Proton VPN shipped an update to its Android app on July 7, 2026 that adds a feature power users have wanted for a while: split tunneling by IP range using CIDR notation, rather than being limited to picking individual apps.
It’s a small-sounding change that actually matters a lot for anyone managing a home lab, a work network, or any setup where “route this app through the VPN” isn’t precise enough.
What CIDR-based split tunneling actually means
Split tunneling lets you choose which traffic goes through the VPN tunnel and which uses your regular connection directly. Most consumer VPN apps offer this at the app level: send Chrome through the tunnel, let Spotify bypass it, and so on. That works fine for most people, but it breaks down for anyone who needs traffic routed based on destination rather than which app sent it.
CIDR (Classless Inter-Domain Routing) notation is the standard way of describing an IP address range, for example 192.168.1.0/24 for an entire home network subnet. Proton VPN’s update lets Android users specify these ranges directly, meaning you can route all traffic to your home network’s IP range outside the tunnel (so a personal WireGuard server or NAS stays reachable without VPN interference) while everything else stays protected, or the reverse: force specific destination ranges through the tunnel regardless of which app is generating the traffic.
Why this matters more than it sounds
App-based split tunneling has a real limitation: it can’t distinguish between two connections made by the same app to different destinations. A browser making a request to your home NAS and a request to a public website look identical to app-level split tunneling, both are “the browser,” so both get the same treatment. CIDR-based rules fix this by working at the network layer instead, where the destination address is what determines the routing decision, not which application initiated the connection.
This is the kind of control that’s long been standard on desktop VPN clients and enterprise networking gear, but rarely made it into mobile apps in a genuinely usable form. Proton VPN’s implementation puts it directly in the Android app’s settings rather than requiring a separate configuration file or command-line step.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Who actually benefits from this
The realistic audience here is people running self-hosted infrastructure at home, a Raspberry Pi or Synology NAS running a personal WireGuard server, as covered in our own Raspberry Pi WireGuard guide and Synology NAS VPN guide, plus a commercial VPN like Proton VPN running simultaneously for everything else. Without CIDR-based rules, reaching a home server while a phone’s VPN app is active can require constantly toggling the VPN on and off. With them, the home network’s IP range gets a permanent tunnel exemption, and the rest of the phone’s traffic stays protected without any manual switching.
It’s a smaller audience than the app’s general user base, but a vocal and technically engaged one, the kind of feature request that shows up repeatedly in community forums and subreddits long before a company ships it.
How this fits into Proton VPN’s broader 2026 roadmap
This ships alongside a string of other Proton VPN releases this year, including the Proton Protocols architecture introduced in mid-July and the network expansion to over 20,000 servers announced earlier in the spring. Proton’s public roadmap has repeatedly emphasized closing feature gaps between its mobile and desktop clients, and granular split tunneling was one of the more visible remaining gaps on Android specifically, since iOS’s networking APIs impose different constraints that don’t map directly onto what Android allows.
How this compares to what iOS allows
Android’s networking stack gives apps deeper control over routing decisions than iOS does, which is part of why this kind of granular split tunneling landed on Android first rather than simultaneously across both platforms. Apple’s NetworkExtension framework, which every iOS VPN app including Proton VPN’s must build on, restricts what a third-party app can specify about routing exceptions compared to what Android’s VpnService API permits. This isn’t a Proton-specific limitation, it affects every VPN provider trying to ship the same feature set across both mobile platforms, and it’s a big part of why iOS VPN apps in general tend to lag behind their Android counterparts on this specific category of networking feature.
Availability
The feature is live now in the current release of Proton VPN’s Android app, available to both free and paid tiers since split tunneling isn’t gated behind a specific subscription level. No action is required beyond updating to the latest app version from the Play Store; the CIDR range settings appear directly in the app’s existing split tunneling menu.
Worth checking even if you don’t think you need it
If you’ve never looked closely at your VPN app’s split tunneling settings, this update is a reasonable prompt to do so, even without a home server to worry about. Plenty of everyday situations benefit from excluding specific traffic from the tunnel: a banking app that flags VPN connections as suspicious, a local printer or smart home device that only responds to requests from the same local network, or a work VPN client that conflicts with a second, personal VPN running at the same time. CIDR-based rules widen what’s possible here beyond the simpler per-app toggle most users have used until now.
This is a niche feature by user count but a genuinely well-executed one, the kind of granular control that used to require a desktop client or a rooted device is now sitting in a stock Android app's settings menu. If you run any kind of home server or self-hosted service alongside a phone VPN, this update is worth updating for immediately. If you don't, it changes nothing about your day-to-day use of the app.
How to set it up
In the current Proton VPN Android app, the new option sits inside the existing Settings > Split tunneling menu, alongside the app-based exclusion list that was already there. Selecting the CIDR mode presents a simple text field for entering ranges in standard notation, and the app validates the format before saving, catching a malformed range before it silently fails to apply. Multiple ranges can be added, useful for anyone managing more than one local subnet, a home network and a separate VPN-only lab network, for example.
One practical note for anyone setting this up for the first time: CIDR notation trips people up if they’re not used to it. 192.168.1.0/24 covers the entire 192.168.1.x range, 256 addresses, while 192.168.1.100/32 covers only that single device. Getting the suffix wrong either excludes far more of the network than intended or fails to cover the device you actually meant to reach. If in doubt, a /24 covering a full standard home subnet is the safe default for most single-router home networks.
A reasonable feature for competitors to match
CIDR-based split tunneling isn’t unique technology, WireGuard itself supports this kind of routing natively, so any VPN provider building on WireGuard could ship a comparable feature without a major engineering lift. What’s notable is less the feature itself and more that Proton VPN built a genuinely usable interface for it on mobile rather than leaving it as a desktop-only or config-file-only capability. Whether competitors like NordVPN or Surfshark follow with their own version is worth watching, since once one major provider ships a well-received power-user feature like this, others in the same tier tend to catch up within a release cycle or two rather than ceding the feature permanently.
Keep reading: How to Set Up a VPN Server on a Synology NAS and What Is Split Tunneling? Explained.