Why All Internet Traffic Goes Through SSL VPN Despite Split Tunneling Enabled
An administrator has configured an SSL VPN with tunnel mode and split tunneling enabled. However, remote users report that all internet traffic is going through the VPN tunnel. What is the MOST likely cause?
Quick Answer
The answer is that the client’s routing table is set to route all traffic through the VPN. When split tunneling is enabled on the FortiGate, it should only forward traffic destined for specific subnets—such as the corporate network—through the SSL VPN tunnel, while allowing other internet-bound traffic to go directly. However, if the client’s routing table contains a default route (0.0.0.0/0) pointing to the VPN interface, every packet is forced into the tunnel, effectively overriding the split tunneling configuration. On the Fortinet NSE 4 exam, this scenario tests your understanding of how the client-side routing table interacts with server-side split tunneling settings; a common trap is assuming the issue lies solely on the FortiGate policy. Remember that split tunneling is a two-sided configuration: the VPN gateway defines the allowed subnets, but the client must also apply those routes correctly. Memory tip: “Default route defeats split tunnel”—if you see 0.0.0.0/0 on the client, split tunneling is not working.
⚠ Common exam trap
A common mix-up: candidates assume the portal's split-tunneling setting is the sole control, but the client-side configuration can override it, making option B seem correct when the real issue is the client's routing table.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The client's routing table is set to route all traffic through the VPN
When split tunneling is enabled on the FortiGate SSL VPN portal, the FortiClient VPN software should only route traffic destined for the corporate network through the tunnel. If remote users report that all internet traffic is going through the VPN tunnel, the most likely cause is that the client's routing table has been configured to route all traffic (0.0.0.0/0) through the virtual adapter, overriding the split-tunneling rules. This can happen if the client is set to 'Route all traffic through VPN' in its settings, which forces a default route into the VPN interface regardless of the portal configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy allows traffic to the internet
Why it's wrong here
That would not force traffic through the tunnel.
- ✗
The SSL VPN portal has 'split tunneling' disabled
Why it's wrong here
The administrator enabled it, so it's likely enabled.
- ✓
The client's routing table is set to route all traffic through the VPN
Why this is correct
Even with split tunneling enabled on the portal, if the client pushes a route for 0.0.0.0/0, all traffic goes through the tunnel.
- ✗
The user has installed a root certificate
Why it's wrong here
Certificates don't affect routing.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator configures an SSL VPN portal with web mode and split tunneling enabled. Remote users can access internal web applications but cannot reach the internet through the VPN. What needs to be checked?
medium- A.The remote user's browser does not support SSL VPN.
- ✓ B.The firewall policy allowing internet traffic from the SSL VPN interface is missing or incorrect.
- C.The split tunneling setting is disabled.
- D.The SSL VPN portal is configured in web mode only; tunnel mode is required for internet access.
Why B: In web mode, the FortiGate proxies web requests. Internal web applications work because a firewall policy permits that traffic. Internet traffic from the SSL VPN web proxy must also be allowed by a firewall policy from the SSL VPN interface to the internet; if that policy is missing or incorrect, the FortiGate drops the requests. Split tunneling is a tunnel-mode feature and does not apply to web mode.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.