Split tunneling
Also called: Split tunnel, VPN split tunneling, App-based split tunneling, Inverse split tunneling
Definition. Split tunneling is a VPN feature that sends some traffic through the encrypted VPN tunnel and lets the rest go straight to the internet. You choose what goes where by app, website, domain or IP address.
Stanislav Vovchyk · Updated Nov 5, 2026 · 15 tools have it
In short
- Split tunneling routes chosen apps, domains or IPs outside the VPN while the rest stays encrypted.
- Excluded traffic shows your real IP and is visible to your ISP, so only exclude what does not need protection.
- Support differs by platform: strongest on Windows and Android, usually missing for apps on iOS.
Split tunneling lets you decide which traffic uses the VPN and which uses your normal connection. Without it, a VPN usually routes everything through its servers. With it, you can keep a banking app or browser inside the tunnel while a game, a local streaming service or a printer on your home network connects directly.
How it works
When a VPN connects, it changes your device's routing table so that traffic goes to a virtual network interface and then to the VPN server. Split tunneling adds exceptions to that routing. The VPN app marks certain apps, domains or IP ranges and sends their packets through your regular network interface instead.
Most apps offer one or both of two modes:
- Exclude mode (bypass): everything uses the VPN except the apps or sites you list.
- Include mode (inverse split tunneling): only the apps or sites you list use the VPN, and everything else goes direct.
Exclude mode is the safer default, because new apps you install stay protected unless you remove them.
Types of split tunneling
| Type | What you select | Typical use |
|---|---|---|
| App-based | Individual programs or mobile apps | Keep games or a local banking app off the VPN |
| Domain or URL-based | Websites or domains | Open a local site that blocks VPN IPs |
| IP or subnet-based | IP addresses or ranges | Reach a home NAS, printer or office network |
App-based rules are the most common in consumer VPNs. Domain-based rules are often delivered through a browser extension or by resolving the domain to IPs, so they can miss sites that use many changing addresses or a CDN. Corporate VPNs mostly use route-based rules, sending only company subnets through the tunnel.
Why it matters and when you need it
- Speed and latency: encryption and the extra hop to a VPN server add delay. Games, video calls and large downloads can run faster outside the tunnel.
- Local services: some banks, government portals and streaming services block known VPN IPs. Excluding them avoids constant disconnecting.
- Two locations at once: you can watch a service through a server in another country while local apps still see your real location.
- LAN access: printers, smart TVs, Chromecast devices and network drives often stop working when all traffic is tunneled.
- Data limits: on free VPNs with a monthly allowance, keeping heavy apps outside the tunnel saves your VPN data.
Limits and risks
Traffic outside the tunnel is not protected by the VPN. Your ISP or the local Wi-Fi operator can see which sites it reaches, and those sites see your real IP address. Do not exclude apps you use on public Wi-Fi for anything sensitive.
Other points to know:
- DNS leaks: if excluded and tunneled traffic share one DNS resolver, lookups can reveal activity. Good apps keep tunneled DNS inside the VPN; see Private DNS.
- Kill switch interaction: a kill switch blocks traffic when the VPN drops, but excluded apps keep running on your real connection. Some apps disable split tunneling when certain kill switch modes are on.
- Platform gaps: Windows and Android have the widest support. On iOS, most VPN apps cannot offer app-based split tunneling because of Apple's network restrictions. On macOS and Linux, support varies by app and version.
- Browser apps: excluding a browser excludes every tab in it. Use domain rules or a second browser if you need finer control.
- Mistakes compound: a long rule list is easy to forget. Review it if you change how you use the VPN.
What to check when comparing VPNs
- Which platforms support it: Windows, macOS, Android, iOS, Linux, routers.
- Whether you get exclude mode, include mode, or both.
- App-based only, or also domain and IP rules.
- How DNS is handled for excluded traffic.
- Whether it works together with the kill switch and with obfuscated servers.
- Whether it is included in free plans or only in paid tiers.
- Whether LAN access is a separate toggle, which saves you writing IP rules for local devices.
Related terms
Split tunneling vs full tunnel: a full tunnel sends all traffic through the VPN, which gives maximum coverage but less flexibility. Split tunneling vs proxy: a proxy usually covers one app or browser by design, while split tunneling starts from a system-wide VPN and carves out exceptions. Split tunneling vs Double VPN: Double VPN changes the route of tunneled traffic through two servers. It does not decide which traffic enters the tunnel.
Tools that have it
From the directory, based on each tool's own feature list. Check the plan: some offer it only on paid tiers or certain apps.
- A
Amnezia VPNSplit tunneling listed in features · Free, from $3.30/mo - N
NordVPNSplit tunneling in apps, choose apps to bypass · From $2.99/mo - P
PureVPNSplit tunneling listed in features · From $1.69/mo - P
Proton VPNSplit tunneling in apps by app or IP · Free, from $3.49/mo - V
VeePNSplit tunneling in feature list · From $1.99/mo - T
Turbo VPNSplit Tunneling on premium plans · Free, from $3.33/mo - S
SurfsharkSplit tunneling in plan features · Paid - E
ExpressVPNSplit tunneling listed in features · Paid - I
IPVanishSplit tunneling in apps, choose apps to bypass · See site - F
FreeVPNPlanetSplit tunneling on Premium · Freemium - W
WindscribeSplit tunneling in apps, include or exclude apps · Freemium - P
Private Internet AccessSplit tunneling by app and domain · From $2.03/mo - H
Hotspot ShieldSplit tunneling in apps by app or site · Freemium - V
VyprVPNSplit tunneling in apps, choose apps to bypass · Paid - C
CyberGhostSplit tunneling in apps by app or website · Paid
FAQ
Is split tunneling safe?
Traffic inside the tunnel is as protected as usual. Traffic you exclude is not protected by the VPN at all, so it is safe only for apps and sites where revealing your real IP and activity to your ISP is acceptable.
Does split tunneling make a VPN faster?
It does not speed up the VPN itself, but excluded apps skip encryption and the extra server hop, so they get lower latency and full line speed. Less traffic in the tunnel can also leave more bandwidth for the apps that stay inside.
Why is split tunneling missing on my iPhone?
Apple's VPN framework gives most third-party VPN apps no way to route individual apps outside the tunnel, so app-based split tunneling is rarely available on iOS. Some apps offer limited workarounds such as LAN access or IP exclusions.
What is inverse split tunneling?
It is the include mode: only the apps or sites you pick go through the VPN and everything else connects directly. It is useful when you need the VPN for one or two apps only.