Split tunneling is the right setting when you want some traffic protected by a VPN while a bank, printer, streaming service, game, or local app uses your normal connection. You choose which traffic bypasses the VPN, then confirm that the selected app or website shows the route you intended.
The practical choice is simple: keep full tunneling when every app should use the VPN. Use split tunneling when one exception needs your ordinary IP address, local network, or better direct performance. Before paying, match the feature to your device, check the renewal price, and confirm whether a kill switch works with your chosen rules.
Key takeaways
- Put banking, printers, local services, or selected high-bandwidth apps outside the VPN only when they need the direct route.
- Use app, website, IP, subnet, or inverse rules according to what your device and provider support.
- Excluded traffic uses your ordinary IP address and does not receive the VPN tunnel’s encryption.
- Check the provider’s exact operating-system support, kill-switch behavior, billing term, renewal amount, and refund rules.
- Make three routing groups: always through VPN, always outside VPN, and test before relying on it.
Which apps should use split tunneling for banks, printers, streaming, and everyday tasks?
A banking app may reject a VPN server address or require the IP address associated with your normal location. A printer, smart-home device, or local network service may stop responding because its traffic needs to stay on the home network. In those cases, excluding only the affected app or website can solve the routing problem while other traffic stays inside the VPN.
Streaming services and games can create a different reason. A streaming website may work only with your ordinary local IP address, while a game, video call, or large download may perform better through the direct connection. Surfshark describes excluding high-data apps as a way to let them use the ordinary route, but that is a provider claim rather than an independent speed measurement. If Netflix displays a proxy message, work through the Netflix proxy error fixes.
Your short routing list should have three groups: apps that should always use the VPN, apps that should always use the normal connection, and apps you will test before relying on them. Work or school services may need the VPN while personal apps use the direct route. A local streaming service may need the opposite.
A VPN encrypts the connection between your device and the VPN server and changes the IP address websites see for protected traffic. It does not stop an account, cookie, employer system, school system, or device fingerprint from identifying you. For the broader boundary, see What Is a VPN and What Does It Do.
How does split tunneling work, and which type do you need?
A split tunnel creates two routes at once. Selected traffic travels through the encrypted VPN tunnel and appears to come from the VPN server’s IP address. Excluded traffic connects directly through your internet provider and appears to use your ordinary IP address.
App-based rules are the easiest choice when one program needs an exception. You can exclude a banking app, printer utility, game, or streaming app, or use inverse mode so only selected apps use the VPN. NordVPN and Surfshark document both ordinary exclusions and inverse routing. Proton calls its inverse option Include or Inverse mode, while Surfshark calls its version Reverse Bypasser.
Website or domain rules suit browser traffic. NordVPN supports website exclusions through browser extensions, Proton supports domain rules in its browser extension, ExpressVPN documents website rules on desktop, and Surfshark supports website exclusions through Bypasser. This approach can be more precise than excluding an entire browser.
IP-address and subnet rules suit network destinations rather than individual programs. Proton supports IP addresses and CIDR ranges on Windows and Android. ExpressVPN documents IPv4, IPv6, and subnet rules on desktop. NordVPN’s Linux Allowlist works with ports, port ranges, and subnets instead of ordinary app-based rules.
The practical choice is to use the narrowest rule that solves the problem. Exclude one app when one app fails. Use a website rule when only a domain needs the direct connection. Use an IP or subnet rule for a printer, server, or network range. Use inverse mode only when you can keep track of every app that must use the VPN.
Which VPN apps support split tunneling on your device?
Platform support matters more than a general provider ranking. NordVPN documents split tunneling for Windows 10 and 11, Android, Android TV, and browser extensions. Its Linux Allowlist handles ports and subnets rather than standard app-based rules. NordVPN is a fit when you use one of those supported platforms and want straightforward app or browser exclusions.
Proton VPN documents split tunneling for Windows, Linux GUI, macOS, Android, Android TV, and its browser extension. Its rules can cover apps, IP addresses, CIDR ranges, and domains depending on the platform. Proton documents split tunneling as a paid feature, so its free tier does not automatically include it.
ExpressVPN documents support for Windows, macOS, Linux, and Android. Its desktop rules can cover apps, websites, IP addresses, and subnets, while Android uses app-based rules. ExpressVPN suits a reader who needs several rule types on a desktop, but the exact behavior can differ by protocol and operating system.
Surfshark documents Bypasser for Windows, macOS, Android, iOS, and Chrome, Firefox, and Edge extensions. It supports apps, websites, and IP addresses in the documented settings. On iOS, the documented method is website-based. Reverse Bypasser is documented for Android and as app-only on Windows.
CyberGhost documents app-based split tunneling on Android. That makes it a narrower choice for this particular task, especially if your main device is a desktop, iPhone, or streaming platform.
Google documents split-tunnel capability for many Chrome and Android VPN apps, as well as the built-in OpenVPN client on Chromebook. Apple documents per-app VPN for managed iPhone and iPad deployments, not as a general consumer switch inside every ordinary iPhone VPN app. Check the device’s Settings → Network & internet → VPN menu and the manufacturer’s documentation before subscribing.
For a provider choice, Surfshark fits readers who want documented support across iOS as well as desktop and mobile platforms. Proton VPN fits readers who need several rule types and can use a paid plan. ExpressVPN fits desktop users who need website, IP, and subnet rules. The tradeoff in every case is that a documented feature still depends on the exact app version, protocol, and platform.
What does split tunneling cost, and what renews?
Prices below are for United States readers and were checked October 28, 2026. A free tier, free trial, and money-back guarantee are different. A free tier costs nothing, a trial has its own eligibility and billing rules, and a money-back guarantee requires an initial paid purchase.
Proton also offers Proton Free at $0, with one simultaneous device and servers in 10 randomly selected countries. Proton documents split tunneling as a paid Proton VPN feature, so the free tier is not the same as the split-tunneling plan. Proton offers a 30-day money-back guarantee, with separate refund handling for App Store and Google Play purchases.
Surfshark advertises three extra months as bonus time. Its 30-day refund applies to the initial purchase, while recurring payments are non-refundable under the stated terms. ExpressVPN’s US checkout price is $83.72 for the first 28 months and $99.95 annually. Its standard 30-day guarantee is for new users and excludes renewal purchases and purchases made through Apple App Store or Google Play.
Before paying, read the complete checkout summary. Confirm the amount due upfront, billing term, renewal amount, refund route, and any trial eligibility or cancellation rule shown by the provider or app store.
What does excluded traffic give up?
Excluded traffic does not use the VPN server’s IP address. It also does not use the VPN tunnel’s encryption, so the destination, internet provider, and local network see the ordinary connection path for that traffic. This can be the right tradeoff for a bank that needs a local IP or a printer that needs the home network, but it should be intentional.
Accounts, cookies, device fingerprints, employer systems, school systems, and logged-in services can still identify you. EFF describes a commercial VPN as shifting trust from the internet provider to the VPN provider. It does not provide complete protection from tracking, malware, government surveillance, or streaming blocks.
DNS can create a separate problem. NordVPN documents a situation where an excluded streaming app sees the internet provider’s IP address while DNS still points through NordVPN. The mismatch can produce a location error. If an app still reports the wrong location after you add an exclusion, check the DNS behavior and reconnect.
IP exclusions can be broader than they look. ExpressVPN warns that public IP whitelisting can affect unrelated websites that share the same infrastructure. A subnet rule can also include more destinations than you intended, so use the narrowest address range that meets the need.
Split tunneling can also change kill-switch coverage. Proton says its standard or advanced kill switch is incompatible with split tunneling on most platforms, although Windows supports both together. Check the chosen app’s current requirements before relying on a kill switch. For a separate explanation of the setting, see What a VPN Kill Switch Does and How to Turn It On.
How do you set up and check split tunneling?
Start with the routing list, then use the provider’s settings. NordVPN places the feature under Settings and Split tunneling on supported platforms. Android uses Profile → Settings → Split tunneling. Android TV uses Trusted apps, and browser extensions use Exclude from VPN for websites.
Proton places the feature in Settings or a Split tunneling shortcut. Enable it, choose Exclude or Include/Inverse mode, and add apps, IPs, CIDR ranges, or domains supported by that platform. Reconnect when the app requests it.
ExpressVPN uses Profile → Split Tunneling. Enable the feature, add apps or IP addresses, and choose Bypass VPN or Only VPN. Its documentation says WireGuard requires disconnecting and reconnecting before changes apply.
Surfshark uses Settings → VPN Settings → Bypasser. Add apps, websites, or IP addresses. On iOS, use the documented website method rather than assuming app-level exclusions. CyberGhost requires disconnecting first, then opening VPN settings → App Split Tunnel on Android and selecting the apps to exclude.
After saving a rule, check both routes. An excluded website should show the ordinary IP address, while a protected website should show the VPN server’s IP address. A printer or local device should respond, and the protected app should continue to use the VPN. A DNS check can help when a streaming or location result does not match the selected route. If needed, run a DNS leak test and fix a leak.
Do not assume that a rule remains active after an app update, protocol change, reconnect, or operating-system update. Confirm the selected route before using a bank, work account, printer, or local streaming service.
What are the Android, iPhone, and Chromebook limits?
Android gives you VPN settings for adding or using a VPN profile, and Google documents a built-in Google VPN on supported Pixel devices and locations. Android also supports work-profile VPN routing. The provider app still controls whether you get app, website, IP, or inverse rules.
iPhone needs more care. Apple documents per-app VPN for managed devices, while ordinary consumer iPhone control depends on the VPN app and service. Surfshark documents website exclusions on iOS, but you should not assume that an iPhone app can freely exclude any individual app.
Chromebook supports the built-in OpenVPN client, and Google identifies printers and local-network devices as split-tunneling use cases. Chrome and Android VPN apps may provide additional capability, but support varies. Check the Chromebook’s VPN settings and the app’s current requirements before relying on a rule.
The practical result is that Android usually provides the broadest consumer choices, iPhone often has narrower controls, and Chromebook depends on whether you use its built-in client or a compatible app.
What legal and terms-of-service boundaries apply?
Use split tunneling in ways allowed by the law where you are and by the terms of the VPN provider, network owner, app, website, employer, school, or streaming service. ExpressVPN’s terms place responsibility on the user to assess compliance with applicable laws and regulations. Surfshark’s terms state that its refund applies to the initial purchase, and its feature page says illegal activity violates its terms.
A VPN does not grant permission to bypass a workplace policy, school rule, account restriction, copyright restriction, geographic license, fraud control, or service access condition. Check the relevant provider and network terms before routing traffic outside or through a VPN. The same check applies when a bank, employer, school, or streaming service blocks VPN traffic.
Frequently asked questions
Should I use split tunneling on my VPN?
Use it when a specific app, website, printer, local service, or high-bandwidth activity needs the ordinary connection while other traffic stays protected. Keep full tunneling enabled when every app should use the VPN route.
What is a VPN split tunnel?
It is a routing setup that sends selected traffic through the VPN and sends other traffic directly through the internet provider. The direct traffic uses the ordinary IP address and does not receive the VPN tunnel’s encryption.
Is split tunneling a security risk?
It can reduce protection for excluded traffic because that traffic follows the ordinary ISP and local-network path. Use exclusions for trusted apps and websites, and remember that the VPN does not protect traffic you deliberately send outside it.
Why would you disable split tunneling?
Disable it when the excluded app no longer needs a local IP, when every connection should use the VPN, or when your platform’s kill switch does not cover split traffic. This also removes confusion from old or overly broad rules.
Is there a free VPN with split tunneling?
Proton VPN has a free tier at $0, but Proton documents split tunneling as a paid Proton VPN feature. A free tier is separate from a free trial and from a money-back guarantee, so check the exact plan and billing channel. Prices checked October 28, 2026.
Which VPN is best for split tunneling?
No single choice is best for everyone. Surfshark fits readers who need documented app and website exclusions across several platforms, Proton fits readers who need several rule types on a paid plan, and ExpressVPN fits desktop users who need app, website, IP, and subnet rules.
Can I be tracked at work if I use a VPN?
Yes. Workplace systems, managed devices, logged-in services, cookies, and device fingerprints can still identify activity, and the VPN provider becomes another party you must trust. A VPN does not remove employer monitoring or account-based tracking.
Does my phone have a built-in VPN?
Android includes VPN settings, and Google documents a built-in Google VPN on supported Pixel devices and locations. Apple documents per-app VPN for managed deployments, while ordinary iPhone control depends on the VPN app and service.
Why does my internet stop when I connect to a VPN?
A connection can stop because of a failed VPN route, DNS conflict, kill-switch setting, protocol problem, or an incorrectly scoped split-tunnel rule. Disconnect, review the VPN and block-connections-without-VPN settings, then reconnect after correcting the rule.
Do VPNs slow down the internet?
They can add routing and encryption overhead, and the result depends on the server, protocol, distance, and connection. Excluding a speed-sensitive app may let it use the direct route, but that is a provider-described use case rather than a guaranteed result.
How do I stop my VPN from disconnecting?
Check the provider’s current device requirements, try another supported protocol, review battery-saving or background restrictions on mobile devices, and confirm that the network permits VPN traffic. Test the selected route again after reconnecting, especially if you changed split-tunneling rules.
Start with one exception, such as the banking app or printer, and confirm both the direct and protected routes. Then read the provider’s complete checkout summary and renewal amount before paying. If the main decision is banking traffic, continue with Using a VPN With Banking Apps; if the concern is cost, compare Free vs Paid VPN.
Glossary
Find more VPN guides on Tunnel Verdict. Have a question about your own setup? Contact us and include your device and the VPN you use.
