NetScaler SSLVPN, Split-Tunneling. When configuring Split-Tunnel to ON, you configure the customer internal network, which is routed through the tunnel. Everything else is going via local breakout, decided after dns-resolution. The other one is to set REVERSE and configure all IP's (or FQDN's when using WFP driver in CSA-Client) which should go via local breakout, everything else is going through tunnel. Is there an option to configure split-tunneling in dependance of a proxy-pac file? So everything which is listed in pac, go through tunnel, everything else local breakout? The pacfile is getting ignored after dns-resolution points to a local breakout (example youtube) and so there's no security when surfing local. I know there are solutions like Cisco Umbrella which is designed to solve exactly that issue with a DNS-based proxy. Just wondering if NetScaler can solve that, too. I've found that statement which sounds great "If you use Full VPN Tunnel with PAC, you must disable Citrix Gateway split tunneling. If split tunneling is on and you configure a PAC file, the PAC file rules override the Citrix ADC split tunneling rules. A proxy server configured in a traffic policy does not override the Citrix ADC split tunneling rules" but it's related to SecureHub / XenMobile (Source https://docs.citrix.com/en-us/xenmobile/server/advanced-concepts/xenmobile-deployment/sso-proxy-mdx-apps.html) thanks for any idea!