Travelling with a corporate laptop is a balancing act between security, performance and convenience. Your company VPN protects sensitive traffic, but it can slow things down, drain battery and block local services. Split tunnelling promises relief by sending only work apps through the VPN and letting everything else use the local connection. Used wrongly, it can leak data or breach policy. Used correctly, it’s a smart way to stay productive on hotel Wi‑Fi, airport lounges and 4G/5G hotspots. This guide explains what split tunnelling is, when to use it, how to prepare before you fly, and the battery/compliance trade‑offs to watch. It’s written for travellers first, while staying friendly to IT policies and tooling. We’ll also cover practical connectivity choices, from personal hotspots to regional eSIMs such as Esim North America and Esim Western Europe, so you aren’t left fighting captive portals when a meeting starts.

What is split tunnelling?

When you connect to a corporate VPN, you typically get one of two modes:

• Full tunnel: All traffic goes through the VPN. Maximum control and security. Greater latency, bandwidth overhead and battery use.
• Split tunnel: Only defined apps or destinations go through the VPN. Everything else goes out locally to the internet. Better performance and battery. Increased exposure if misconfigured.

There are two common flavours of split tunnelling:

• Per‑app: Only specific applications (e.g., Outlook, Teams, SAP) use the VPN. Others (e.g., Spotify, personal browser tabs) bypass it.
• Per‑destination: Traffic to corporate domains, subnets or IP ranges uses the VPN; everything else goes direct.

Key risks to understand:

• Data leakage: If an app that handles company data is not routed via the VPN, logs and content may leak to local networks.
• Policy breach: Many organisations disable or tightly control split tunnelling to enforce monitoring, DLP and compliance.
• Captive portals: Some networks block or throttle VPNs. Split tunnelling can help you authenticate to the network, but policies still govern what’s allowed.

If your search intent is “vpn split tunneling travel,” the core takeaway is: it’s useful on the road, but only when your company explicitly allows and configures it.

Should you use split tunnelling on the road?

Pros (when permitted by IT): - Faster access to local/cloud services (video calls, maps, local content). - Better battery life due to reduced encryption overhead and lower round‑trip times. - Fewer geolocation issues for non‑work apps (streaming, public cloud buckets in‑region). - Smoother captive portal logins on hotel and airport Wi‑Fi.

Cons: - Increased risk surface on untrusted networks; misrouted traffic could expose metadata or content. - Harder for IT to enforce uniform controls and logs across all traffic. - Some collaboration tools may behave unpredictably when half inside, half outside the tunnel.

Bottom line: Use split tunnelling only if your IT policy allows it, ideally with centrally managed per‑app rules. If your device is managed (MDM/EDR), let IT push the profile. Avoid ad‑hoc, user‑side tweaks unless you have explicit approval.

Prepare your work laptop before you travel

Use this checklist one week before departure:

1. Confirm policy - Ask IT whether split tunnelling is allowed on corporate devices. - Clarify which apps must be forced through VPN and which can bypass. - Request written guidance for your destination(s).
2. Update and test - Patch your OS, VPN client and browser. - Test the VPN on at least two networks (home and a mobile hotspot). - Confirm you can reach key services (email, intranet, storage, CRM) with and without split tunnelling (if permitted).
3. MFA and recovery - Add backup MFA methods (TOTP app, phone, hardware key). - Generate one‑time recovery codes in case SMS is unavailable. - Ensure your device time zone and clock auto‑sync (MFA can fail with time drift).
4. Profiles and policies - Have IT push the correct VPN profile(s) and DNS split rules for your region. - Check that Always‑On VPN behaviour matches policy (e.g., blocks traffic until tunnel up). - Verify the kill switch is enabled if required.
5. Connectivity plan - Prefer mobile data over insecure public Wi‑Fi when possible. Load an eSIM for your route: see Destinations, or choose a regional plan like Esim North America or Esim Western Europe. Country options include Esim United States, Esim France, Esim Italy and Esim Spain. - Set up your phone’s personal hotspot as a backup. - Save hotel Wi‑Fi details offline, but avoid auto‑connect on unknown networks.
6. Contacts and contingencies - Save IT helpdesk contacts and escalation hours in your calendar (local time). - Request an alternative protocol/port (e.g., TLS/443) profile if your main VPN is blocked. - Ask for safe split tunnelling defaults if you’ll be presenting or streaming.

Pro tips: - Download offline installers for the VPN client and MFA app. - Cache the latest company root certificates in case the device can’t reach internal distribution points. - If travelling to higher‑risk regions, ask about a “clean laptop” policy and temporary accounts.

Configure split tunnelling safely (with IT approval)

Your corporate image may lock these settings; if so, use IT‑pushed profiles instead. If user‑config is permitted:

Windows 11/10 (generic steps)

• Open your corporate VPN client. Look for “Split tunnelling,” “Per‑app VPN” or “Exclude local networks.”
• Choose the mode approved by IT:
• Per‑app include list: Add only work apps to the VPN list.
• Per‑app exclude list: Keep all apps in VPN except those explicitly excluded (safer default).
• Per‑destination: Add corporate subnets (e.g., 10.0.0.0/8), domains or DNS suffixes.
• Ensure DNS for corporate domains resolves via the VPN (check “Use VPN DNS for internal domains”).
• Enable the kill switch if required, and verify that non‑VPN traffic is blocked when the tunnel is down (for non‑split apps).
• Apply and test:
• Open a corporate app (should route via VPN).
• Open a public website (should route directly if excluded).
• Confirm IP paths with “whoami” sites or tracert; check DNS with nslookup against internal names.

macOS (generic steps)

• In your managed VPN app or Network settings profile, locate split tunnelling controls.
• Use per‑app or per‑domain routing as defined by IT; avoid wildcards that could capture personal traffic.
• Verify “Send all traffic over VPN” is disabled only if split tunnelling is explicitly allowed.
• Check DNS suffix search and internal resolver settings are applied when the tunnel is up.
• Test with Activity Monitor’s per‑process network view or a browser extension that shows current egress IP.

Pro tips: - Don’t exclude your browser if you access SaaS tools that handle company data—keep it on the VPN unless IT says otherwise. - Avoid excluding update services; patching over untrusted networks is sensitive and may be blocked by your company anyway. - If performance is poor, ask IT about protocol options (e.g., IKEv2 vs TLS) rather than changing encryption settings yourself.

Network choices on the road

Order of preference for reliability and safety:

1. Mobile data via eSIM on your laptop/tablet or phone hotspot.
2. Known, password‑protected networks you control (MiFi, travel router with your SIM/eSIM).
3. Enterprise‑grade public networks (airline lounges).
4. Hotel or café Wi‑Fi (last resort).

Why eSIMs help: - Stable IPs and lower contention than crowded hotel networks. - Fewer captive portals that break VPN handshakes. - Predictable costs and usage alerts.

Plan ahead with Destinations and pick a regional or country plan to match your itinerary: Esim North America, Esim Western Europe, Esim United States, Esim France, Esim Italy or Esim Spain. If you’re managing a team, centralise purchasing and support via For Business. Partners and MSPs can streamline provisioning through the Partner Hub.

Captive portal tip: - Most portals block VPNs until you accept terms. Temporarily disconnect the VPN, join the Wi‑Fi, complete the portal, then reconnect. If policy enforces Always‑On VPN, use mobile data to complete sign‑in or ask IT for a captive‑portal profile.

Battery and performance trade‑offs

VPNs consume CPU to encrypt/decrypt traffic and can keep radios active, increasing battery use. Practical steps:

• Prefer modern, efficient protocols approved by IT. IKEv2 and WireGuard‑based options are generally lighter than older SSL/TLS stacks, but only switch if your organisation supports them.
• Use split tunnelling (if allowed) for heavy, non‑sensitive traffic like video conferencing to reduce packets through the tunnel.
• Avoid marginal Wi‑Fi. Weak signals force higher transmit power and retries. A good eSIM or hotspot can use less energy overall.
• Close background sync and heavy downloads before joining a meeting. Cloud drive re‑indexing can saturate the tunnel.
• Reduce resolution/frame rate in video calls if bandwidth is tight.
• Let your device sleep between tasks; some VPN clients keep sockets alive—enable power‑friendly settings if IT permits.
• Keep your device cool. Thermal throttling increases energy per task and can worsen VPN performance.

Compliance essentials (don’t break policy)

• Respect MDM/EDR controls. Don’t install personal VPNs or proxies alongside corporate VPN clients.
• Don’t modify encryption, DNS or split rules beyond what IT has approved.
• Treat public cloud/SaaS as “work data” unless explicitly personal. If you use a browser for both, keep that browser within the VPN.
• In restricted or high‑risk countries, consult IT about export controls, device searches and data minimisation. Ask whether a loaner device is required.
• If your VPN is blocked regionally, use the IT‑approved fallback profile. Avoid consumer workarounds that could violate policy.

Troubleshooting on the road: quick fixes

If the VPN won’t connect: - Try another network (switch to your eSIM or hotspot). - Check time/date and time zone; re‑sync if MFA fails. - Complete captive portal sign‑in before reconnecting. - Toggle a secondary protocol/port profile (e.g., TLS/443) if provided. - Reboot the device; network stacks and drivers often recover on restart.

If split tunnelling misroutes traffic: - Flush DNS cache and retry. - Ensure corporate domains are on the “include” list. - Remove risky exclusions (e.g., your browser) and test again.

If calls are choppy: - Move the conferencing app to bypass VPN (only if IT allows). - Drop video quality or switch to audio‑only. - Swap to mobile data; hotel Wi‑Fi uplinks are often the bottleneck.

If you can’t reach internal sites: - Verify the VPN is up and that DNS suffix search is applied. - Try the short hostname and the FQDN. - Ask IT whether the site is geo‑restricted or requires a different profile.

Pro tips: - Keep offline copies of key docs for read‑only access if the VPN drops. - Save your helpdesk’s “known issues” page for quick self‑diagnosis.

FAQ

• What is split tunnelling in a VPN? Split tunnelling routes only selected apps or destinations through the VPN, with other traffic using the local internet. It improves performance and battery life, but must be configured and approved by IT to avoid data leakage.
• Is it safe to use split tunnelling on hotel Wi‑Fi? Only if your company allows it and has defined which traffic must stay inside the tunnel. Use mobile data where possible, and keep work apps (email, browsers used for SaaS, storage clients) inside the VPN.
• Will a VPN slow my connection? Yes, some. Encryption and longer routes add latency and reduce throughput. Efficient protocols and split tunnelling (if permitted) mitigate this. A good eSIM or hotspot often outperforms congested Wi‑Fi.
• Can I watch streaming services while connected to my corporate VPN? Often your company blocks or discourages this. Even if it works, streaming through the VPN can waste bandwidth and trigger policy issues. If allowed, keep streaming outside the tunnel with split tunnelling, and only on personal time.
• My VPN breaks at captive portals. What should I do? Disconnect the VPN, complete the portal login, then reconnect. If your device enforces Always‑On VPN, connect via mobile data first or use an IT‑approved captive‑portal profile.
• Should I tether from my phone or use hotel Wi‑Fi? Tethering via a regional eSIM is typically safer and more reliable. See Destinations for travel options, including Esim North America and Esim Western Europe.

Next step: If you’re equipping a team for secure travel, centralise data plans and support with For Business.