DNS, routing and split tunnelling

Deciding what travels through the tunnel, and who answers your name lookups.

AllowedIPs is the routing decision

Despite the name, AllowedIPs in [Peer] does two jobs: outbound it decides what gets routed into the tunnel, inbound it decides what the peer may send you.

Neither is more correct. A split tunnel reaches the office while leaving video calls on your own connection; a full tunnel sends everything to the far end, which is what you want when you trust it more than the local Wi-Fi.

DNS

The DNS line in [Interface] names the resolver used while the tunnel is up.

If you use a split tunnel to reach internal machines by name, this line usually has to point at the resolver on that network — otherwise names that exist only inside it will not resolve, even though the addresses behind them are perfectly reachable. It is the single most common reason a split tunnel is described as “connected but nothing works”.

Paart can also decide this per domain rather than for the whole machine — the customer’s names through their resolver, everything else through yours. See Split DNS: the right resolver for each network.

What a split tunnel does not do

Traffic outside the configured ranges never enters the tunnel. That is the point — but it also means the far end offers that traffic no protection, because it never sees it.