routes section. You should see a specific entry for your local subnet (e.g.,
192.168.1.0) with a metric corresponding to your physical network adapter. Crucially, you should
not see a
0.0.0.0 destination with a next-hop address pointing to your VPN adapter's IP. If you do see
0.0.0.0 pointing to the VPN, the setting was not saved correctly, or another policy is overriding it.
For more detailed troubleshooting on connectivity issues that may arise after changing these settings, refer to our guide on
Create Split Tunneling OSVPN Client on Windows, which covers advanced scenarios involving custom routing tables.
Handling DNS Resolution Conflicts
A common side effect of enabling split tunneling is DNS resolution failure for internal resources. When the VPN does not act as the default gateway, Windows may continue to query your ISP's DNS servers instead of the internal corporate DNS servers required to resolve the licensed software's hostname.
To fix this, you must ensure that the VPN client is configured to register its DNS suffixes or manually specify the DNS servers in the IPv4 properties. In the same
Edit menu where you disabled the default gateway, click on
DNS settings. Change the configuration from Automatic to Manual. Enter the internal DNS server IP addresses provided by your IT department.
This ensures that when your browser requests
internal-server.corp.local, the query goes directly to the corporate DNS resolver through the tunnel, while requests for
google.com go to your ISP's resolver over the clear internet path. Failure to configure this correctly results in the application appearing offline even though the network tunnel is technically active.
Alternative Methods for Granular Control
If the native Windows UI does not provide enough granularity for your specific licensing requirements, you may need to implement static routes. This is particularly useful if the licensed software uses multiple subnets or dynamic IP ranges that are not automatically pushed by the VPN server.
You can add specific routes using the
netsh interface. For example, to route traffic for a specific subnet through the VPN interface, you would identify the interface index number from the
netsh interface ipv4 show interfaces command and then execute:
netsh interface ipv4 add route 10.10.0.0/16 interface= store=active
Replace
<index> with the actual numeric ID of your VPN adapter. This method forces all traffic destined for
10.10.0.0/16 to traverse the VPN tunnel, regardless of the default gateway setting. This approach is highly effective for enterprise environments where precise control over traffic flow is mandated by security policies.
For users experiencing broader connectivity failures after implementing these changes, such as being unable to ping internal hosts despite correct routing, check our article on
Windows Server 2022 VPN Setup Hell: Can't Connect Windows 11 Client for deeper diagnostic steps.
Frequently Asked Questions
Why does my local internet become slow after connecting?
This occurs because the VPN is acting as the default gateway, forcing all web traffic through the corporate uplink. To fix this, you must disable the "Use default gateway on remote network" option in the VPN adapter's IPv4 properties to restore direct local access.
Can I use split tunneling with L2TP/IPsec protocols?
Yes, but the implementation varies. L2TP/IPsec often requires manual configuration of the routing table because it does not always push default routes like SSTP or IKEv2. You may need to manually add static routes for internal subnets to ensure they traverse the tunnel while keeping the default route on your local NIC.
Will disabling the default gateway break my ability to access the internet?
No, provided you have correctly configured your local network adapter with a valid default gateway and DNS servers. Disabling the remote default gateway simply tells Windows to ignore the VPN for general traffic, allowing it to fall back to your standard ISP connection for all non-specific requests.
How do I troubleshoot if the licensed software still cannot connect?
Verify that the specific IP range of the licensed server is reachable through the tunnel by pinging it from the command line. If the ping fails, check that the internal DNS servers are correctly entered in the VPN's DNS settings, as name resolution failures are a common cause of perceived connectivity issues.
Is split tunneling less secure than full tunneling?
It offers a different security profile rather than being strictly less secure. It reduces the attack surface for the corporate network by limiting traffic to necessary channels, but it exposes local traffic to potential interception on the public internet. Always ensure your local Wi-Fi network is secure when using split tunneling to protect sensitive personal data.