In short: VPN routing is the set of rules your operating system uses to decide which traffic goes into the encrypted tunnel and which goes straight to the internet. When you turn on a VPN, the client creates a virtual network adapter and rewrites the routing table: it usually adds a default route (0.0.0.0/0) through the tunnel, so all traffic flows to the VPN server. How routing is set up determines what is actually protected and what can "leak" around the tunnel. Below we explain how it works in plain terms, how a full tunnel differs from a split tunnel, and why routing causes leaks.
What VPN routing is in plain terms
VPN routing is the set of rules a device uses to choose a path for every network packet: send it into the encrypted VPN tunnel or let it go directly over the ordinary connection. Put simply, routing answers the question "where exactly will this traffic go" before it even leaves your device.
Think of a junction with road signs. Every data packet pulls up to the junction, and the routing table is the set of signs telling it which road to take. Without a VPN, every sign points to your internet provider. When the VPN comes up, a new sign appears that directs traffic into the tunnel. How the tunnel and encryption themselves work is covered in our article on how a VPN works.
It's important not to confuse routing with the protocol. The protocol (WireGuard, OpenVPN, IKEv2) governs how data is encrypted and transmitted, while routing governs which data enters the tunnel at all. These are two separate layers, configured independently of each other.
How the routing table works without a VPN
Without a VPN, a device sends all traffic through a single default gateway — usually your home router or your carrier's base station. The routing table handles this: a list of rules in the operating system that says, for each range of IP addresses, which gateway and which network interface to send packets through.
The key entry in this table is the default route, written as 0.0.0.0/0. It means "anything with no more specific rule, send here." On an ordinary home network this route leads to the router and then to the provider. That's exactly why your provider sees the addresses of every site you open: all traffic passes through it.
There are also more specific routes — for the local network, say (printers and other devices at home). The system always picks the most specific rule: if there's a narrow route for an address, it's used, and 0.0.0.0/0 only kicks in as a fallback.
What changes in routing when you turn on a VPN
When you connect a VPN, the client creates a virtual network adapter and rewrites the routing table so traffic goes into the tunnel. This usually happens in steps:
- A virtual adapter is created. The VPN client brings up a virtual interface (called TUN or TAP) and assigns it an internal IP address from the VPN server's network.
- The default route changes. The client adds a new
0.0.0.0/0route through the virtual adapter with a higher priority than the ordinary one. Now all traffic goes into the tunnel "by default." - An exception is added for the server itself. So encrypted packets can physically reach the VPN server, a separate route to its real IP is added through the ordinary interface — otherwise you'd get a loop.
- DNS is redirected. A properly configured client also sends DNS queries into the tunnel, so the provider can't see which domains you request.
After that, an app opens a site — the packet reaches the virtual adapter, is encrypted, and travels to the VPN server, which forwards it to the internet under its own name. To the site, the request appears to come from the server's address, not yours. What the client handles automatically and what you set by hand depends on the VPN configuration.
Full tunnel or split routing: what's the difference
There are two main routing modes: a full tunnel, where all traffic goes into the VPN, and split tunneling, where only part goes through the tunnel and the rest goes directly. Choosing the mode is precisely a routing setting.
| Parameter | Full tunnel | Split routing |
|---|---|---|
| What goes into the VPN | All device traffic | Only selected apps or sites |
| Privacy | Maximum — provider can't see addresses | Partial — some traffic goes in the open |
| Speed for the rest | Everything via the server, extra latency possible | Local services run directly, faster |
| Leak risk | Lower when configured correctly | Higher — easy to route sensitive traffic around the tunnel by accident |
A full tunnel is the default choice for privacy and protection on public networks: nothing leaves in the clear, bypassing encryption. Split routing is handy when you want only the browser in the tunnel, say, while leaving a local printer or a banking app on the direct connection. A detailed per-app walkthrough is in our separate article on split tunneling.
Routing in a site-to-site VPN: linking networks and offices
In corporate site-to-site VPNs, routing solves a harder task — linking two whole networks rather than one device to a server. Here two gateways (the routers of two offices, for example) bring up a permanent tunnel between them, and routing decides which subnets are reachable through it.
On each gateway, routes to the remote network are written: "to reach office B's subnet (say, 10.0.2.0/24), send packets into the tunnel." Routes can be static (set manually by an administrator) or dynamic (gateways exchange them automatically over routing protocols). To staff it looks as if both offices are one shared network. How VPNs are used for secure team access is covered in our guide on VPNs for remote work.
Why routing matters for privacy and where leaks come from
Routing mistakes are the main reason some traffic goes around the VPN even when it's "on." If a routing rule is written incorrectly, packets go directly instead of into the tunnel, and protection only works partway. The most common scenarios:
- DNS leak. Traffic is encrypted, but DNS queries (turning a site's name into an IP) go to the provider around the tunnel, so it sees the list of domains you open. How to check and close this is in our article on the DNS leak.
- Tunnel drop. If the VPN goes down for a second and the default route falls back to the ordinary interface, traffic flows in the open. The Kill Switch feature guards against this by blocking the network when the tunnel fails.
- Wrong split routing. In split-tunnel mode it's easy to leave a sensitive app outside the tunnel by accident and not notice.
- IPv6 bypass. If the client only wrapped the IPv4 route while the provider also hands out IPv6, some traffic can leak over the unwrapped protocol.
The takeaway: the reliability of protection depends not only on encryption but on correct routing. That's why a good client handles routing itself and adds safeguards. For example, the LiMP VPN apps for iOS and Android set up routes automatically and keep no logs; plans are on the LiMP VPN pricing page.
How to check and fix VPN routing
You can verify routing is working in a few minutes: essentially, you need to confirm that all traffic really goes through the tunnel. The order of steps is:
- Check your IP address. Open any IP-checking service — it should show the VPN server's address, not your real one.
- Run a DNS leak test. Make sure the DNS servers belong to the VPN, not your provider.
- Check IPv6. If a service shows your real IPv6 address, turn on IPv6-leak protection in the client or disable IPv6 in the system.
- Enable the Kill Switch. Turn on network blocking when the tunnel drops, so traffic doesn't leak during reconnects.
- Review split routing. If you use a split tunnel, leave outside the tunnel only the apps that genuinely don't need protection.
If your real IP is visible after the check, the default route hasn't switched to the tunnel; reconnecting, changing the protocol, or contacting the service's support usually helps. The full verification method is in our article on how to check that your VPN is working.
Frequently asked questions
What is VPN routing in plain terms?
VPN routing is the set of rules a device uses to decide which traffic to send into the encrypted tunnel and which to send directly. When the VPN is on, the default route (0.0.0.0/0) switches to the tunnel's virtual adapter, so all traffic goes to the VPN server rather than straight to the provider.
How does routing differ from the VPN protocol?
The protocol (WireGuard, OpenVPN, IKEv2) defines how data is encrypted and transmitted, while routing defines which data enters the tunnel at all. They are different layers: you can change the protocol without changing routing rules, and vice versa.
What is a routing table?
It's a list of rules in the operating system that says, for each range of IP addresses, which gateway and interface to send packets through. The main entry is the default route, 0.0.0.0/0; when a VPN turns on, the client rewrites it to point at the tunnel.
Does all traffic go through the VPN?
It depends on the routing mode. In full-tunnel mode all device traffic goes through the VPN. In split-tunneling mode only selected apps or sites do, while the rest is sent directly to the internet.
Why does traffic leak around the VPN?
Usually because of routing mistakes: a DNS leak, a tunnel drop with no Kill Switch, unwrapped IPv6, or misconfigured split routing. You can check this with IP and DNS tests; a reliable client sets up routes and leak protection automatically.