I Tried Split Tunneling to Save My Call—Then Realised I Was Excluding the Work I Wanted Protected

The airport lounge Wi-Fi was fast enough to play a video, but my presentation upload had stopped at 61 percent and the preview window for a client call kept freezing. I blamed the crowded network, disconnected, rejoined and chose a nearer VPN server. The upload advanced by three percent and stopped again.

The VPN was running in full-tunnel mode. The browser, cloud drive, meeting app and everything else on the laptop were taking the same encrypted route.

That sounded like the safest arrangement. With twelve minutes left before the call, it also looked like the reason nothing important was moving.

I opened the VPN settings and found the alternative I had been reading about: split tunneling.

The choice appeared simple. Full tunnel protected everything but was struggling on the lounge network. Split tunnel could send the meeting app directly to the internet while leaving the rest of the laptop on the VPN.

I added the meeting app to the exclusion list.

The video preview immediately looked better.

Then the sign-in page opened in my browser.

Split tunneling fixed the app, not the task

There is a sound reason companies use split tunneling for video meetings. Microsoft recommends allowing selected Teams traffic to bypass a forced VPN route, reducing the extra distance and congestion that can hurt real-time audio and video. (Microsoft, guidance on preparing networks for Microsoft)

Inside a managed organisation, that exception can be narrow and deliberate. An IT team knows which services are involved, defines the routes centrally and tests the policy across company devices.

I was not an IT team. I was one person in an airport lounge choosing applications from a consumer VPN menu.

Split tunneling means some traffic uses the VPN while selected traffic follows the device’s ordinary internet connection. (NIST) The definition is simple. The difficulty is deciding where one task begins and ends.

The meeting was not contained inside one application.

The desktop client handled the call. The browser handled authentication. The calendar opened the meeting link. The cloud drive carried the presentation. Background services checked my identity and delivered workspace notifications.

I had excluded the app I could see. I had not excluded everything the app depended on.

The video preview now moved smoothly, but the browser asked me to authenticate again. The presentation remained stuck because the sync client was still inside the slower tunnel.

I excluded the browser. The sign-in page loaded.

Then I excluded the cloud drive. The upload resumed.

The improvement should have felt like progress. Instead, it exposed the contradiction in what I was doing. The meeting, the client login and the presentation were now bypassing the VPN. Those were the three things I had connected it to protect.

Other users run into the same practical problem: application rules can be difficult to verify, and an update may change an app’s path or move part of its traffic into another process. (Reddit discussion) The feature had worked exactly as designed. My mistake was treating a routing policy like a speed button.

That changed the question.

I no longer needed to know whether full tunneling or split tunneling was universally better. I needed to know whether I could keep the whole work session inside one tunnel without making the call unusable.

The established VPN left me with two incomplete choices

I had chosen the established provider for sensible reasons. It had years of public history, many server locations and mature controls, including application-level split tunneling.

In full-tunnel mode, the boundary was easy to understand: the laptop’s traffic used the VPN.

The problem was performance. The connection repeatedly stalled on the crowded lounge Wi-Fi, taking the upload and meeting media with it.

Split tunneling improved the call because the call no longer depended on that route. It had not improved the tunnel. It had moved the problem around it.

I tried one more nearby server. Then I changed protocols.

The full tunnel remained erratic.

I returned to split mode and reviewed the growing exclusion list: meeting app, browser, cloud drive. I considered adding the project workspace as well because message attachments were appearing slowly.

At that point, nearly the entire client session would have been outside the VPN.

A free browser extension offered an even simpler version of the same compromise. It could protect a browser tab, but the meeting client, presentation sync and workspace application would continue on separate routes. It solved the easiest traffic to contain, not the work I needed to complete.

The failure was no longer “full tunnel is too slow.”

It was that this full tunnel could not carry the complete task on the network in front of me.

The smaller app kept the work together

I removed the exclusions and installed OnlydogVPN.

Instead of asking me to choose among a long list of countries and protocols, it offered a preset for a weak or changing network. I selected it and connected.

Then I recreated the situation that had caused the trouble.

The browser was open. The presentation was syncing. The workspace was connected. The meeting preview was running.

The upload moved past 61 percent.

It reached 70, then 90, then finished.

The video preview remained clear. I joined the call, shared the completed deck and sent a copy through the workspace without excluding any of those applications from the tunnel.

The technical difference did not need a long explanation. The service uses an HTTP/3-based transport with added traffic obfuscation. HTTP/3 runs over QUIC, which is designed to handle changing network conditions and multiple active streams more gracefully than older connection paths. (RFC 9114)

In practical terms, the smaller app carried the browser, upload, meeting and workspace traffic together instead of asking me to decide which part of the job should go unprotected.

I could not inspect how the airport network classified every internal flow. I could see the result: the established app’s full tunnel repeatedly stalled, while the second connection completed the upload and held the call without an exclusion list.

That result changed split tunneling from an urgent workaround back into what it should have been: an optional routing decision.

The network changed, but the rule list did not

Near the end of the call, the lounge Wi-Fi weakened as the gate area filled. Audio broke for a moment, and I switched the laptop to my phone’s hotspot.

The meeting paused, then returned.

I did not have to reconnect each application or check whether a new network had altered the split-tunnel rules. The work session remained inside the same tunnel.

That recovery mattered because the original problem was not a laboratory speed test. It was a public network changing underneath a live call.

A split-tunnel setup can reduce pressure on a struggling VPN by sending demanding applications elsewhere. But when the connection changes, the user still has to trust that every process is following the intended route.

The smaller app removed that doubt. The meeting and files stayed together before and after the switch.

Once the call ended, I found a smaller reason to keep it installed.

The app showed that it had blocked unnecessary tracking requests during the session. That was not what saved the meeting, and it did not need to become a second sales pitch. It simply meant fewer background requests competing for attention on a connection that had already proved unstable.

The primary result remained the same: I had not needed to sacrifice full-tunnel protection to make the laptop usable.

Split tunneling is useful when the exception is the plan

The experience did not convince me that split tunneling is a bad feature.

It convinced me that it is often chosen for the wrong reason.

Split tunneling makes sense when a user or administrator knows exactly which traffic should bypass the VPN. A company may route carefully selected meeting traffic directly while keeping internal tools inside a managed tunnel. Someone may want a local printer, home media server or region-sensitive application to use the ordinary connection.

Those are planned exceptions with clear purposes.

My airport setup was different. I had started excluding applications because the full tunnel was failing. Every exclusion improved performance by removing another part of the client session from protection.

That was not a routing strategy. It was a retreat.

The established provider still had meaningful advantages: a longer public history, broader server coverage and more independent scrutiny. The smaller service has fewer locations and fewer years of public review.

But none of those differences changed the immediate test.

One connection gave me a full tunnel that stalled and a split tunnel that worked only after I excluded the meeting, browser and files. The other carried the complete work session through one tunnel and recovered when the underlying network changed.

For that call, full tunnel versus split tunnel was the wrong comparison. The deciding question was whether the full tunnel worked well enough that I did not have to take the important work out of it.