It is one checkbox in a group setting, and it quietly decides where every byte from a remote laptop travels. Here is what Full Tunnel and split tunnel really change in Untangle, what each one costs, and the office-by-office way to choose.
In the video, enabling Full Tunnel is the fix that makes a freshly connected client finally behave. That makes it tempting to treat Full Tunnel as simply "the correct setting". It is not — it is a routing decision with a benefit side and a bill side, and Untangle lets you decide it per group of users at Apps → OpenVPN → Server → Groups. This page gives you both sides honestly so the choice is deliberate, not accidental.
With split tunnel, only traffic meant for the office networks travels through the VPN. The user's YouTube, personal browsing and everything else leaves through their home connection as usual. With Full Tunnel, all of the laptop's traffic — office and internet alike — is pushed through the tunnel and out of the office's internet connection.
Nothing about identity changes between the two: the same certificate logs the same user in. What changes is routing, and, if you enable it, DNS — Push DNS makes the client ask the firewall (or a custom server you name) to resolve names, which is what makes office hostnames work from home in either mode.
Split tunnel is the kind default for most small offices. The office internet line — often the weakest link in the whole system — carries only office work, not a houseful of family streaming competing with it. Remote users keep their normal internet speed, the firewall's filtering and reporting stay focused on office resources, and if the office connection is modest, this is the difference between a VPN people tolerate and one they quietly stop using. Its weakness is real too: the laptop's general internet traffic gets no protection or filtering from the office firewall while it works.
Full Tunnel earns its keep in stricter setups. All traffic exits from the office, so the firewall's web filtering, threat apps and logs see everything the laptop does; the laptop appears to outside services with the office's public IP, which matters if a bank portal or a government site is allow-listed to that address; and a user on café Wi-Fi is wrapped in the tunnel end to end. The bill: every byte hairpins through your office uplink twice (in and out), so a slow office connection becomes everyone's slow connection, and the office line's failures become remote-work failures. And as the video shows, Full Tunnel is also the setting that makes some clients pick up proper addressing and DNS behaviour when a plain connection misbehaves.
Tunnel behaviour is baked into the config file at download time. Change the group a client belongs to, or edit the group's Full Tunnel or DNS settings, and existing laptops keep behaving the old way until they import a freshly downloaded config. Arista's documentation states this plainly, and the video demonstrates it live: enable Full Tunnel, re-download the updated config file, reconnect, and only then does the client pick up the new behaviour. If a setting change ever "does nothing", this is why — nine times out of ten the laptop is still running yesterday's file.
You do not have to pick one mode for the whole company. Create two groups: a split-tunnel group for most staff, who need files, Tally or a printer and nothing more; and a full-tunnel group for the owner, the accountant, or anyone who touches allow-listed services or works from untrusted networks. Turn Push DNS on for both — office names resolving correctly prevents more confusion than any other single setting. Then revisit the choice when something changes: a faster office line, a compliance demand, a new branch. It is a group edit and a config re-send away, not a rebuild.
See the group setting changed and the config re-downloaded live in the video — that sequence is the heart of this topic.
▶️ Watch Full VideoYes. Tunnel mode is a group setting under Apps, OpenVPN, Server, Groups. Put each client in the group that matches their job — split tunnel for most staff, full tunnel for the few who need central filtering or the office IP address.
It changes routing, not identity. The same per-user certificate still decides who gets in. Full Tunnel does add central filtering and logging of the user's internet traffic, which some offices want — but it does not fix weak habits like shared profiles or lost config files.
The laptop is still using the config file downloaded before the change. Tunnel settings are written into that file, so download a fresh config from the Remote Clients list, import it in place of the old one, and reconnect.