Why can’t I access a VPE when using a client-to-site VPN in split‑tunnel mode?

In split-tunnel mode, your VPN might not send the right traffic through the tunnel. If DNS or routing isn’t configured correctly, your VPN client can't reach the private virtual private endpoint (VPE).

You can’t connect to a private resource through a VPE when using client-to-site VPN in split-tunnel mode. The same setup works in full-tunnel mode.

This issue usually occurs because one or both of the following settings are missing:

  • DNS is blocked by the security group - Your VPN client must contact IBM Cloud DNS to look up the private VPE address. If port 53 (DNS) isn’t allowed in the security group, the request is blocked, and the VPE IP address is never returned.
  • Missing VPN server route - In split-tunnel mode, the VPN server specifies routes for the traffic that should go through the tunnel. If no VPN route exists for the VPC subnet where the VPE is located, your client sends the traffic to the public internet, where private IP addresses aren’t accessible.

Follow these steps to fix this issue:

  1. Allow DNS in the security group

    DNS rule for security group
    Protocol Port Purpose
    UDP/TCP 53 Allow DNS resolution

  2. Add a VPN server route for the VPE

    In the VPN server routes section, add one of the following IP addresses:

    • VPC subnet CIDR: 10.x.y.0/24 (recommended)
    • VPE private IP as a /32 route: 10.x.y.z/32

  3. Reconnect the VPN because route changes are applied only after you disconnect and reconnect the VPN.