---
title: "Split Tunneling VPN: What It Is, Setup and When to Use It"
description: "Split tunneling lets chosen apps or sites skip the VPN. See which devices support it, how to set it up, and what the excluded traffic gives up."
url: "https://tunnelverdict.com/blog/split-tunneling/"
lang: "en"
published: "2026-01-22"
modified: "2026-10-29"
tags: ["setup","troubleshooting","phone","computer","explainer"]
image: "https://tunnelverdict.com/blog/split-tunneling/featured.jpg"
alternates:
  es: "https://tunnelverdict.com/es/blog/tunel-dividido-vpn.md"
---

Explainer

# Split Tunneling: What It Is and When to Use It

Split tunneling lets chosen apps or sites skip the VPN. See which devices support it, how to set it up, and what the excluded traffic gives up.

Tunnel Verdict Published January 22, 2026 Prices checked October 28, 2026

![A gravel path in a park that forks around a large tree with a bench at the fork](https://tunnelverdict.com/blog/split-tunneling/featured.jpg)

Split tunneling is the right setting when you want some traffic protected by a VPN while a bank, printer, streaming service, game, or local app uses your normal connection. You choose which traffic bypasses the VPN, then confirm that the selected app or website shows the route you intended.

The practical choice is simple: keep full tunneling when every app should use the VPN. Use split tunneling when one exception needs your ordinary IP address, local network, or better direct performance. Before paying, match the feature to your device, check the renewal price, and confirm whether a kill switch works with your chosen rules.

Key takeaways

- Put banking, printers, local services, or selected high-bandwidth apps outside the VPN only when they need the direct route.
- Use app, website, IP, subnet, or inverse rules according to what your device and provider support.
- Excluded traffic uses your ordinary IP address and does not receive the VPN tunnel’s encryption.
- Check the provider’s exact operating-system support, kill-switch behavior, billing term, renewal amount, and refund rules.
- Make three routing groups: always through VPN, always outside VPN, and test before relying on it.

## Which apps should use split tunneling for banks, printers, streaming, and everyday tasks?

A banking app may reject a VPN server address or require the IP address associated with your normal location. A printer, smart-home device, or local network service may stop responding because its traffic needs to stay on the home network. In those cases, excluding only the affected app or website can solve the routing problem while other traffic stays inside the VPN.

![A phone leaning against a mug on a side table beside a sofa and a bowl of fruit](https://tunnelverdict.com/blog/split-tunneling/side-table-phone-mug.jpg)

Streaming services and games can create a different reason. A streaming website may work only with your ordinary local IP address, while a game, video call, or large download may perform better through the direct connection. Surfshark describes excluding high-data apps as a way to let them use the ordinary route, but that is a provider claim rather than an independent speed measurement. If Netflix displays a proxy message, work through the [Netflix proxy error fixes](https://tunnelverdict.com/blog/netflix-vpn-proxy-error/).

Your short routing list should have three groups: apps that should always use the VPN, apps that should always use the normal connection, and apps you will test before relying on them. Work or school services may need the VPN while personal apps use the direct route. A local streaming service may need the opposite.

A VPN encrypts the connection between your device and the VPN server and changes the IP address websites see for protected traffic. It does not stop an account, cookie, employer system, school system, or device fingerprint from identifying you. For the broader boundary, see [What Is a VPN and What Does It Do](https://tunnelverdict.com/blog/what-is-a-vpn/).

## How does split tunneling work, and which type do you need?

A split tunnel creates two routes at once. Selected traffic travels through the encrypted VPN tunnel and appears to come from the VPN server’s IP address. Excluded traffic connects directly through your internet provider and appears to use your ordinary IP address.

App-based rules are the easiest choice when one program needs an exception. You can exclude a banking app, printer utility, game, or streaming app, or use inverse mode so only selected apps use the VPN. NordVPN and Surfshark document both ordinary exclusions and inverse routing. Proton calls its inverse option Include or Inverse mode, while Surfshark calls its version Reverse Bypasser.

Website or domain rules suit browser traffic. NordVPN supports website exclusions through browser extensions, Proton supports domain rules in its browser extension, ExpressVPN documents website rules on desktop, and Surfshark supports website exclusions through Bypasser. This approach can be more precise than excluding an entire browser.

IP-address and subnet rules suit network destinations rather than individual programs. Proton supports IP addresses and CIDR ranges on Windows and Android. ExpressVPN documents IPv4, IPv6, and subnet rules on desktop. NordVPN’s Linux Allowlist works with ports, port ranges, and subnets instead of ordinary app-based rules.

The practical choice is to use the narrowest rule that solves the problem. Exclude one app when one app fails. Use a website rule when only a domain needs the direct connection. Use an IP or subnet rule for a printer, server, or network range. Use inverse mode only when you can keep track of every app that must use the VPN.

Which split-tunneling rule fits the problem
| Rule type | Fits when | The tradeoff |
| --- | --- | --- |
| App rule | One program, such as a banking app, printer utility, game, or streaming app, needs an exception | It covers only that program, so other traffic on the device still follows the VPN |
| Website or domain rule | Only a domain needs the direct connection | It suits browser traffic and can be more precise than excluding an entire browser |
| IP address or subnet rule | A printer, server, or network range needs the direct route | A subnet rule can include more destinations than you intended |
| Inverse mode | Only selected apps should use the VPN | You have to keep track of every app that must use the VPN |

## Which VPN apps support split tunneling on your device?

Platform support matters more than a general provider ranking. NordVPN documents split tunneling for Windows 10 and 11, Android, Android TV, and browser extensions. Its Linux Allowlist handles ports and subnets rather than standard app-based rules. NordVPN is a fit when you use one of those supported platforms and want straightforward app or browser exclusions.

![A phone, a thin laptop and a tablet in a row on a cushioned window seat](https://tunnelverdict.com/blog/split-tunneling/window-seat-three-devices.jpg)

Proton VPN documents split tunneling for Windows, Linux GUI, macOS, Android, Android TV, and its browser extension. Its rules can cover apps, IP addresses, CIDR ranges, and domains depending on the platform. Proton documents split tunneling as a paid feature, so its free tier does not automatically include it.

ExpressVPN documents support for Windows, macOS, Linux, and Android. Its desktop rules can cover apps, websites, IP addresses, and subnets, while Android uses app-based rules. ExpressVPN suits a reader who needs several rule types on a desktop, but the exact behavior can differ by protocol and operating system.

Surfshark documents Bypasser for Windows, macOS, Android, iOS, and Chrome, Firefox, and Edge extensions. It supports apps, websites, and IP addresses in the documented settings. On iOS, the documented method is website-based. Reverse Bypasser is documented for Android and as app-only on Windows.

CyberGhost documents app-based split tunneling on Android. That makes it a narrower choice for this particular task, especially if your main device is a desktop, iPhone, or streaming platform.

Documented split-tunneling support by provider
| Provider | Platforms documented | Rule types documented |
| --- | --- | --- |
| NordVPN | Windows 10 and 11, Android, Android TV, browser extensions | Apps and websites; the Linux Allowlist handles ports, port ranges, and subnets |
| Proton VPN | Windows, Linux GUI, macOS, Android, Android TV, browser extension | Apps, IP addresses, CIDR ranges, and domains, depending on the platform |
| ExpressVPN | Windows, macOS, Linux, Android | Apps, websites, IP addresses, and subnets on desktop; apps on Android |
| Surfshark | Windows, macOS, Android, iOS, Chrome, Firefox, and Edge extensions | Apps, websites, and IP addresses; website-based on iOS |
| CyberGhost | Android | Apps |

Google documents split-tunnel capability for many Chrome and Android VPN apps, as well as the built-in OpenVPN client on Chromebook. Apple documents per-app VPN for managed iPhone and iPad deployments, not as a general consumer switch inside every ordinary iPhone VPN app. Check the device’s Settings → Network & internet → VPN menu and the manufacturer’s documentation before subscribing.

For a provider choice, [Surfshark](https://surfshark.com/) fits readers who want documented support across iOS as well as desktop and mobile platforms. [Proton VPN](https://protonvpn.com/) fits readers who need several rule types and can use a paid plan. [ExpressVPN](https://www.expressvpn.com/) fits desktop users who need website, IP, and subnet rules. The tradeoff in every case is that a documented feature still depends on the exact app version, protocol, and platform.

## What does split tunneling cost, and what renews?

Prices below are for United States readers and were checked October 28, 2026. A free tier, free trial, and money-back guarantee are different. A free tier costs nothing, a trial has its own eligibility and billing rules, and a money-back guarantee requires an initial paid purchase.

| Plan | Upfront price and paid time | Effective monthly price | Renewal |
| --- | --- | --- | --- |
| Proton VPN Plus, US, 2-year term | $83.76 for the first 24 months | $3.49 per month | $83.88 every 12 months |
| Surfshark Starter, US, 2-year term plus bonus time | $67.23 for the first 27 months, before applicable VAT | $2.49 per month across the 27 months, which include 3 bonus months | Confirm the applicable renewal price at checkout |
| ExpressVPN Basic, US, 28-month term | $83.72 for the first 28 months | About $2.99 per month | $99.95 annually |

Proton also offers Proton Free at $0, with one simultaneous device and servers in 10 randomly selected countries. Proton documents split tunneling as a paid Proton VPN feature, so the free tier is not the same as the split-tunneling plan. Proton offers a 30-day money-back guarantee, with separate refund handling for App Store and Google Play purchases.

Surfshark advertises three extra months as bonus time. Its 30-day refund applies to the initial purchase, while recurring payments are non-refundable under the stated terms. ExpressVPN’s US checkout price is $83.72 for the first 28 months and $99.95 annually. Its standard 30-day guarantee is for new users and excludes renewal purchases and purchases made through Apple App Store or Google Play.

Before paying, read the complete checkout summary. Confirm the amount due upfront, billing term, renewal amount, refund route, and any trial eligibility or cancellation rule shown by the provider or app store.

## What does excluded traffic give up?

Excluded traffic does not use the VPN server’s IP address. It also does not use the VPN tunnel’s encryption, so the destination, internet provider, and local network see the ordinary connection path for that traffic. This can be the right tradeoff for a bank that needs a local IP or a printer that needs the home network, but it should be intentional.

![A home printer on a bookshelf with an open paper tray beside a lamp and a plant](https://tunnelverdict.com/blog/split-tunneling/printer-on-bookshelf.jpg)

Accounts, cookies, device fingerprints, employer systems, school systems, and logged-in services can still identify you. EFF describes a commercial VPN as shifting trust from the internet provider to the VPN provider. It does not provide complete protection from tracking, malware, government surveillance, or streaming blocks.

DNS can create a separate problem. NordVPN documents a situation where an excluded streaming app sees the internet provider’s IP address while DNS still points through NordVPN. The mismatch can produce a location error. If an app still reports the wrong location after you add an exclusion, check the DNS behavior and reconnect.

IP exclusions can be broader than they look. ExpressVPN warns that public IP whitelisting can affect unrelated websites that share the same infrastructure. A subnet rule can also include more destinations than you intended, so use the narrowest address range that meets the need.

Split tunneling can also change kill-switch coverage. Proton says its standard or advanced kill switch is incompatible with split tunneling on most platforms, although Windows supports both together. Check the chosen app’s current requirements before relying on a kill switch. For a separate explanation of the setting, see [What a VPN Kill Switch Does and How to Turn It On](https://tunnelverdict.com/blog/vpn-kill-switch/).

## How do you set up and check split tunneling?

Start with the routing list, then use the provider’s settings. NordVPN places the feature under Settings and Split tunneling on supported platforms. Android uses Profile → Settings → Split tunneling. Android TV uses Trusted apps, and browser extensions use Exclude from VPN for websites.

![A person holding a phone in both hands at a kitchen table with a mug beside it](https://tunnelverdict.com/blog/split-tunneling/thumb-over-phone.jpg)

Proton places the feature in Settings or a Split tunneling shortcut. Enable it, choose Exclude or Include/Inverse mode, and add apps, IPs, CIDR ranges, or domains supported by that platform. Reconnect when the app requests it.

ExpressVPN uses Profile → Split Tunneling. Enable the feature, add apps or IP addresses, and choose Bypass VPN or Only VPN. Its documentation says WireGuard requires disconnecting and reconnecting before changes apply.

Surfshark uses Settings → VPN Settings → Bypasser. Add apps, websites, or IP addresses. On iOS, use the documented website method rather than assuming app-level exclusions. CyberGhost requires disconnecting first, then opening VPN settings → App Split Tunnel on Android and selecting the apps to exclude.

After saving a rule, check both routes. An excluded website should show the ordinary IP address, while a protected website should show the VPN server’s IP address. A printer or local device should respond, and the protected app should continue to use the VPN. A DNS check can help when a streaming or location result does not match the selected route. If needed, run a [DNS leak test and fix a leak](https://tunnelverdict.com/blog/dns-leak-test/).

Do not assume that a rule remains active after an app update, protocol change, reconnect, or operating-system update. Confirm the selected route before using a bank, work account, printer, or local streaming service.

Set up and check a split-tunneling rule

1.  Make your routing listSort apps into always through the VPN, always outside the VPN, and test before relying on them.
2.  Open the split-tunneling settingUse the provider's Settings, Profile, or Bypasser menu for your platform.
3.  Enable it and pick a modeChoose Exclude, or an inverse mode such as Include/Inverse or Only VPN where the app offers one.
4.  Add the narrowest ruleAdd the app, website, IP address, or subnet that needs the exception.
5.  Reconnect when askedProton asks for a reconnect, and ExpressVPN's documentation says WireGuard requires disconnecting and reconnecting before changes apply.
6.  Check both routesAn excluded website should show your ordinary IP address, a protected website should show the VPN server's IP address, and a printer or local device should respond.
7.  Recheck after changesConfirm the route again after an app update, protocol change, reconnect, or operating-system update.

## What are the Android, iPhone, and Chromebook limits?

Android gives you VPN settings for adding or using a VPN profile, and Google documents a built-in Google VPN on supported Pixel devices and locations. Android also supports work-profile VPN routing. The provider app still controls whether you get app, website, IP, or inverse rules.

iPhone needs more care. Apple documents per-app VPN for managed devices, while ordinary consumer iPhone control depends on the VPN app and service. Surfshark documents website exclusions on iOS, but you should not assume that an iPhone app can freely exclude any individual app.

Chromebook supports the built-in OpenVPN client, and Google identifies printers and local-network devices as split-tunneling use cases. Chrome and Android VPN apps may provide additional capability, but support varies. Check the Chromebook’s VPN settings and the app’s current requirements before relying on a rule.

The practical result is that Android usually provides the broadest consumer choices, iPhone often has narrower controls, and Chromebook depends on whether you use its built-in client or a compatible app.

## What legal and terms-of-service boundaries apply?

Use split tunneling in ways allowed by the law where you are and by the terms of the VPN provider, network owner, app, website, employer, school, or streaming service. ExpressVPN’s terms place responsibility on the user to assess compliance with applicable laws and regulations. Surfshark’s terms state that its refund applies to the initial purchase, and its feature page says illegal activity violates its terms.

A VPN does not grant permission to bypass a workplace policy, school rule, account restriction, copyright restriction, geographic license, fraud control, or service access condition. Check the relevant provider and network terms before routing traffic outside or through a VPN. The same check applies when a bank, employer, school, or streaming service blocks VPN traffic.

**Quiz: Comprueba lo aprendido**

1. ¿Qué usa el tráfico excluido?
   - La dirección IP del servidor VPN y el cifrado del túnel
   - Tu dirección IP habitual, sin el cifrado del túnel de la VPN **(correct answer)**
   - Un segundo túnel cifrado hacia tu proveedor de internet
2. ¿Qué tipo de regla conviene a una impresora, un servidor o un rango de red?
   - Una regla por dirección IP o subred **(correct answer)**
   - Una regla por sitio web
   - El modo inverso para todas las apps
3. ¿El plan gratuito de Proton incluye el túnel dividido?
   - Sí, en todas las plataformas
   - Sí, pero solo en Android
   - No; Proton documenta el túnel dividido como una función de pago de Proton VPN **(correct answer)**

## Frequently asked questions

### Should I use split tunneling on my VPN?

Use it when a specific app, website, printer, local service, or high-bandwidth activity needs the ordinary connection while other traffic stays protected. Keep full tunneling enabled when every app should use the VPN route.

### What is a VPN split tunnel?

It is a routing setup that sends selected traffic through the VPN and sends other traffic directly through the internet provider. The direct traffic uses the ordinary IP address and does not receive the VPN tunnel’s encryption.

### Is split tunneling a security risk?

It can reduce protection for excluded traffic because that traffic follows the ordinary ISP and local-network path. Use exclusions for trusted apps and websites, and remember that the VPN does not protect traffic you deliberately send outside it.

### Why would you disable split tunneling?

Disable it when the excluded app no longer needs a local IP, when every connection should use the VPN, or when your platform’s kill switch does not cover split traffic. This also removes confusion from old or overly broad rules.

### Is there a free VPN with split tunneling?

Proton VPN has a free tier at $0, but Proton documents split tunneling as a paid Proton VPN feature. A free tier is separate from a free trial and from a money-back guarantee, so check the exact plan and billing channel. Prices checked October 28, 2026.

### Which VPN is best for split tunneling?

No single choice is best for everyone. Surfshark fits readers who need documented app and website exclusions across several platforms, Proton fits readers who need several rule types on a paid plan, and ExpressVPN fits desktop users who need app, website, IP, and subnet rules.

### Can I be tracked at work if I use a VPN?

Yes. Workplace systems, managed devices, logged-in services, cookies, and device fingerprints can still identify activity, and the VPN provider becomes another party you must trust. A VPN does not remove employer monitoring or account-based tracking.

### Does my phone have a built-in VPN?

Android includes VPN settings, and Google documents a built-in Google VPN on supported Pixel devices and locations. Apple documents per-app VPN for managed deployments, while ordinary iPhone control depends on the VPN app and service.

### Why does my internet stop when I connect to a VPN?

A connection can stop because of a failed VPN route, DNS conflict, kill-switch setting, protocol problem, or an incorrectly scoped split-tunnel rule. Disconnect, review the VPN and block-connections-without-VPN settings, then reconnect after correcting the rule.

### Do VPNs slow down the internet?

They can add routing and encryption overhead, and the result depends on the server, protocol, distance, and connection. Excluding a speed-sensitive app may let it use the direct route, but that is a provider-described use case rather than a guaranteed result.

### How do I stop my VPN from disconnecting?

Check the provider’s current device requirements, try another supported protocol, review battery-saving or background restrictions on mobile devices, and confirm that the network permits VPN traffic. Test the selected route again after reconnecting, especially if you changed split-tunneling rules.

Start with one exception, such as the banking app or printer, and confirm both the direct and protected routes. Then read the provider’s complete checkout summary and renewal amount before paying. If the main decision is banking traffic, continue with [Using a VPN With Banking Apps](https://tunnelverdict.com/blog/vpn-and-banking-apps/); if the concern is cost, compare [Free vs Paid VPN](https://tunnelverdict.com/blog/free-vs-paid-vpn/).

## Glossary

**Split tunneling:** A routing setup that sends selected traffic through the VPN and sends other traffic directly through the internet provider.

**Full tunneling:** Keeping every app on the VPN route, the right choice when all traffic should be protected.

**Excluded traffic:** Traffic that bypasses the VPN. It uses your ordinary IP address and does not receive the VPN tunnel's encryption.

**Inverse mode:** A setting where only the selected apps use the VPN. Proton calls it Include or Inverse mode, and Surfshark calls its version Reverse Bypasser.

**Subnet:** A range of network addresses. A subnet rule can include more destinations than you intended.

**CIDR range:** A way of writing a block of IP addresses as one rule. Proton supports CIDR ranges on Windows and Android.

**Kill switch:** A setting that blocks internet access if the VPN connection fails. It can behave differently when split tunneling is on.

**DNS:** The lookup that turns a website name into an address. A DNS mismatch can cause a location error for an excluded app.

Find more VPN guides on [Tunnel Verdict](https://tunnelverdict.com/). Have a question about your own setup? [Contact us](https://tunnelverdict.com/contact/) and include your device and the VPN you use.

- Setup
- Troubleshooting
- Phone
- Computer
- Explainer

Keep reading

## More VPN guides and reviews

Guide

### [VPN Not Connecting? Fixes for Phone, PC and Wi-Fi](https://tunnelverdict.com/blog/vpn-not-connecting/)

Fix VPN not connecting problems on phones, Windows 11 and Wi-Fi with server, protocol, kill switch and network troubleshooting steps.

[Read VPN Not Connecting? Fixes for Phone, PC and Wi-Fi](https://tunnelverdict.com/blog/vpn-not-connecting/)

Explainer

### [What a VPN Kill Switch Does and How to Turn It On](https://tunnelverdict.com/blog/vpn-kill-switch/)

Learn what a VPN kill switch does, how to turn it on by device, why internet stops, what plans cost, and how to test its limits safely.

[Read What a VPN Kill Switch Does and How to Turn It On](https://tunnelverdict.com/blog/vpn-kill-switch/)

Guide

### [Is a YubiKey Worth It? Security Keys Explained](https://tunnelverdict.com/blog/is-a-yubikey-worth-it/)

Is a YubiKey worth it? Keys start at $29 as a one-time purchase with no renewal. Compare models, supported accounts, backup keys and setup.

[Read Is a YubiKey Worth It? Security Keys Explained](https://tunnelverdict.com/blog/is-a-yubikey-worth-it/)