VPN Split Tunneling Explained: When to Include or Exclude Apps
VPN split tunneling routes some apps through the VPN and the rest straight to the internet. Learn how include and exclude modes work safely.
By Galactic News Editorial · Published 2026-11-08T16:23:22+00:00 · Updated 2026-11-08T16:23:22+00:00
VPN split tunneling lets you choose which apps or websites use the VPN and which connect directly to the internet. By default, a VPN routes all of your traffic through its encrypted tunnel. Split tunneling breaks that all-or-nothing rule. Some traffic stays protected, and the rest takes the normal route. This guide explains how VPN split tunneling works, when it helps, and when to leave it off.
What is VPN split tunneling?
VPN split tunneling is a setting that divides your internet traffic into two paths. One path goes through the encrypted VPN tunnel. The other connects straight to the internet through your normal connection. You pick which apps, websites or IP addresses take which route, and you can change the rules at any time.
In full tunnel mode, every packet leaving your device travels through the VPN. Your internet provider sees only an encrypted connection to the VPN server, and websites see the VPN server's address. In split tunnel mode, the VPN software applies routing rules. Traffic that matches the rules goes through the tunnel. Everything else uses your regular connection and shows your real IP address, just as if the VPN were off.
The feature is available in most premium VPNs, but not all of them. It also varies by platform. Windows and Android have the broadest support. On iOS, no consumer VPN offers app-level split tunneling, because Apple's architecture restricts per-app routing to managed enterprise devices. Some VPNs offer website or domain-based exclusions on iOS instead.
How VPN split tunneling works: include mode vs exclude mode
Most VPN apps offer one of two styles. In exclude mode, all traffic goes through the VPN except the apps or websites you list. In include mode, also called inverse split tunneling, only the apps or websites you select use the VPN. Everything else connects directly.
Exclude mode is the safer default. New apps are protected automatically until you remove them from the tunnel. Include mode suits people who want the VPN for one particular job, such as a single work app. New apps start unprotected until you add them, so it is easy to forget one.
At a network level, split tunneling uses policy-based routing. The VPN app creates rules that tag traffic by app, domain or IP range. On Windows, apps use the Windows Filtering Platform to create per-app rules. On Android, the VpnService API lets a VPN exclude apps from the tunnel or include only selected apps.
| Mode | What uses the VPN | What bypasses the VPN | Best for |
|---|---|---|---|
| Full tunnel | All traffic | Nothing | Maximum privacy |
| Exclude mode | Everything except listed apps or sites | Only what you list | Everyday use with a few exceptions |
| Include mode | Only listed apps or sites | Everything else | One specific job, such as a work app |
The three types of VPN split tunneling
App-based split tunneling
You pick which apps use the VPN. A browser might go through the tunnel while a video-calling app or a banking app uses your normal connection. This is the most common type, and the easiest to understand.
URL or domain-based split tunneling
Rules are based on website addresses instead of apps. You might route your streaming service outside the tunnel while everything else stays protected. Some VPNs support this on platforms where app-based routing is not possible.
IP-based split tunneling
Rules are based on IP ranges. This is common in company setups. Traffic for the office network goes through the VPN, while ordinary internet traffic does not. It is the most technical type, and most home users never need it.
When to use VPN split tunneling
Split tunneling helps in several everyday situations. A banking app may block logins from VPN IP addresses, so excluding it avoids constant verification codes. A streaming service may only work from your home country, so routing it outside the tunnel keeps it working. Local devices such as printers, smart TVs and network storage often need your real local network, which a full tunnel can break.
It can also improve speed. Excluding bandwidth-heavy but non-sensitive traffic, such as video streaming or gaming, takes load off the VPN server. Your protected traffic then has more room. Video calls may also run better outside the tunnel, since the extra hop adds latency.
Work setups are another common use. A company VPN may only need to carry traffic for internal systems. Routing the rest of your browsing directly keeps personal traffic off the company network and keeps the work connection fast.
When to leave VPN split tunneling off
Traffic outside the tunnel is unprotected. It carries your real IP address, is visible to your internet provider, and reveals the domains you visit. That is the trade-off, and it is easy to get wrong.
Leave split tunneling off if your main goal is privacy. A full tunnel protects everything by default, including apps you forgot about. Split tunneling only makes sense when you have a specific reason to bypass the VPN, and you know exactly which app or site you are exposing.
Never exclude apps that handle sensitive information. Email, messaging, file downloads and anything tied to your identity belong inside the tunnel. A kill switch also needs care with split tunneling. A good kill switch only blocks traffic that should use the tunnel. It must not block excluded apps, but it must block included ones if the VPN drops.
How to set up VPN split tunneling
The setting is usually found under Advanced or Connection in your VPN app. The exact steps vary by provider, but the pattern is the same.
- Open your VPN app and go to Settings, then Connection or Advanced.
- Find the split tunneling option and turn it on.
- Choose exclude mode or include mode. Pick exclude mode unless you have a reason not to.
- Add the apps or websites you want to route outside the tunnel, or inside it in include mode.
- Reconnect the VPN so the new rules take effect.
- Test your VPN split tunneling setup. Visit a site that shows your IP address from an excluded app, and confirm it shows your real address, while a protected app shows the VPN address.
Check your provider's support pages for platform limits. Proton VPN, for example, supports app and IP exclusions on Windows and Android, with more limited support on macOS and Linux. Other providers differ, so confirm before you rely on the feature.
Bottom line
VPN split tunneling is a useful tool, not a default setting. Use it when a specific app needs your real IP address, when local devices need your home network, or when you want to save VPN bandwidth for the traffic that matters. Use exclude mode so new apps stay protected. Keep sensitive apps inside the tunnel, and remember that anything outside it is visible to your provider and shows your real address. If privacy is the priority, a full tunnel is still the safer choice.