Split tunnel vs full tunnel

In WireGuard, tunneling mode is mostly controlled by client AllowedIPs:

Full tunnel — AllowedIPs = 0.0.0.0/0, ::/0 (all traffic via VPN). Best for privacy on untrusted Wi‑Fi.
Split tunnel — only specific ranges (VPN subnet and/or remote LANs). Best for accessing a homelab without sending all browsing through the VPS.

In WireGuard Kit, enable Full tunnel for the first case, or leave it off and keep traffic on the VPN subnet only.