Split tunneling

Updated 21 September 2026 · How we research

Split tunneling lets some traffic use the VPN while the rest goes direct. It is genuinely useful and quietly risky, because every excluded application is fully exposed.

Two ways to split

Application-based splitting is easier to reason about; route-based splitting is more precise.

Model	How it decides	Typical platforms
Application-based	You list apps to include or exclude; the client routes per process.	Windows, Android
Route-based	You exclude IP ranges or destinations; routing tables do the work.	Routers, Linux, some desktop clients

Reasonable uses

Keeping a banking app on your home connection while everything else is tunnelled, because some banks treat VPN addresses as suspicious.
Letting a printer, smart speaker or NAS stay reachable on the local network.
Running a latency-sensitive game direct while a download stays in the tunnel.
Keeping a work application on a corporate connection that blocks consumer VPNs.

The trap

An excluded app has no protection at all. On public Wi-Fi, an app you excluded for convenience at home is transmitting in the clear on a network you do not control. Review your exclusion list whenever you change network, or disable split tunneling when travelling.

DNS still needs care

Splitting traffic does not automatically split DNS. Depending on the implementation, lookups for excluded apps may still go through the tunnel, or — worse — lookups for included apps may escape it. After changing any split-tunneling setting, re-run the checks on DNS leak protection.

Platform availability

Application-based split tunneling is common on Windows and Android, because both expose the necessary per-process hooks. On iOS, per-app VPN exists but is reserved for devices under mobile device management, so consumer apps generally cannot offer it. macOS support varies by client. Check the current feature list for your specific platform rather than assuming parity.