Not Every Packet Needs a Bodyguard: A Practical Split Tunneling Playbook for Accounting Workstations

There's a school of thought in small-firm IT that says every packet on an accounting workstation should travel through the VPN, no exceptions. It sounds rigorous. In practice, it produces machines that crawl through cloud backups, time out on video calls, and frustrate staff into finding workarounds — the exact behavior that creates real security gaps.

Split tunneling offers a more honest architecture: route the sensitive through the tunnel, let the trivial go direct. The trick is knowing which is which.

The Two Buckets

Start by sorting your applications into two categories.

Always tunnel:

• Payroll portals (ADP, Gusto, Paylocity) — these carry SSNs, bank routing numbers, and compensation data
• Banking and treasury dashboards, including client fiduciary accounts
• Tax preparation and e-filing software exchanging taxpayer PII
• Client document portals and secure file transfer tools
• Remote desktop sessions into client environments

Safe to bypass (on a trusted network):

• General web browsing and research — yes, including Wikipedia
• Video conferencing and VoIP, where VPN overhead degrades call quality
• Cloud storage sync for non-client files, if your DLP policies permit
• OS updates and software downloads, which benefit from direct bandwidth

The dividing line is simple: if the traffic contains client-identifiable or financial data, it gets the tunnel. If it doesn't, forcing it through encryption adds latency without adding protection.

Configuration Walkthroughs

NordLayer (business tiers): Navigate to the admin panel, select Split Tunneling, and add applications by executable path. Add QuickBooks, your tax suite, and browsers used exclusively for banking. Set them to Tunnel only these apps mode for maximum containment.

Perimeter 81 (now Check Point): Under Network > Policies, create an app-based policy. Assign your payroll and banking executables to the private gateway; leave everything else on the default route. Enable Auto-connect by application so staff can't forget.

Tailscale: Use ACL tags to route only subnet ranges containing client resources through the tailnet. Everything public flows normally. This identity-based model is arguably the cleanest fit for firms with defined client servers.

Proton VPN (Windows): Settings > Features > Split Tunneling. Toggle Apps to exclude — add Teams, Zoom, and your backup client. Everything else, including your browser, rides the tunnel by default.

Cisco AnyConnect (legacy enterprise): The Local LAN Access and dynamic split-include policies set by your administrator determine which destinations route through the corporate gateway. Ask your MSP for the split-include list; if it's empty, you're running full-tunnel and paying for it in throughput.

Test every configuration by visiting an IP-lookup site inside and outside a tunneled application. If your payroll portal's browser session shows your home ISP and your tax software shows the VPN gateway, the policy is working.

The Opinion: Kill-Switch Everything Is Costing You Billable Hours

Here's where we'll part ways with the maximalists. Many business VPNs ship with an always-on kill switch that severs all connectivity the moment the tunnel drops. For a workstation handling taxpayer data mid-e-filing, that's correct behavior. For the same policy applied to a machine answering email and joining Zoom calls, it's a self-inflicted outage.

We've spoken with firm administrators who estimate losing 30 to 60 minutes per staff member per busy season to kill-switch freezes — dropped tunnels during ISP maintenance, stalled reconnects, staff rebooting rather than waiting. Multiply that across a ten-person firm at $250 an hour and the math becomes uncomfortable.

The defensible position is application-scoped enforcement: a kill switch that protects the tunneled applications only, while general connectivity survives. NordLayer and Perimeter 81 both support this granularity. If your current provider can't distinguish between the payroll portal and a podcast stream, that's a selection criterion worth revisiting before next filing season.

A Closing Checklist

1. Inventory the applications that touch client or financial data.
2. Configure app-based split tunneling on every workstation — not per-user judgment.
3. Scope your kill switch to tunneled apps, not the whole machine.
4. Document the routing map so your next peer review or cyber insurance questionnaire has an answer ready.

Precision beats paranoia. Guard the data that needs guarding, and let the rest of the internet move at full speed.