Windows 11 Split Tunnelling and VPN Routing: 2026 Guide
Windows 11 can use built-in and vendor VPN clients with different routing rules. Learn how split tunnelling, DNS and kill switches affect real traffic.
Windows 11 supports built-in VPN profiles and third-party VPN clients. The actual routing behavior depends on the client, protocol and split-tunnelling rules.
Full versus split routing
With full tunnelling, most eligible traffic uses the VPN's default route. With split tunnelling, selected apps or networks can use the normal internet connection.
DNS is part of the design
A split route can still produce unexpected DNS behavior if name resolution uses a different adapter or secure-DNS setting. Test DNS separately from public IP.
Vendor clients
Commercial VPN apps often implement their own app-based split tunnelling, kill switch and protocol logic. Do not assume the Windows built-in setting controls every vendor feature.
2026 test checklist
- Check route tables before and after connection.
- Verify IPv4 and IPv6.
- Test included and excluded applications.
- Confirm kill-switch behavior.
- Check DNS resolver results.
- Re-test after sleep, resume and network changes.
Bottom line
Split tunnelling on Windows is powerful but can be difficult to reason about. Keep the exception list small and validate the real route instead of relying only on the UI toggle.
Related Posts
Android Private DNS and Always-on VPN: 2026 Configuration Guide
Android can combine Private DNS, Always-on VPN and block-without-VPN behavior. Learn how these controls interact and how to troubleshoot DNS or app failures.
iPhone and iPad in 2026: iCloud Private Relay vs VPN
Private Relay and VPNs overlap in privacy goals but cover different traffic. Learn how Safari, apps, DNS and network policies behave on Apple devices.
Android TV VPN Setup Guide 2026
How to set up VPN on Android TV and Google TV: Play Store app, APK, and router methods.