Configure split tunneling for the OSVPN client on Windows by modifying the connection’s IPv4 properties to use a custom metric. This prevents the VPN from becoming the default gateway, ensuring only traffic destined for specific remote subnets is routed through the encrypted tunnel while local network access remains direct and unaffected.
Understanding Split Tunneling Mechanics
Split tunneling allows you to send only selected traffic through your Virtual Private Network (VPN) while keeping other traffic on your regular internet connection. In standard VPN configurations, the server often pushes a "default route" that forces all internet traffic through the tunnel. This can slow down general browsing and block access to local resources like printers or intranet sites. By disabling this automatic default route assignment, you retain full control over which destinations traverse the secure channel.
This approach is particularly useful when accessing corporate resources that reside in a specific subnet. You want those internal servers protected by encryption, but your daily web browsing should go through your faster, local ISP connection. The OSVPN client, like most robust Windows VPN implementations, respects the underlying routing table managed by the operating system. Therefore, the solution lies not in changing the VPN software itself, but in adjusting how Windows handles IP routing for that specific adapter.
Configuring the OSVPN Connection Properties
The primary method to achieve split tunneling involves manually adjusting the IPv4 settings of the OSVPN adapter. You must ensure that the VPN does not claim the entire address space as its own. Follow these steps to disable the automatic default gateway:
- Navigate to Settings > Network & Internet > VPN.
- Select your
OSVPN connection from the list.
- Click on Edit or Advanced options depending on your Windows version.
- Locate the setting labeled "Use default gateway on remote network" or similar.
- Toggle this switch to Off.
When this option is disabled, the VPN client will no longer push a route with a destination of
0.0.0.0/0. Instead, it will only install routes for the specific subnets defined in the VPN profile. If your OSVPN profile does not specify any remote subnets, you may need to edit the connection details to include them. Without these specific routes, the tunnel might appear inactive for remote resources.
For users managing multiple connections, this setting ensures that only the designated OSVPN tunnel receives remote traffic. Other VPNs or network adapters remain independent. This isolation prevents routing conflicts that could arise if two clients tried to claim the default gateway simultaneously.
Verifying Routing Tables and Metrics
After disabling the default gateway, you must verify that Windows is correctly routing traffic to your remote destinations. Open Command Prompt as an administrator and run the following command:
route print
Look for entries associated with your OSVPN adapter. You should see specific network ranges listed under the interface corresponding to your VPN. If you do not see any routes pointing to the remote network, the split tunnel is technically active but ineffective because no traffic is being directed into the tunnel.
To troubleshoot missing routes, check the OSVPN client logs. Often, the server must explicitly advertise the networks it wants you to reach. If the server configuration is static, you may need to manually add routes using the
route add command. However, this is rarely necessary if the VPN profile is correctly configured.
It is also important to monitor the
Metric value of your network interfaces. A lower metric indicates higher priority. Ensure that your local Ethernet or Wi-Fi adapter has a lower metric than the VPN adapter for non-remote traffic. Windows automatically adjusts this when you disable the default gateway, but manual verification prevents subtle issues where local traffic accidentally takes the slower VPN path.
Handling Local Network Access Issues
One common side effect of split tunneling is the inability to access local devices. If your computer cannot ping a printer on your home network after connecting to OSVPN, it is likely due to routing ambiguity. Windows might be confused about which interface to use for local broadcasts.
To resolve this, ensure that your local subnet is not overlapping with the remote VPN subnet. Overlapping addresses cause severe routing conflicts that split tunneling cannot fix. If the subnets are distinct, you can force traffic to specific local IPs by adding explicit routes. For example, to ensure traffic to a local NAS goes directly:
route add 192.168.1.50 mask 255.255.255.255 192.168.1.1 -p
This command adds a persistent route for a specific device, ensuring it bypasses the VPN entirely. While powerful, this requires manual maintenance. For most users, simply disabling the default gateway is sufficient. If you experience connectivity drops, consider reviewing related guides on managing VPN interactions with local services. See our guide on
Enabling File Printer Sharing with WireGuard on Windows: Creating New Tunnels for broader context on network isolation techniques.
Frequently Asked Questions
Why can't I access the internet after enabling split tunneling?
If your internet stops working, it is likely because the VPN client did not install any routes, leaving no path for traffic. Ensure that the OSVPN profile includes valid remote subnet definitions. Without these, the tunnel has nowhere to send data, and since the default gateway is off, general internet traffic falls through.
Does split tunneling reduce security for my browsing traffic?
Yes, by design. Traffic that does not go through the VPN is unencrypted and visible to your local ISP or network administrator. Only the traffic destined for the specified remote subnets benefits from encryption. Use split tunneling only when you trust your local network connection.
How do I remove specific routes added manually?
You can remove manually added routes using the
route delete command followed by the destination IP and subnet mask. Be cautious when deleting routes, as removing the wrong entry can disrupt your network connectivity entirely. Always verify the route exists before deletion.
Can I use split tunneling with multiple VPN clients?
It is possible but complex. Each client must be configured to avoid claiming the default gateway. You will need to carefully manage metrics and specific routes to prevent conflicts. Consider using one primary VPN client for all remote access to simplify management and avoid routing loops.
What happens if the remote subnet changes?
If the remote network structure changes, you must update your OSVPN profile or manually adjust your routes. Static routes do not update automatically. Regularly review your network configuration to ensure your split tunneling setup remains accurate and efficient.