iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
VPN split tunneling and a proxy solve different routing problems. Split tunneling is a VPN policy: selected traffic enters an encrypted VPN tunnel while traffic outside the policy uses the ordinary direct route. A forward proxy is an intermediary configured for a browser or application; it receives the requests that the application sends to it and forwards them onward. A proxy therefore does not automatically protect the rest of the device.
Choose split tunneling when you need selective, network-level control over devices, applications, destinations, or subnets. Choose a proxy when one browser or application supports the required proxy protocol and you accept the proxy operator as an additional point of trust. In either case, the actual result depends on protocol support, DNS and IPv6 settings, application behavior, and what your VPN or proxy operator logs.
What exactly is VPN split tunneling?
VPN split tunneling sends only a defined subset of traffic through a VPN while the remaining traffic follows a direct route. RFC 7359 describes this as the “split-tunnel” case: some traffic is sent through the VPN and other traffic is sent to its intended destination with a direct routing path.
How the routing decision is made
A split-tunnel client installs routes or filtering rules that decide whether a flow uses the virtual VPN interface or the normal network interface. Depending on the product, you can define the subset by:
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
- Application, such as sending a corporate database client through the VPN while a personal browser stays direct.
- Destination address, hostname, or address range, such as routing an internal subnet through the tunnel.
- Device, when a router applies the policy to selected phones, computers, televisions, or IoT devices.
- Interface or network, such as placing work traffic on a VPN-backed SSID and personal traffic on the ordinary connection.
“Split” describes the path, not a weaker encryption mode. Traffic that actually enters the VPN is protected by that tunnel according to the VPN protocol and endpoint policy. Traffic excluded by the rules is outside the tunnel and has the exposure of a normal direct connection.
What is a proxy, and how does it route requests?
A forward proxy is an intermediary between an application and the destination. The application is configured to send a request to the proxy, which then makes the onward connection. The proxy can see and process the metadata and content available to it under the protocol and encryption being used.
Browser and PAC proxying
Browsers can use a manual proxy setting or a PAC (Proxy Auto-Configuration) file. MDN defines a PAC file as “a JavaScript function that determines whether web browser requests (HTTP, HTTPS, and FTP) go directly to the destination or are forwarded to a web proxy server.” The function can return a proxy for one host and DIRECT for another, so PAC is selective routing at the request level.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →That scope is narrower than device-wide VPN routing. A PAC decision normally applies to requests made by a browser that honors the PAC file. A desktop application, game, command-line tool, DNS resolver, updater, or smart-TV app may ignore it unless that application has its own proxy setting or the operating system applies a compatible policy.
Why a proxy is not automatically a VPN replacement
A proxy does not inherently encrypt the link between your device and the proxy. HTTPS can protect web content between the browser and the HTTPS destination, but the proxy still handles connection metadata and may see unencrypted application data when the protocol does not provide end-to-end encryption. A proxy also does not automatically carry UDP, HTTP/3, or non-browser traffic. Cloudflare’s documented PAC proxy endpoints, for example, focus on HTTP and HTTPS and exclude UDP, HTTP/3, and non-browser applications.
What are the main privacy, security, and routing differences?
| Comparison | VPN split tunneling | Proxy |
|---|---|---|
| Routing scope | Selected network traffic uses the VPN; traffic outside the policy is direct. | PAC or application settings select particular browser or application requests. |
| Encryption and trust | The VPN tunnel protects included traffic to the VPN endpoint. Excluded traffic is outside that tunnel. | The proxy forwards traffic. Encryption depends on the protocol and application, such as HTTPS. |
| Protocol coverage | Can route IP traffic supported by the VPN implementation and its policy engine. | Coverage depends on the proxy and client; browser PAC endpoints may focus on HTTP/HTTPS and omit UDP, HTTP/3, and non-browser applications. |
| Local-network access | Direct routes can continue to reach printers, NAS devices, or other local services if the policy permits. | PAC rules can return DIRECT for selected hosts or networks. |
| Failure behavior | Incorrect rules can leave sensitive flows outside the tunnel. DNS and IPv6 need explicit review. | A PAC rule can intentionally fall back to DIRECT; that fail-open behavior must be understood. |
| Performance factors | Only selected traffic takes the VPN path. Endpoint distance, encryption overhead, and congestion affect latency. | Proxy distance, congestion, connection reuse, and protocol support affect latency. There is no universal speed percentage. |
Does split tunneling bypass the VPN for some apps?
Yes. If an application is excluded by the split-tunnel policy, its connections use the direct interface rather than the VPN. That can preserve access to local services or reduce latency, but it also means the excluded application does not receive the VPN’s tunnel protection or source-address policy.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Per-application rules
An allow-list model sends only named applications through the VPN. A deny-list model sends everything through the VPN except named applications. The labels differ between clients, so read whether “include” means “force through VPN” and whether “exclude” means “bypass VPN” before saving a rule.
Destination and subnet rules
Destination-based policies are useful when an organization publishes private address ranges or when only a particular service needs a different route. Hostname rules can be affected by DNS resolution, changing addresses, content-delivery networks, and applications that connect directly to an IP address. Subnet rules are more predictable when the service has stable ranges.
Device-based rules on a router
A VPN-capable router can place selected devices or VLANs on the VPN while leaving other devices on the ordinary WAN connection. This is useful for a television or work laptop that cannot run a VPN client, but the router must support policy-based routing and the chosen VPN protocol. Verify firmware support, route priorities, DNS handling, IPv6 behavior, and recovery when the tunnel drops.
Is a proxy safer than a VPN?
Neither category is automatically safer. A VPN can provide a stronger, broader transport boundary for the traffic that enters its tunnel, while a proxy may be sufficient for a browser request when HTTPS protects the content and the proxy’s operator is trusted. The correct choice depends on which traffic must be protected and which operator you are willing to trust.
What each operator can learn
The VPN endpoint can generally observe metadata for traffic that reaches it, such as connection timing, destination information available at that layer, and account details. A proxy can observe the requests it forwards and the metadata exposed by the protocol. HTTPS normally protects web content from intermediate networks, but it does not hide all metadata and it does not protect non-HTTPS traffic.
Recommended Free Tools
What each one does not protect
- Split tunneling does not protect traffic deliberately excluded from the tunnel.
- A proxy does not protect applications that do not use it.
- Neither option fixes malware, a compromised account, unsafe downloads, or weak application authentication.
- Neither option guarantees anonymity. The endpoint operator, destination service, and account identifiers can still link activity.
Which protocols and applications work with each option?
Protocol compatibility is often the deciding factor. A VPN operates at the network layer supported by its implementation, whereas a proxy depends on the client and proxy protocol.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Typical VPN split-tunnel coverage
When the VPN client or router supports the traffic, policy-based routing can cover browsers, desktop applications, DNS queries, and other IP flows. Actual coverage still depends on route precedence, whether an application uses a separate tunnel, and how the client handles IPv4 and IPv6.
Typical proxy coverage
HTTP proxies handle HTTP requests; HTTPS proxying commonly uses a CONNECT-style tunnel so the browser can establish TLS to the destination. A PAC file can choose between a proxy and DIRECT for each browser request. It does not, by itself, route arbitrary UDP flows, QUIC/HTTP/3 traffic, system services, or applications that ignore browser proxy settings. Cloudflare’s PAC proxy documentation specifically warns that its endpoints do not support every traffic type, so a browser proxy should not be described as a full-device VPN.
How do I configure split tunneling safely?
The exact labels vary by VPN client and router, but the following process prevents the most common routing mistakes.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Write the policy in plain language. State which applications, destinations, subnets, or devices require the VPN and which must remain direct. Include local services such as printers, file shares, and management interfaces.
- Choose an inclusion or exclusion model. An inclusion list is easier to audit when only a few flows need the tunnel. An exclusion list is convenient when almost everything should use the VPN, but one missed rule can expose an application on the direct path.
- Enter rules in the client or router. Use the product’s split-tunneling, per-app VPN, policy-routing, or route-management screen. Prefer stable application identifiers and address ranges over a single hostname when the service uses many changing addresses.
- Decide how DNS should follow the policy. Determine whether DNS queries go to the VPN resolver, the local network, or a public resolver. A hostname can reveal the destination even when the application’s data path uses the VPN, and a resolver that cannot reach an internal name can break work applications.
- Review IPv6 separately. If the VPN carries only IPv4, an IPv6-capable application may use the direct interface. Either provide an IPv6 tunnel and matching policy or deliberately disable IPv6 where appropriate and documented.
- Check the disconnect behavior. Decide whether protected applications should stop when the tunnel fails or continue directly. A kill switch or fail-closed rule is appropriate for traffic that must never leave the VPN; a fail-open rule may be necessary for availability but should be treated as an explicit exception.
- Verify every important flow. With the VPN connected, test an included application, an excluded application, a local service, DNS resolution, IPv4, and IPv6. Repeat the tests after reconnecting, changing networks, and disconnecting the VPN.
What to record for an audit
- The rule type and exact application, destination, subnet, or device.
- The expected interface and next hop for each test flow.
- DNS servers used while connected and disconnected.
- Whether the rule is fail-open or fail-closed.
- Firmware or client version, because routing behavior can change after updates.
How do I configure a browser proxy or PAC file?
Use a proxy when the browser or application is the boundary you actually want to control. Obtain the proxy hostname, port, authentication method, and supported protocols from the operator, then configure only the clients that should use it.
- Open the application’s network settings. Look for Proxy, Network, Connection, or Automatic Configuration. Operating-system proxy settings may be inherited by some applications but ignored by others.
- Select the appropriate mode. Choose a manual HTTP/HTTPS proxy, an automatic configuration URL, or an imported PAC file. Do not assume an HTTP proxy setting supports SOCKS, UDP, or HTTP/3.
- Define authentication carefully. Store credentials in the platform’s secure credential store where available. Avoid placing reusable passwords in a PAC file or sharing a PAC file that contains secrets.
- Add deliberate bypasses. A PAC function can return
DIRECTfor local names, private address ranges, or destinations that must not use the proxy. Keep the list short and review it as a possible fail-open path. - Test supported and unsupported traffic. Confirm the browser request reaches the proxy, then test a site that uses HTTPS, a local hostname, an application outside the browser, and any service that relies on UDP or HTTP/3.
- Inspect the result after changes. Check the destination-visible address, DNS behavior, certificate status, and application logs. A successful page load proves only that that particular request worked.
Illustrative PAC logic
function FindProxyForURL(url, host) {
if (isPlainHostName(host) || isInNet(host, "192.168.0.0", "255.255.0.0")) {
return "DIRECT";
}
return "HTTPS proxy.example.invalid:443";
}This example is a pattern, not a working service address. PAC files are JavaScript functions evaluated for browser requests; they do not force unrelated applications to use the proxy. A real deployment must use the operator’s supplied hostname, port, authentication, and supported proxy scheme.
Should I use a proxy or split tunneling for streaming?
Use split tunneling when the streaming device or application must follow a VPN route while other household traffic stays direct. Use a proxy only when the streaming application actually supports that proxy or inherits a compatible system setting.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Browser-based streaming
A browser proxy can route browser requests, but service behavior can change based on account region, licensing, DNS, IP reputation, and protocol choice. If the browser negotiates HTTP/3 or another unsupported transport, a proxy endpoint focused on HTTP/HTTPS may not carry that connection. A VPN rule covering the browser and its DNS path gives you a broader routing boundary, but the service can still enforce its own regional and account policies.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Televisions, consoles, and media players
These devices often have limited proxy controls and may use UDP, proprietary protocols, or application-specific resolvers. Router policy-based routing or a device-level VPN capability is usually more predictable than a browser PAC file, provided the router supports the required protocol and the device’s IPv4 and IPv6 traffic are covered.
Should I use a proxy or split tunneling for work apps?
For work applications, route the specific corporate destinations or managed applications through the organization’s approved VPN policy. Do not substitute an unapproved proxy for an enterprise access control, because the proxy operator could become an additional recipient of work traffic and the application may not support the proxy protocol.
When split tunneling fits
Split tunneling is useful when internal subnets must use a corporate VPN while ordinary browsing and local services remain direct. The organization should document allowed destinations, DNS resolvers, endpoint authentication, and what happens when the tunnel is unavailable.
When a proxy fits
A proxy can be appropriate for a browser-based security gateway or a narrowly scoped application that the organization explicitly supports. Confirm whether TLS is terminated at the proxy, whether the proxy inspects content, how credentials are protected, and which traffic is intentionally returned as DIRECT.
What are the most common leakage and failure problems?
| Symptom | Likely cause | What to check |
|---|---|---|
| A supposedly protected app shows the ordinary public address. | The app is excluded, a more-specific direct route wins, or it ignores the VPN client. | Inspect route tables and per-app rules; test the app while toggling the VPN. |
| Internal names stop resolving. | DNS is sent to a resolver that cannot answer private zones. | Set the documented VPN DNS policy and verify search domains. |
| IPv6 traffic bypasses the VPN. | The tunnel or policy covers IPv4 only. | Enable supported IPv6 tunneling and rules, or apply a documented IPv6 policy. |
| A browser works but a desktop client does not. | The client ignores PAC or system proxy settings. | Configure the client directly or route it with a VPN policy. |
| Some pages load while video, calls, or games fail. | The proxy does not support UDP, HTTP/3, or the application’s protocol. | Check endpoint protocol support and force a supported transport only when the application allows it. |
| Local printers or file shares disappear. | All traffic is being forced through the VPN, or local subnets lack a direct exception. | Add a narrowly scoped local-network route if policy permits. |
| Traffic continues normally after a VPN drop. | The policy is fail-open. | Use a kill switch or fail-closed rule for flows that must not leave the tunnel. |
| Latency changes unpredictably. | Endpoint distance, congestion, proxy load, or route changes. | Compare the same flow direct and tunneled at different times; do not rely on a universal speed claim. |
Can a VPN router implement selective routing?
Yes. A router with policy-based routing can assign selected devices, destination ranges, or VLANs to a VPN interface and send the rest through the ordinary WAN. This is a practical way to cover devices that cannot install a VPN client.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Questions to answer before buying or deploying
- Which VPN protocols and authentication methods does the firmware support?
- Can rules target devices, source subnets, destination subnets, domains, or only a default route?
- Does the router apply the policy to IPv6 as well as IPv4?
- Can DNS requests follow the same policy as application traffic?
- Is there a kill switch for the VPN policy, and can exceptions be documented?
- What happens during boot, tunnel renegotiation, firmware upgrades, and provider outages?
- Can you export logs or route information to verify the path?
Router implementations differ substantially. Verify these capabilities in the current firmware documentation rather than assuming that a product described as “VPN compatible” supports selective routing.
How should I choose between the two?
Make the decision from the traffic boundary and threat model, not from the words “VPN” or “proxy” alone.
- List the flows. Include browsers, work clients, streaming devices, DNS, local services, voice or video calls, games, and background applications.
- Mark the required boundary. If an entire device, subnet, or non-browser protocol needs the VPN, start with split tunneling. If only browser URLs need an intermediary, a PAC or application proxy may be enough.
- Check protocol support. Confirm HTTP/HTTPS, SOCKS, UDP, HTTP/3, DNS, and IPv6 support where relevant.
- Evaluate trust. Identify who can see traffic metadata, whether HTTPS remains end to end, how authentication works, and what logs the operator keeps.
- Choose failure behavior. Select fail-closed for traffic that must never go direct; select fail-open only when availability is more important and the exception is understood.
- Test after deployment. Verify included, excluded, local, DNS, IPv4, IPv6, and disconnect scenarios rather than relying on a single “connected” indicator.
What should I remember about split tunneling and proxies?
Split tunneling is selective VPN routing; a proxy is selective request forwarding. The VPN protects only the traffic that enters its tunnel, while a proxy protects neither unrelated applications nor protocols it does not support. The safest configuration is the one whose routing rules, DNS and IPv6 behavior, endpoint trust, and failure mode you can state and verify.
Frequently Asked Questions
Can split tunneling reduce VPN battery or bandwidth use?
It can reduce the amount of traffic encrypted and sent through the VPN, which may lower tunnel overhead on a constrained device. The result depends on the client, cipher implementation, network conditions, and how much traffic you exclude; there is no universal savings percentage.
Will a proxy hide my IP address from every website?
Only requests that actually use the proxy may appear to originate from the proxy’s network. Direct browser exceptions, other applications, DNS behavior, and connections that bypass the proxy can still reveal the ordinary network address.
Can I run a VPN and a proxy at the same time?
Yes, but the order matters: a browser proxy may send its request through the VPN, or a proxy can be outside the tunnel, depending on routing. Stacking them increases troubleshooting complexity and can create conflicting DNS, authentication, and fail-open behavior.
Why does an application ignore my PAC file?
PAC is evaluated by clients that implement browser-style proxy configuration. Applications with their own networking stack, certificate handling, or UDP transport may ignore system PAC settings and require a separate proxy option or network-level VPN policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
