VPN split tunneling is a feature that routes some of your internet traffic through the encrypted VPN tunnel while letting the rest connect directly to the internet. Instead of protecting everything or nothing, you choose which apps or websites go through the VPN and which bypass it entirely.
That’s the one-sentence answer. Here’s everything else you need to know.
How VPN split tunneling works
Your VPN app maintains a routing table that determines where each piece of traffic goes. When split tunneling is active, that table has two paths.
Traffic matching your rules goes through the VPN: encrypted, with your IP replaced by the VPN server’s IP, routed through a server in whatever location you chose. Everything else takes a direct path to the internet using your real IP address, with no encryption from the VPN.
Most providers offer two modes:
Inclusive split tunneling: direct connection is the default. Only the apps you add to the list go through the VPN. Use this if you only need to protect specific things.
Exclusive split tunneling: VPN is the default. Only the apps you add to the list bypass it. Use this if you want most traffic protected but need a few apps to use your real IP.
Some providers also offer URL-based or IP-range-based splitting, where you route specific websites or network addresses through the VPN rather than controlling it at the app level.
When split tunneling is actually useful
Banking apps: Some banks flag logins from VPN IP addresses and respond with extra verification or temporary account freezes. Excluding your banking app from the VPN solves this without dropping the VPN connection for everything else.
Local network access: When connected to a VPN, your local network devices (NAS drives, printers, smart home hubs) often become unreachable because traffic is being rerouted. Excluding local network traffic (the 192.168.x.x range) keeps those devices accessible.
Streaming geo-access with local services: Route a streaming app through a foreign server to access geo-blocked content, while keeping other apps on your real IP for local services that block VPN traffic.
Speed-sensitive apps: Gaming and real-time video calls are sensitive to the extra latency a VPN adds. Excluding them while routing everything else through the VPN is a reasonable trade.
Work plus personal traffic: On a home device, you might route work apps through a corporate VPN while personal apps go through a personal VPN or directly. Split tunneling keeps those flows separate on the same device.
When split tunneling creates risk
The forgotten exclusion problem: If you exclude an app from the VPN and forget about it, you may later assume your traffic is protected when it isn’t. Document what you exclude and why.
DNS leaks: Some split tunneling implementations route DNS queries through the VPN for all traffic, including the direct path. Others don’t. If excluded apps use your ISP’s DNS server, your ISP can see which sites those apps are looking up even though the connection itself bypasses the VPN. Run a leak test after configuration.
IP correlation: If someone can see both your VPN IP (from VPN-routed traffic) and your real IP (from direct traffic) simultaneously, they can correlate the two to identify you. For most users this is theoretical. For journalists, activists, or anyone with a genuine threat model, full-tunnel VPN is safer.
The rule that keeps it manageable: split by app using the provider’s official feature, check the exclusion list a few times a year, and never exclude an app whose privacy actually matters to you.
Which VPNs support split tunneling
Not all providers support it, and support varies significantly by platform.
| VPN | Windows | macOS | Android | iOS | App-based | URL-based |
|---|---|---|---|---|---|---|
| NordVPN | Yes | Yes | Yes | Limited | Yes | Yes |
| Surfshark | Yes | Yes | Yes | Limited | Yes | No |
| ExpressVPN | Yes | Yes | Yes | No | Yes | No |
| ProtonVPN | Yes | No | Yes | No | Yes | No |
| Mullvad | Yes | Yes | Yes | No | Yes | No |
| CyberGhost | Yes | No | Yes | No | Yes | No |
| Private Internet Access | Yes | Yes | Yes | No | Yes | Yes |
| IPVanish | Yes | Yes | Yes | No | Yes | No |
iOS is the outlier. Apple’s VPN API restrictions prevent true per-app split tunneling. When providers claim iOS support, they typically mean route-based approximations, not the per-app control you get on Android or Windows. If split tunneling on iPhone is a priority, your options are limited.
Best overall for split tunneling: NordVPN covers Windows, macOS, and Android with both app-based and URL-based control. The macOS implementation is solid, which puts it ahead of providers like ProtonVPN and CyberGhost that dropped macOS support.
Best for flexibility: Private Internet Access matches NordVPN on feature set and is cheaper on a 2-year plan at around $2.03/month, though its no-logs audit track record is thinner.
Best for privacy-focused users: ProtonVPN’s split tunneling on Windows and Android is well-implemented, and the company’s no-logs policy has been independently audited by KPMG. The absence of macOS support is a real gap.
How to set up split tunneling on NordVPN (Windows)
- Open the NordVPN app and go to Settings
- Select VPN, then Split Tunneling
- Toggle Split Tunneling on
- Choose mode: “Apps” (app-based) or “Websites/IPs” (URL-based)
- Add the apps or addresses you want to exclude (or include, depending on mode)
A practical starting setup: add your banking app and your local network range (192.168.1.0/24) to exclusions. Run a DNS leak test at dnsleaktest.com to confirm the configuration is behaving as expected.
Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.
Platform support in practice
Android and Windows get the most complete implementation across all providers. macOS has app-based splitting in some clients with platform-imposed quirks. iOS, as noted, is mostly route-based approximations.
Router-level VPN setups split by device instead of by app. For smart TVs and consoles where you can’t install a VPN app, routing the device itself outside the tunnel (while everything else goes through it) is often more practical than any per-app setup on a phone.
Check your specific platform’s support page before building a workflow around the feature. Among the options above, NordVPN and Private Internet Access cover the widest platform spread.
Four configurations worth the setup time
The banking exemption: route your bank’s app outside the tunnel. Some banks challenge VPN IPs or freeze accounts; excluding the app avoids this while keeping everything else protected.
The streaming split: TV apps inside the tunnel to access geo-blocked catalogs, local catch-up TV outside it since those services often block VPNs and work better on a direct connection.
The work split: corporate tools outside your personal VPN (your company’s own VPN client handles those), personal browsing inside.
The gaming split: game traffic outside for lowest latency, launcher downloads and background apps inside where your ISP’s bandwidth throttling is most likely to hit.
Each is two minutes in the app’s split tunneling list. Each removes one recurring reason to disable the VPN entirely, which is the feature’s real value: fewer exceptions, more time actually protected.
Split tunneling is useful for specific situations: banking apps flagging VPN IPs, local network access, and speed-sensitive traffic. It's not something most users need to configure from day one. If you do use it, document your exclusions, run a DNS leak test, and avoid excluding anything whose privacy actually matters. NordVPN offers the most complete cross-platform implementation. Full-tunnel VPN remains the safer default for privacy-focused use.
Keep reading: What Is a VPN Kill Switch and Why You Need One and WireGuard vs OpenVPN: Which Protocol Should You Use in 2026?.