Choose full or split tunneling

The same tunnel, the same keys, the same endpoint — what makes a VPN “full” or “split” is nothing but the routes you install.

A full tunnel installs routes that send normal Internet traffic through the VPN endpoint. A split tunnel sends selected destinations through the VPN and leaves other traffic on the local connection.

In WireGuard the choice is one line in the client’s [Peer] section:

AllowedIPs = 10.14.0.0/24
# split tunnel: only the private subnet uses wg0

AllowedIPs = 0.0.0.0/0, ::/0
# full tunnel: every IPv4 and IPv6 destination uses wg0

When AllowedIPs contains 0.0.0.0/0, wg-quick does not overwrite your default route. It installs special policy-routing rules that take precedence, so bringing the tunnel down restores the previous state cleanly.

Now the trade-offs. Full tunneling centralizes egress and filtering: every packet gets the endpoint’s protections, its logging, and its network position. It also adds latency, bandwidth cost, and a larger failure domain — when the endpoint dies, the entire Internet dies with it for that device.

Split tunneling reduces unnecessary traffic. Your video call to a public service takes the short path instead of a detour through the company gateway. It needs careful routes and DNS behavior so private destinations still use the correct path: a private hostname resolved through public DNS returns nothing, no matter how correct your routes are.

Verify which mode you actually got by testing a public destination:

ip route get 1.1.1.1
# split:  1.1.1.1 via 192.168.1.1 dev eth0 src 192.168.1.34
# full:   1.1.1.1 dev wg0 table 51820 src 10.14.0.2

Choose from the job. Reaching private resources calls for a split tunnel with narrow routes. Protecting all traffic on hostile networks, or enforcing central filtering, calls for a full tunnel — and you accept its costs deliberately.

The failure mode worth knowing: switching a client to 0.0.0.0/0 when the server was never configured to forward and NAT Internet traffic. Every public destination goes dark at once. The next lesson covers the server side that makes full tunnels actually work.