Choose full or split tunneling

The same tunnel, the same keys, the same endpoint. What makes a VPN “full” or “split” is nothing but the routes you install.

A full tunnel sends all your Internet traffic through the VPN endpoint. A split tunnel sends only selected destinations through the VPN and leaves everything else on the local connection.

In WireGuard the choice is one line in the client’s [Peer] section. This is a split tunnel:

AllowedIPs = 10.14.0.0/24
# split tunnel: only the private subnet uses wg0

And this is a full tunnel:

AllowedIPs = 0.0.0.0/0, ::/0
# full tunnel: every IPv4 and IPv6 destination uses wg0

When AllowedIPs contains 0.0.0.0/0, wg-quick does not overwrite your default route. It installs policy-routing rules that take precedence over it. So bringing the tunnel down restores the previous state cleanly, with nothing to repair by hand.

Now the trade-offs. Full tunneling centralizes egress and filtering. Every packet gets the endpoint’s protections, its logging, and its network position. It also adds latency, bandwidth cost, and a larger failure domain. When the endpoint dies, the entire Internet dies with it for that device.

Split tunneling avoids unnecessary detours. Your video call to a public service takes the short path instead of a round trip through the company gateway. But it needs careful routes and careful DNS. A private hostname resolved through public DNS returns nothing, no matter how correct your routes are.

Don’t trust the config file to tell you which mode you got. Test a public destination:

ip route get 1.1.1.1
# split:  1.1.1.1 via 192.168.1.1 dev eth0 src 192.168.1.34
# full:   1.1.1.1 dev wg0 table 51820 src 10.14.0.2

If the output names eth0, public traffic stays local. If it names wg0, everything goes through the tunnel.

Choose from the job. Reaching private resources calls for a split tunnel with narrow routes. Protecting all traffic on hostile networks, or enforcing central filtering, calls for a full tunnel, and you accept its costs on purpose.

I run split tunnels for my own servers. I switch to a full tunnel only on networks I don’t trust, like hotel Wi-Fi, and I switch back when I leave.

The failure mode worth knowing: switching a client to 0.0.0.0/0 when the server was never set up to forward and NAT Internet traffic. Every public destination goes dark at once, while the handshake still looks perfect. The next lesson covers the server side that makes full tunnels work.