VPN configuration types
VPN apps often show settings such as full tunnel, split tunneling, DNS protection, and kill switch. They all affect how traffic is routed: what goes through the VPN and what stays on the normal network.
Full tunnel and split tunneling 🌐
The most important VPN setting is which traffic uses the VPN. This changes what ISPs and destination services can see.
Main differences
| Setting | Behavior | Good fit |
|---|---|---|
| Full tunnel | Routes almost all traffic through the VPN | Public Wi-Fi protection, making traffic use the VPN exit IP |
| Split tunneling | Routes only selected apps or destinations through the VPN | Company systems through VPN, video or games over the normal network |
| Per-app VPN | Applies VPN routing app by app | Use VPN for only a browser, game, or specific app |
Cautions
- Full tunnel can still have exclusions such as local LAN routes. Check both IPv4 and IPv6, DNS, and per-app exceptions.
- Split tunneling is convenient, but traffic outside the VPN uses the normal network IP.
- The choice changes what ISPs and services can see.
DNS settings and DNS leaks
DNS converts domain names to IP addresses. If DNS queries go outside the VPN, clues about visited domains may remain visible on the normal network side.
Common patterns
- Use VPN-provided DNS: selecting a server does not guarantee its route. Verify the actual resolver and path.
- Use OS or router DNS: depending on settings, queries may go outside the VPN.
- Use DoH/DoT: encrypts DNS itself, but whether it uses the VPN path depends on app and OS settings.
WebRTC leaks and local IPs
WebRTC powers browser voice/video features. Depending on browser and settings, it may expose local IPs or alternate path information to websites.
How to think about it
- Enable leak protection in the VPN app when available.
- Check official browser settings or management policies for IP exposure controls. Distinguish a private address from exposure of a public IP you intended to hide.
- If work apps or games need WebRTC, disabling it may affect functionality.
Kill switch and auto reconnect 🔒
A kill switch aims to block traffic outside the VPN, but scope varies by OS and product. Auto reconnect restores the tunnel; it does not itself block traffic during the gap. Check startup, manual disconnect, wake from sleep, and network changes.
When it helps
- When a task must keep using the VPN exit IP.
- When using public Wi-Fi and avoiding raw network fallback matters.
- For games and calls, it can interrupt traffic, so balance safety with usability.
VPN protocol types
A VPN protocol is the method used to build the tunnel. It affects speed, stability, device support, and whether restrictive networks block it.
Common examples
| Protocol | Traits | Good fit |
|---|---|---|
| WireGuard | Encrypted tunnel over UDP; performance also depends on devices, networks, and implementations | Supported clients with UDP connectivity |
| OpenVPN | Supports UDP or TCP; TCP does not guarantee passage through network restrictions | Flexible configurations with a supported client |
| IPsec/IKEv2 | Widely supported by OSes and common in enterprise VPNs | Company VPNs, mobile reconnection |
| SSL-VPN | An umbrella label for TLS-based products, including app proxies and full tunnels | Remote access after checking product-specific capabilities |
How to choose
First decide which traffic must stay inside the VPN. Routing, DNS selection, and disconnect blocking are separate functions: verify actual behavior instead of relying on setting names. Follow organizational policy on managed devices.
By use case
- Public Wi-Fi: prefer full tunnel, DNS protection, and kill switch.
- Company VPN: full or split routing depends on the organization. Follow the prescribed settings rather than creating your own exclusions.
- Gaming: if latency gets worse, keep the game on the normal network and use VPN for the browser only.
- To understand visibility effects, also read What others see when you use a VPN.
Specifications and related guides
Microsoft: VPN routing / Android: VPN / RFC 8828: WebRTC IP handling / WireGuard / OpenVPN manual / VPN protocol differences