Gateway

Configuring Split Tunneling

January 8, 2024

Contributed by:

C S C

You can enable split tunneling to prevent the Citrix Gateway plug-in from sending unnecessary network traffic to Citrix Gateway.

When you do not enable split tunneling, the Citrix Gateway plug-in captures all network traffic originating from a user device and sends the traffic through the VPN tunnel to Citrix Gateway.

If you enable split tunneling, the Citrix Gateway plug-in sends only traffic destined for networks protected by Citrix Gateway through the VPN tunnel. The Citrix Gateway plug-in does not send network traffic destined for unprotected networks to Citrix Gateway.

When the Citrix Gateway plug-in starts, it obtains the list of intranet applications from Citrix Gateway. The Citrix Gateway plug-in examines all packets transmitted on the network from the user device and compares the addresses within the packets to the list of intranet applications. If the destination address in the packet is within one of the intranet applications, the Citrix Gateway plug-in sends the packet through the VPN tunnel to Citrix Gateway. If the destination address is not in a defined intranet application, the packet is not encrypted and the user device routes the packet appropriately. When you enable split tunneling, intranet applications define the network traffic that is intercepted.

Note: If users connect to published applications in a server farm by using Citrix Receiver, you do not need to configure split tunneling.

Citrix Gateway also supports reverse split tunneling, which defines the network traffic that Citrix Gateway does not intercept. If you set split tunneling to reverse, intranet applications define the network traffic that Citrix Gateway does not intercept. When you enable reverse split tunneling, all network traffic directed to internal IP addresses bypasses the VPN tunnel, while other traffic goes through Citrix Gateway. Reverse split tunneling can be used to log all non-local LAN traffic. For example, if users have a home wireless network and are logged on with the Citrix Gateway plug-in, Citrix Gateway does not intercept network traffic destined to a printer or another device within the wireless network.

For more information about intranet applications, see Configuring Client Interception.

You configure split tunneling as part of the session policy.

To configure split tunneling

In the configuration utility, on the Configuration tab, in the navigation pane, expand Citrix Gateway Policies and then click Session.
In the details pane, on the Profiles tab, select a profile and then click Open.
On the Client Experience tab, next to Split Tunnel, select Global Override, select an option and then click OK twice.

Configuring Split Tunneling and Authorization

When planning your Citrix Gateway deployment, it is important to consider split tunneling and the default authorization action and authorization policies.

For example, you have an authorization policy that allows access to a network resource. You have split tunneling set to ON and you do not configure intranet applications to send network traffic through Citrix Gateway. When Citrix Gateway has this type of configuration, access to the resource is allowed, but users cannot access the resource.

If the authorization policy denies access to a network resource, you have split tunneling set to ON, and intranet applications are configured to route network traffic through Citrix Gateway, the Citrix Gateway plug-in sends traffic to Citrix Gateway, but access to the resource is denied.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Configuring Split Tunneling

January 8, 2024

Contributed by:

C S C

January 8, 2024

Contributed by:

C S C

Configuring Split Tunneling

To configure split tunneling

Configuring Split Tunneling and Authorization

In this article