You're connected to the corporate VPN. Everything works for remote resources. But suddenly you can't print to the office printer. Or you can't reach the file server at 192.168.1.100. Other users on the same network don't have this problem. This usually happens after a VPN client update or a network change on your side.
The trigger? Maybe you upgraded from Windows 10 to Windows 11. Or your IT pushed a new VPN profile. Or you installed a third-party firewall that messed with routing tables. Whatever the cause, the symptom is the same: VPN traffic goes through the tunnel, but local traffic doesn't get routed correctly.
Root Cause: Split Tunnel Routing Got Corrupted
Split tunnel is supposed to send only company traffic through the VPN. Local traffic (like 192.168.x.x or 10.0.x.x) should go directly to your router. But when the split tunnel misconfiguration happens, the VPN client adds a route that forces ALL traffic—even local—through the tunnel. Or worse, it removes the default route for your local subnet entirely.
I've seen this most often with FortiClient 7.0.x and OpenVPN 2.5.x. But it can happen with any client. The real fix is to manually adjust the routing table on your machine. No, reinstalling the VPN rarely helps. The problem is in the routes.
Fix: Reset and Add the Correct Route
We'll do this in three steps. First, disconnect from the VPN so we don't conflict. Then we'll delete any bad routes. Finally, we'll add the correct route for your local subnet.
Step 1: Open Command Prompt as Admin
- Press Windows Key + X and select Terminal (Admin) or Command Prompt (Admin).
- If Windows asks for permission, click Yes.
- Now you're in the command prompt. The title bar should say Administrator: Command Prompt.
Step 2: Check Your Current Routes
route print -4Look at the section labeled IPv4 Route Table. Find the line that starts with 0.0.0.0. That's the default route. Under Gateway, you'll see your VPN's IP address (something like 10.10.10.1) instead of your local router's IP (like 192.168.1.1). That's the problem. Also check if your local subnet (like 192.168.1.0) has a route. If it's missing, that's why you can't reach local devices.
Step 3: Delete the Bad Default Route
We need to remove the VPN's default route so local traffic goes back to your router. But be careful—this will break your VPN connection. That's why we do this before reconnecting.
route delete 0.0.0.0 mask 0.0.0.0 10.10.10.1Replace 10.10.10.1 with whatever gateway your VPN was using (you saw it in the route table). After you hit Enter, you won't see any confirmation. Run route print -4 again to confirm the default route now shows your local router's IP (like 192.168.1.1).
Step 4: Add Your Local Subnet Route
If your local subnet route was missing, add it now. The typical command looks like this:
route add 192.168.1.0 mask 255.255.255.0 192.168.1.1Replace 192.168.1.0 with your actual subnet. Replace 255.255.255.0 with your subnet mask (most home networks use 255.255.255.0). Replace 192.168.1.1 with your router's IP. If you don't know your subnet, run ipconfig and look at the IPv4 address and subnet mask for your local adapter.
Step 5: Reconnect to the VPN
Now reconnect to your VPN. The default route might get overwritten again if the VPN client pushes routes. But we've already fixed the local subnet route—it should persist through the connection. After reconnecting, try pinging your local printer or file server.
ping 192.168.1.100If you get replies, the fix worked. If not, move to the next section.
Still Not Working? Check These
VPN Client Overwrites Routes
Some VPN clients (especially OpenVPN) reapply routes every time you connect. In that case, you need to add a persistent route. Use the -p flag:
route add -p 192.168.1.0 mask 255.255.255.0 192.168.1.1The -p makes it permanent. But the VPN client might still override it. If that happens, you'll need to create a script that runs after each VPN connection. Or talk to your IT team about fixing the VPN profile itself.
Check Your Firewall
Windows Defender Firewall or third-party firewalls can block local traffic over the VPN adapter. Open Windows Defender Firewall with Advanced Security. Look for inbound rules that block your local subnet. If you see any, disable them temporarily to test.
Try Reinstalling the VPN Client
I know I said this rarely helps. But sometimes a corrupt installation really does cause routing issues. Uninstall the VPN client completely, reboot, then install the latest version from scratch. Make sure you download the correct version for your OS (64-bit vs 32-bit).
Reset TCP/IP Stack
As a last resort, reset the whole TCP/IP stack. This clears all custom routes, so make sure you know what you're doing.
netsh int ip reset
netsh winsock resetReboot after running these commands. Then repeat the fix steps above.
Pro tip: If you're on a managed corporate laptop, your IT team might centrally enforce VPN settings. In that case, don't mess with routes—they'll get overwritten by group policy. Ask IT to check the split tunnel configuration on the VPN server.
That's it. Nine times out of ten, the route delete and add commands fix the problem. The rest is just fine-tuning for your specific setup.