Split tunneling explained

What is split tunneling?

By default, a VPN app sends all of your device's traffic through its encrypted tunnel. Split tunneling lets you choose exceptions. Some traffic goes through the VPN, and the rest goes straight out through your normal connection with your real IP address.

Providers usually offer one or both of two modes. Proton VPN's support pages describe them this way:

Some apps let you split by app; some also by IP address or website. Browser extensions only ever cover the browser, which is a form of split tunneling in itself.

Why people use it

• Local devices. Printers, network storage and smart speakers on your home network can become unreachable while the VPN is on.
• Banking and work apps. Some banks and employers block or challenge logins from VPN addresses.
• Speed for heavy, low-risk traffic. Large game downloads or video calls on a trusted network don't always need the tunnel.
• Services that block VPNs. Some sites refuse VPN connections. See why streaming services block VPNs.
• Using a local service while abroad. You might keep a browser on a home-country server while other apps use the local connection. Our VPN for travel guide has more.

Which platforms support split tunneling?

Support depends on the operating system as much as on the VPN company. Two providers' published details show how much it varies:

Mullvad says its app doesn't offer include-only (inverse) split tunneling on any platform and errs on the side of tunneling everything. Neither provider offers split tunneling on iPhone. Check your own provider's help pages; this changes with app updates.

The privacy trade-offs

Every app you exclude sends traffic with your real IP address, visible to your ISP or the network you're on. That's fine for a printer. It isn't for anything you'd want hidden.

• It can weaken the kill switch. Proton's support pages say split tunneling isn't compatible with its kill switch on most platforms, Windows being the exception. If you rely on a kill switch, check this for your app.
• Excluded apps can leak more than you expect. A browser left outside the tunnel can still make DNS lookups and WebRTC connections outside it. Run a leak test after you change settings.
• Changes may need a reconnect. Proton says most platforms need you to reconnect or reapply settings before changes take effect, and on Linux apps must be restarted.
• Don't exclude your torrent client. If you use a VPN for torrenting, excluding the client sends its traffic with your real IP address to every peer. Remember too that a VPN doesn't make copyright infringement legal. See the safe torrenting guide.

How to set it up

1. Find the setting It's usually under Settings, then Split tunneling, Bypass, or Allowed apps.
2. Pick a mode Start with exclude mode, so new apps are protected by default.
3. Add exceptions sparingly Add only apps that don't work with the VPN, such as a printer utility or a bank app.
4. Reconnect and test Reconnect the VPN, then check with What is my IP in a tunneled browser and an excluded one.

Good and bad candidates for exclusion

A simple rule: exclude things that only talk to devices you own or services that already know who you are, and keep everything else in the tunnel. Review the list every few months, because apps you excluded once are easy to forget.

When split tunneling doesn't seem to work

• The app was already running. Apps often keep existing connections open. Close and reopen the app after changing settings; Proton says some platforms need this.
• The app uses a helper process. Some programs hand network traffic to a separate background process. If the main app is excluded but its helper isn't, traffic may still go through the VPN, or the other way round.
• The website comes through another app. Excluding one browser doesn't affect links that open in a different one.
• The kill switch is on. On platforms where the two features conflict, the app may disable one of them. Check the app's messages.

Split tunneling on a router

On a router, the equivalent is choosing which devices use the VPN. ASUS calls its version VPN Fusion. Our router guide explains it.