{"id":343,"date":"2026-04-23T15:07:19","date_gmt":"2026-04-23T12:07:19","guid":{"rendered":"https:\/\/mangen.kitabara.org\/?p=343"},"modified":"2026-04-23T15:16:23","modified_gmt":"2026-04-23T12:16:23","slug":"how-to-configure-firebox-ikev2-mobilevpn-to-do-both-full-tunnel-and-split-tunnel","status":"publish","type":"post","link":"https:\/\/mangen.kitabara.org\/index.php\/how-to-configure-firebox-ikev2-mobilevpn-to-do-both-full-tunnel-and-split-tunnel\/","title":{"rendered":"How to configure Firebox IKEv2 mobilevpn to do both Full tunnel and Split tunnel."},"content":{"rendered":"\n

The Firebox doesn\u2019t control<\/strong> whether the IKEv2 VPN runs in Full<\/strong> or Split tunnel mode<\/strong>. Each Windows workstation<\/strong> decides that locally, and you can even have both modes configured<\/strong> on the same machine.<\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
<\/div>\n\n\n\n

By default, Windows IKEv2 connections use a Full tunnel<\/strong>, but you can switch to Split tunnel<\/strong> manually with PowerShell commands.<\/p>\n\n\n\n

On the Windows workstation<\/strong><\/h2>\n\n\n\n

To enable Split tunneling manually for your IKEv2 VPN connection:
– Set-VpnConnection “WG IKEv2” -SplitTunneling $true<\/strong>
– Add-VpnConnectionRoute “WG IKEv2” 192.168.10.0\/24<\/strong><\/p>\n\n\n\n

You can check the current tunnel mode with: Get-VpnConnection<\/strong>
If SplitTunneling<\/strong> shows True, the connection is in Split mode; if False, it\u2019s Full tunnel.<\/p>\n\n\n\n

\"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
<\/div>\n\n\n\n

On the Firebox<\/strong><\/h2>\n\n\n\n

Starting with Firebox v12.9<\/strong>, you can enable Split tunnel configuration in the Firebox IKEv2 setup. When you download the IKEv2 config from the Firebox it automatically includes the -SplitTunneling option and route definitions like: -DestinationPrefix ‘192.168.110.0\/24’<\/p>\n\n\n\n

Using both Full and Split tunnels<\/strong><\/p>\n\n\n\n

If you need both connection types:<\/p>\n\n\n\n

    \n
  1. Configure the Firebox for Split tunnel<\/strong> first and download the IKEv2 Split configuration.<\/li>\n\n\n\n
  2. Then switch the Firebox to Full tunnel<\/strong> mode and download the IKEv2 Full configuration.<\/li>\n<\/ol>\n\n\n\n
    \n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n\n\n
    \"\"\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n<\/figure>\n\n\n\n
    <\/div>\n\n\n\n

    The Firebox must have Full tunnel mode<\/strong> enabled so that Full tunnel IKEv2 clients can connect out the internet through the Firebox, but workstations can use either Full or Split configurations.<\/p>\n\n\n\n

    Advanced option<\/strong><\/h2>\n\n\n\n

    If you\u2019re comfortable editing scripts, you can freely modify the PowerShell file (AddVPN.ps1<\/strong>) created by the Firebox to customize routes or tunnel behavior.
    Check Microsoft VpnClient Modules and commands<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    The Firebox doesn\u2019t control whether the IKEv2 VPN runs in Full or Split tunnel mode. Each Windows workstation decides that locally, and you can even have both modes configured on the same machine. By default, Windows IKEv2 connections use a Full tunnel, but you can switch to Split tunnel manually with PowerShell commands. On the…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,4,2],"tags":[],"class_list":["post-343","post","type-post","status-publish","format-standard","hentry","category-ikev2","category-vpn","category-watchguard"],"_links":{"self":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/343","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/comments?post=343"}],"version-history":[{"count":6,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/343\/revisions"}],"predecessor-version":[{"id":354,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/posts\/343\/revisions\/354"}],"wp:attachment":[{"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/media?parent=343"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/categories?post=343"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mangen.kitabara.org\/index.php\/wp-json\/wp\/v2\/tags?post=343"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}