// VPN routing · fundamentals
VPN split tunneling, whitelists, and routing rules
Split tunneling separates traffic between a direct connection and an encrypted VPN tunnel. The client app applies rules from the imported profile on the device.
Direct route and tunnel route
A direct route uses the device's regular network path. A tunnel route sends selected traffic through the VPN profile.
Splitting traffic can preserve a normal local path for selected services without sending every connection through the same tunnel.
Whitelist and rule-based routing
A whitelist usually names apps or destinations that should follow one selected path. Some clients describe the same idea as bypass rules, direct rules, or smart routing.
The exact labels matter less than the outcome: each rule should clearly map a destination to either the direct path or the VPN tunnel.
- domain or subdomain matches;
- IP address or network ranges;
- application-level rules when supported by the client;
- a default route for traffic that matched no earlier rule.
Rule order and DNS
Specific rules generally need to run before broad defaults. DNS behavior can also affect matching because a domain may resolve to changing addresses.
Client implementations differ, so test the final route after an app update or profile refresh.
Limits and trade-offs
Split tunneling is a routing feature, not a universal reachability or performance guarantee. Websites, access networks, DNS resolvers, and client updates remain outside Quietline's control.
A direct route also does not receive the same tunnel treatment as traffic explicitly sent through the VPN profile.