Split or Full Tunnel: What Your Employer Still Records

The question arrives as one question, and it needs two answers. A tunnel changes where your packets travel, while the client changes what runs on the machine, and conflating them produces either false reassurance or unnecessary alarm. Separate the two and the rest of the answer follows from facts you can check.

The traffic half is decided by the route the profile installs. The machine half is decided by what the client does and what your own computer publishes on the network.

One Question Hides Two

A full tunnel installs a default route through the company gateway, so public requests leave from there and the gateway, its proxy and its resolver can record destinations, times and volumes. A split tunnel installs only selected routes, so ordinary browsing leaves through your own connection and your provider sees it instead. Neither arrangement is about encryption strength: HTTPS protects content in both cases and reveals the destination in both cases. The distinction is routing, and routing is visible on the machine itself.

The client can also install a driver that inspects packets, run a health check before it allows a connection, and report what software is present. Those are capabilities of the software rather than of the tunnel, and they apply under either routing mode.

What the Gateway and Proxy Keep

With the default route pointing into the tunnel, expect the corporate resolver and any web proxy to hold a record of the destinations you contacted. A proxy additionally logs the request line of an unencrypted HTTP request and the CONNECT destination used for HTTPS, which is a richer record than a flow log. Content inside HTTPS stays unreadable unless the organisation installed its own trusted certificate on the machine, which is a separate and visible change. Flow metadata alone is enough to establish when you were working and which services you used.

With a split tunnel those public destinations leave through your own link, so the company record covers internal names and corporate destinations instead of everything. That is a smaller record, and still not an empty one. Any claim that a split tunnel means the employer sees nothing is simply wrong.

DNS Sees Names the Tunnel May Not Carry

Name resolution is its own path, and a profile that pushes the corporate resolver sends lookups there even when the connection exits locally. The resolver records the names you asked for, which is often more informative than the addresses you reached. Split DNS confines that to internal domains, and a browser with its own encrypted resolver can bypass the arrangement entirely. Three components can answer a lookup, and only one of them belongs to the company.

Test the resolution path separately from the routing path. A lookup going to the corporate resolver while the connection leaves locally is a split configuration working as designed, and it still discloses names.

Check the Route and the Shares

Two facts decide what you are actually exposing, and both are visible on the machine. The commands below show the default routes with the tunnel up, the name resolution path, and the shares this computer publishes. Run them before connecting, then again while connected.

Get-NetRoute -DestinationPrefix 0.0.0.0/0
Resolve-DnsName corp.example.com -Type A
Get-SmbShare
Get-NetFirewallProfile -Name Public | Select-Object Name, Enabled

A default route naming the tunnel adapter means the company carries your public traffic, and a default naming your own adapter means it does not. A share listed by the third command is reachable from the corporate network while the tunnel is up, even when the ordinary hostname does not resolve, and guest access makes it reachable without an account. The firewall profile matters because a tunnel adapter can be classified as public, which decides whether file sharing is permitted at all. Read the four together and the boundary is described rather than guessed.

Choose the arrangement from that boundary: a direct connection gives the employer's tooling the most reach, a company device keeps work monitoring away from your files, and a virtual machine isolates the installation without changing where the traffic exits. Record which route and which shares you accepted.