Same server, same tunnel, two completely different behaviours — decided by a single line in the client config. Full tunnel sends everything through the office; split tunnel sends only office traffic. Here is what each really costs and buys.
Beginners often ask which mode is "correct". Neither is. AllowedIPs is a routing decision, and routing decisions are answers to questions about trust and speed. This page walks both modes with the exact config difference shown above, so you can set the tunnels from the video up the way your office actually works.
Example configurations with fake placeholder keys. The only real difference between the two setups is the AllowedIPs line.
In the client config, the AllowedIPs line under [Peer] is the routing order for the whole tunnel. It lists which destination networks get sent into the VPN. Everything else travels the normal way. WireGuard itself does not care which style you pick — the config the firewall generates can be adjusted in the client, and the right choice depends on the job, not on habit.
With 0.0.0.0/0, every connection the device makes — office servers, websites, updates, everything — travels through the tunnel to the office and out from there.
With something like AllowedIPs = 10.10.10.0/24, 192.168.1.0/24 (the tunnel network plus your office LAN), only office-bound traffic enters the VPN. Websites and streaming go directly over the local connection.
Ask one question: what is this tunnel for? Reaching office systems from a trusted home network → split tunnel, and enjoy the speed. Working from hotels, airports and client sites → full tunnel, and accept the speed cost. Company-owned laptops that should never browse unprotected → full tunnel, enforced by policy. Phones usually live happily with split tunnel, because their sensitive traffic is inside office apps anyway. Neither setting is "more secure" in the abstract — they protect different things, and picking knowingly is the whole game.
See the tunnel configuration created in the full setup video, then set its mode with this guide open beside you.
▶️ Watch Full VideoSlower, almost always. Your traffic takes a detour: device to office, office to internet, and back. The ceiling is the office connection's upload speed, which on most broadband lines is far lower than the download speed you are used to.
Yes — edit the AllowedIPs line in the client config and reconnect. The server does not need any change. On the Untangle setup you can adjust the generated config in the WireGuard client after importing it.
Split tunnel is the practical default: office apps and files flow through the VPN, personal browsing stays direct and fast. Use full tunnel on phones only when company policy genuinely requires all traffic to pass the office firewall.