A VPN’s green Connected indicator proves only that the client authenticated and established a session. It does not prove that every packet uses the tunnel. Split-tunnel routes, exclusion rules, an IPv4-only profile, local DNS resolution, or a reconnect transition can leave some traffic on your ordinary network interface.
Antihost offers VPS plans with one-click OpenVPN, NVMe storage and a 14-day free trial.
To force a full-tunnel connection, make the VPN own the default IPv4 route (0.0.0.0/0) and, when IPv6 is active, the default IPv6 route (::/0), send DNS queries to the VPN resolver, and use a correctly scoped kill switch. The procedure below isolates route, DNS, IPv6, and firewall problems without telling you to disable security controls blindly.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What “connected” actually tells you
A VPN connection has several separate parts: authentication, tunnel encryption, routing, name resolution, and leak protection. The status indicator normally reports only the first two. A client can encrypt its control session while the operating system continues to send selected destinations through the physical adapter.
Microsoft describes the distinction this way: in a split-tunnel configuration, specified routes use the VPN and all other traffic uses the physical interface; in a force-tunnel configuration, all traffic is sent through the VPN. Split tunneling is intentional when you need local printers, corporate resources, or lower latency for selected applications. It is a misconfiguration when you expect your public address, DNS, and every connection to be protected but exclusions remain enabled.
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Start with a five-minute diagnosis
- Write down the expected policy. Decide whether you need a full tunnel, a split tunnel with specific exclusions, or access to both a VPN network and your local LAN. You cannot judge a bypass until you know which destinations are supposed to be excluded.
- Check your public addresses. Record the public IPv4 address, then check IPv6 separately. An unchanged IPv4 address indicates an IPv4 route or policy problem; an address supplied by your normal ISP over IPv6 indicates an IPv6 bypass.
- Identify the DNS resolver. A website can load through the tunnel while DNS queries still go to your home router or ISP. Test the resolver path independently of the web connection.
- Inspect the route table. On Windows, open Command Prompt and run
route print. Look for the default route and the interface index associated with the VPN adapter. - Classify the failure. Test one public website, a known private resource reachable only through the VPN, DNS resolver identity, and a destination deliberately excluded by your split-tunnel policy. Record which category fails before changing settings.
This separation prevents a DNS leak from being mistaken for a routing failure, and prevents an intentionally excluded site from being treated as proof that the tunnel is broken.
Step 1: turn off unintended split tunneling
Windows VPN profiles
Open the VPN profile’s advanced routing or traffic settings and look for labels such as split tunneling, use VPN only for these routes, exclude destinations, or allow local network access. Microsoft’s Windows VPN documentation allows route lists to be assigned to a profile and distinguishes force-tunnel from split-tunnel behavior.
For a full tunnel, remove destination exclusions and select the option that sends all traffic through the VPN. If the profile is managed by an employer, the setting may be delivered by policy rather than exposed in the client; in that case, the administrator must change the profile’s routing rules.
Application and destination exclusions
Many clients implement split tunneling by application, destination IP range, or port. Review every exclusion list, not just a master switch. A browser, game, torrent client, virtual machine, or command-line tool may have its own bypass rule. If only one application shows your normal IP, compare its process or destination with the exclusion list before changing the entire profile.
When split tunneling is the right choice
Keep split tunneling when you deliberately need local printers, NAS devices, video-conference media paths, or a service that rejects VPN addresses. Document each excluded app or network, because a later “why is my traffic bypassing the VPN?” investigation depends on knowing what was intentional. A full tunnel is the safer default for public Wi-Fi and untrusted networks, but it can increase latency and prevent access to local resources unless the VPN policy allows them.
Step 2: verify the default routes
Windows route table
Run route print while disconnected and again while connected. In the connected state, the VPN interface should own the intended default route. A default route is represented by destination 0.0.0.0 and mask 0.0.0.0. If the physical adapter still has the preferred default route and the VPN has only narrow private-network routes, the profile is split tunneled even if the client says connected.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDo not delete routes at random. VPN clients often install more-specific routes, DNS host routes, and firewall rules that must remain consistent. Change the profile’s tunnel mode first, reconnect, and inspect the table again. Manual route edits can disappear on reconnect or leave traffic without a usable gateway.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
WireGuard AllowedIPs
WireGuard uses the peer’s AllowedIPs list both to select outbound routes and to validate inbound traffic. A full IPv4 tunnel normally includes 0.0.0.0/0. If IPv6 is enabled, include ::/0 as well. Narrow entries such as a private subnet create a split tunnel by design.
On WireGuard for Windows, a peer with a default AllowedIPs route can activate kill-switch firewall rules that block traffic outside the tunnel. That behavior is useful only when the endpoint, DNS configuration, and exclusions are correct. If you add a default route but the tunnel cannot handshake, check the endpoint, keys, and DNS reachability rather than disabling the firewall.
Policy routing and virtual adapters
Virtual machines, containers, security software, and multiple VPN clients can install competing routes. Check which interface owns the default route and whether a more-specific route sends a destination elsewhere. A private route can legitimately outrank the default VPN route; the question is whether that exception is intended.
Free tools Windows power users keep installed
One-click scans. No signup required.
Step 3: test DNS independently
DNS is a separate path from the web connection. Your browser may reach a site through the VPN while the operating system asks your local router, ISP, or another public resolver for the site’s address. That exposes the domains you look up and can cause region or policy mismatches.
Windows checks
Open Command Prompt and use netsh to inspect interface and DNS configuration. Confirm that the VPN adapter receives the expected DNS server and that the server is reachable through the VPN route. The exact output varies by Windows version and client, so compare the connected and disconnected states rather than relying on one label.
Flush cached answers after changing DNS, then test again. A cached response can make a corrected configuration appear unchanged for a while. If the VPN provides an internal hostname, resolve that name while connected; failure suggests that the DNS server or its route is wrong even if public websites work.
macOS checks
On macOS, use scutil to inspect the active DNS configuration and service order. The VPN resolver should be listed for the domains it is meant to handle, and queries should be reachable through the tunnel. A resolver shown in the system settings is not proof that every application uses it; browsers and security tools can implement their own DNS-over-HTTPS or DNS-over-TLS settings.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
WireGuard and multihomed Windows DNS
WireGuard’s Windows documentation notes that a multihomed system can send DNS queries through an unintended interface unless queries are constrained to the VPN DNS server. Set the DNS server supplied by the VPN and ensure the route to it is inside the tunnel. If your client offers a DNS leak-protection switch, enable it only after confirming that the VPN DNS address is reachable; an unreachable resolver can make all name lookups fail.
Browser encrypted DNS
Encrypted DNS inside a browser can bypass the operating system’s VPN DNS policy. For a controlled test, temporarily set the browser to follow the operating system resolver, reconnect the VPN, and repeat the DNS check. If the browser then behaves correctly, decide whether its encrypted-DNS provider is acceptable for your privacy policy or whether it should be disabled while the VPN is active.
Step 4: cover IPv6, not just IPv4
Many VPN profiles tunnel IPv4 while leaving native IPv6 enabled. Applications that prefer IPv6 can then connect directly through your ISP, producing an unchanged IPv6 address even though IPv4 appears protected.
Preferred fix: tunnel IPv6
Use a VPN profile that supports IPv6 and installs ::/0 for a full tunnel. In WireGuard, add ::/0 to AllowedIPs when the endpoint and DNS configuration support IPv6. Verify that the VPN service actually assigns IPv6 connectivity; adding a route to a tunnel that cannot carry IPv6 will create failed connections rather than protection.
Disabling IPv6 as a policy choice
You can disable IPv6 on an adapter only when that is an intentional, tested policy and your network and applications do not require it. Disabling it permanently can break modern services, local network discovery, or enterprise resources. If you use this workaround, record the change and retest after operating-system updates, adapter changes, and VPN-client upgrades.
Step 5: understand kill-switch behavior
A kill switch is a firewall policy intended to block internet traffic when the VPN is unavailable. It is not the same thing as a full tunnel: a client can have a kill switch and still intentionally exclude an application or network while connected.
Always-on and automatic modes
Some clients offer an always-on mode that blocks traffic until the VPN is established; others activate the block only after a connection drops. Read the client’s platform and protocol limitations. For example, Proton documents differences by operating system and protocol, while NordVPN documents an interaction in which split tunneling must be disabled for its kill switch to operate as expected.
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
Testing without creating a leak
With the VPN connected, note a known public destination. Then disconnect the VPN and try to reach it. A correctly functioning kill switch should block the connection until the VPN reconnects or the policy is disabled. If traffic continues, inspect firewall rules and excluded applications rather than turning off the firewall globally.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWireGuard for Windows can create restrictive firewall rules when a peer uses a default AllowedIPs route. If those rules prevent the tunnel handshake, confirm the endpoint, UDP access, and DNS settings, and use the client’s documented kill-switch controls instead of deleting firewall rules manually.
Step 6: reconnect after every routing change
Disconnect and reconnect the VPN after changing split-tunnel settings, routes, DNS, IPv6, or kill-switch options. OpenVPN’s troubleshooting documentation warns that pause, resume, and reconnect transitions—including movement between Wi-Fi and cellular data—can temporarily disengage the tunnel and allow direct traffic.
For mobile devices and laptops, test after sleep, wake, Wi-Fi roaming, Ethernet insertion, and switching networks. A configuration that works immediately after connection can fail when the operating system changes the active interface. If the client has an auto-connect on untrusted networks or block connections without VPN option, enable it only after confirming that it does not prevent access to required local services.
Step 7: retest by traffic category
| Test | What a full tunnel should show | If it fails |
|---|---|---|
| Public IPv4 address | An address associated with the VPN exit, not your ISP connection | Check the IPv4 default route, split-tunnel exclusions, and application-specific bypasses |
| Public IPv6 address | An address supplied through the VPN, or no IPv6 if you intentionally disabled it | Add ::/0 with a supported IPv6 tunnel or revisit the deliberate IPv6 policy |
| DNS resolver identity | The VPN’s resolver or the resolver required by your documented policy | Inspect netsh or scutil, browser encrypted DNS, and multihomed routing |
| Private VPN resource | Reachable through the tunnel | Check the private route, authentication, and VPN DNS; a public-IP change alone does not prove private-resource access |
| Intentionally excluded destination | Uses the physical interface in a split-tunnel policy | If it unexpectedly uses the VPN, remove the exclusion or correct its route precedence |
| After disconnecting | Blocked when a kill switch is enabled | Review kill-switch mode, excluded apps, and firewall state |
Run the same tests with the VPN disconnected and connected, and save the results with the time and network type. This makes intermittent failures after roaming or sleep easier to identify.
Common symptoms and the most likely cause
“My IP address is unchanged.”
First determine whether you checked IPv4 or IPv6. An unchanged IPv4 address usually means the VPN has no default IPv4 route, an exclusion matches the test application, or the client is connected only to a private network. An unchanged IPv6 address points to missing IPv6 tunneling even when IPv4 is correct.
“Websites work, but DNS tests show my ISP.”
The route may be correct while DNS remains on the physical interface. Check VPN DNS assignment, browser encrypted-DNS settings, and the Windows multihomed behavior documented for WireGuard.
Best Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
“Only one program bypasses the VPN.”
Look for per-application split tunneling, a proxy configured inside that program, or a separate virtual adapter. Compare the program’s destination and process with the client’s exclusion list.
“Everything stops when I enable the kill switch.”
The block may be working, while the tunnel cannot establish because its endpoint or DNS server is itself being blocked. Confirm endpoint reachability and the client’s documented exceptions. On Linux, Proton documents an interaction in which split tunneling must be disabled to use its kill switch.
“It leaks only after changing networks.”
Reconnect after every interface transition and test the pause, resume, and reconnect behavior. OpenVPN warns that these states can temporarily disengage the tunnel. An always-on or block-without-VPN policy can reduce the exposure window if it is compatible with your network.
How to force all traffic through a VPN
- Disable application and destination exclusions in the VPN client.
- Enable the client’s full-tunnel or force-tunnel mode.
- Verify a default IPv4 route through the VPN interface; in WireGuard, use
AllowedIPs = 0.0.0.0/0. - If IPv6 is in use and supported, add
AllowedIPs = ::/0and confirm the endpoint carries IPv6. - Set the VPN-provided DNS server and prevent local or browser-specific resolvers from bypassing the policy.
- Enable the client’s documented kill switch, understanding which applications or LAN routes it excludes.
- Disconnect and reconnect, then repeat IPv4, IPv6, DNS, private-resource, exclusion, and disconnect tests.
Do not force a default route by deleting unrelated system routes or disabling the operating-system firewall. Those shortcuts can cut off the VPN endpoint, expose traffic during reconnection, or break local and enterprise connectivity.
What to compare when changing VPN clients or services
If the current client cannot express the policy you need, compare capabilities rather than relying on its connection badge.
| Capability | Questions to ask |
|---|---|
| Full versus split tunnel | Can you switch modes, and can you see the exact route list? |
| Exclusions | Are bypasses defined by application, destination, port, or all three? |
| IPv4 and IPv6 | Does the client tunnel IPv6, install ::/0, or intentionally block IPv6? |
| DNS protection | Does it supply a VPN resolver, constrain queries to it, and account for browser encrypted DNS? |
| LAN access | Can local printers and devices remain reachable without sending internet traffic outside the tunnel? |
| Kill switch semantics | Does it block before connection, only after a drop, or allow excluded apps? Which platforms and protocols support it? |
| Roaming and sleep | What happens during Wi-Fi changes, cellular transitions, suspend, and resume? |
| Protocol support | Are the protocols you need available on your operating system, and do their routing and firewall behaviors differ? |
Private Internet Access documents desktop split tunneling with DNS controls; Proton documents platform and protocol limitations; NordVPN documents how split tunneling interacts with its kill switch. Treat those documented behaviors as product-specific rather than universal VPN rules.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
A maintenance checklist
- Keep a written record of intentional exclusions and local-network exceptions.
- After client or operating-system updates, verify the default routes and DNS servers again.
- Test both IPv4 and IPv6 whenever your ISP provides IPv6.
- Repeat checks after sleep, wake, Wi-Fi roaming, Ethernet changes, and cellular handoffs.
- Use a kill switch when exposure during a drop is unacceptable, but verify its platform and protocol limitations.
- Never treat a green status indicator, a single public-IP test, or a successful website load as proof that every traffic category is tunneled.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
