---
title: About Tunnel Bypass
canonical: https://openvpn.net/cloud-docs/owner/access/access---internet/about-tunnel-bypass/
product: CloudConnexa Docs
description: Learn how Tunnel Bypass in CloudConnexa allows administrators to define destinations that bypass the secure tunnel and route traffic locally for specific User Groups.
---

# About Tunnel Bypass

**Tunnel Bypass** allows administrators to maintain a secure-by-default approach for a user group by routing all internet traffic through CloudConnexa, while selectively routing traffic to specific destinations directly to the local network gateway.

This is useful for destinations that don't require secure tunneling, such as locally accessible intranet resources, on-premises systems, or performance-sensitive services that benefit from direct routing.

The tunnel bypass feature is configured at a user group level. Different user groups can have different tunnel bypass configurations based on their roles, risk profiles, and access needs.

> **Note**
>
> Tunnel Bypass is only available when a User Group's **Internet Access** is set to **Split Tunnel Off** or **Restricted Internet**. It's not available for User Groups with Split Tunnel On.

## Supported internet access modes

| **Internet access setting** | **Tunnel Bypass available?** |
| --- | --- |
| Split Tunnel On (Level-1) | No |
| Split Tunnel Off (Level-2) | Yes |
| Restricted Internet (Level-3) | Yes |

## Constraints

- Destinations within a user group need to be unique and non-overlapping with each other.
- Destinations can't conflict with existing routing ranges configured in your WPC, including [WPC subnets](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-tunnel-ip-addresses.md), [domain routing subnets](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-the-ip-subnet-range-from-which-to-assign-domain-routing-ip-addresses.md), [IP service subnets](https://openvpn.net/cloud-docs/owner/networks/networks---ip-services/add-an-ip-service-to-a-network.md), and [network routes](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/enable-configuring-routes-for-networks.md).
- Application routing takes precedence over Tunnel Bypass. Traffic to domains configured as Applications is always routed through the CloudConnexa tunnel, even if the resolved destination matches a Tunnel Bypass destination.

## Configure tunnel bypass subnets for a user group

To add, edit, or remove tunnel bypass subnets for a user group:

1. Sign in to the CloudConnexa Administration Portal using your WPC's **Cloud ID** address (for example, `yourcompany.openvpn.com`).
2. Navigate to **Access → Internet**.
3. Locate the target user group.
4. In the **Internet Access** column, click **Manage Exclusions**.
   - If **Tunnel Bypass Unavailable** displays for the User Group, edit the group to use an **Internet Access** setting that supports the feature: **Split Tunnel Off**, or **Restricted Internet**. Refer to [Change Internet Access](https://openvpn.net/cloud-docs/owner/access/access---internet/change-internet-access-for-user-groups-networks-and-hosts.md).

     > **Note**
     >
     > Tunnel Bypass isn't available with Split Tunnel On because only explicitly configured destinations are routed through CloudConnexa in that mode. All other traffic already routes via the local gateway by default.
5. In the Tunnel Bypass configuration panel, enter destinations in CIDR format, one per line, in the **IPv4 Subnets** field.
6. Optionally, paste a comma-separated or space-separated list. The entries are automatically parsed and sorted.
7. Click **Update Tunnel Bypass** to save your changes.

## Related documents

- [About Internet Access Configuration](https://openvpn.net/cloud-docs/owner/access/access---internet/about-internet-access-configuration.md)
- [Change internet access for User Groups, Networks, and Hosts](https://openvpn.net/cloud-docs/owner/access/access---internet/change-internet-access-for-user-groups-networks-and-hosts.md)
- [Set IP Allocation Versions](https://openvpn.net/cloud-docs/owner/settings/settings---wpc/set-ip-allocation-versions.md)
- [About User Groups](https://openvpn.net/cloud-docs/owner/users/users---groups/about-user-groups.md)
- [Tutorial: Learn About the Levels of Security Afforded by the Use of Various Internet Access Options](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--learn-about-the-levels-of-security-afforded-by-the-use-of-various-internet-access-options.md)
- [Tutorial: Secure All Internet Traffic by Configuring a Private Network as an Internet Gateway](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--secure-all-internet-traffic-by-configuring-a-private-network-as-an-internet-gateway.md)
- [Tutorial: Block All Internet Traffic Except To Trusted Internet Destinations](https://openvpn.net/cloud-docs/tutorials/use-case-tutorials/internet-security/tutorial--block-all-internet-traffic-except-to-trusted-internet-destinations.md)

---

Prev: [About Internet Access](https://openvpn.net/cloud-docs/owner/access/access---internet/about-internet-access-configuration.md)
Next: [Change Internet Access](https://openvpn.net/cloud-docs/owner/access/access---internet/change-internet-access-for-user-groups-networks-and-hosts.md)
Index: https://openvpn.net/cloud-docs/llms.txt