Disclosed are various examples for segregating virtual private network (VPN) traffic based on the originating client application. A tunnel endpoint receives, through a network tunnel, network traffic sent by a client application executed by a client device. The tunnel endpoint identifies characteristics of the client application or the client device. The tunnel endpoint then selects a particular virtual local area network (VLAN) from multiple VLANs based at least in part on the characteristics. The tunnel endpoint then forwards the network traffic to an internal network gateway of an organization using the particular VLAN.