Split tunneling
Split tunneling means sending only some of a device’s traffic through a VPN, while everything else goes out over the device’s normal internet connection. The alternative, a full tunnel, sends all traffic through the VPN, including web browsing and video calls, usually by way of a central VPN server.
Split tunneling in Managed Nebula
Section titled “Split tunneling in Managed Nebula”Managed Nebula is a split tunnel. DNClient only sends traffic through Nebula when it’s headed for an address on the network’s overlay, like another host’s overlay IP, or for a subnet the host is allowed to reach through a route. Websites, video calls, and software updates go out the host’s normal connection, the same as if DNClient weren’t installed.
For example, take a laptop on coffee shop Wi-Fi, on a network using 100.100.0.0/22, with a tag that lets it use a route to a database at 192.168.86.5:
| Destination | Path |
|---|---|
100.100.0.9, another host’s overlay IP | Through Nebula, directly to that host |
192.168.86.5, the database behind a route | Through Nebula, to the router host for that subnet |
www.example.com | The coffee shop’s Wi-Fi, as normal |
Internet traffic doesn’t detour through a VPN server, and traffic between hosts goes directly between them, so nothing central has to carry everyone’s traffic. Access to private resources is still controlled host by host with firewall rules (see Zero trust networking).
To see what goes through Nebula on a host, look at its routing table: the overlay range, and any routes the host uses, point at DNClient’s network interface.