What protocols get encrypted and go through the VPN? Is it just port 80 and DNS traffic that does not go through the VPN?
Does this impose any security risks by running a split tunnel? Making the assumption that maybe we connected to a rogue AP by mistake because it looked exactly like a public wifi spot.
I know that running a full VPN will tunnel everything so you are immune to MITM attacks and several other attacks as everything is connecting directly to your own network.
This depends on your split tunneling configuration.
Most split tunnels that I'm aware of are cases such as "road warriors": people who are working from outside the office. In these cases, traffic to the company's network is tunneled over the VPN and other traffic is sent directly.
For example, say your company's LAN is on the 10.99.0.0/16 network. The VPN would add a route, but rather than adding a default route, it would add a route only for 10.99.0.0/16 to send traffic via the VPN. Anything not matching that would go directly to the internet via normal routing rules.
I've never seen a split tunnel VPN that was per-protocol or per-port, though I suppose you could do it via firewall rules or something.
