Split Tunneling Explained: Do You Need It?

What Is Split Tunneling, Exactly?

By default, a VPN works as an all-or-nothing tunnel: once you connect, every app on your device, and every byte of traffic those apps send, gets routed through the encrypted connection to the VPN server. Your browser, your email client, your game launcher, your smart-home app — all of it goes through the same tunnel, gets the same encryption, and appears to come from the same VPN server IP address.

Split tunneling changes that default. It is a setting, usually found in a VPN app's preferences, that lets you split your traffic into two paths at once: some of it goes through the VPN tunnel as usual, and the rest goes directly out over your normal internet connection, bypassing the VPN entirely. Both paths are active simultaneously — you are not switching the VPN on and off, you are running both routes side by side and deciding, app by app or in some cases site by site, which one each piece of traffic uses.

The most common implementation is app-based split tunneling: you pick specific apps (a browser, a streaming app, a torrent client) to either always use the VPN or always bypass it, and everything else on the device follows whatever the app's default rule is. Some VPN apps also offer URL-based or IP-based split tunneling, where you specify domains or IP address ranges instead of whole apps — useful if, say, you want your browser to use the VPN for most sites but bypass it automatically for your bank's website or your company's internal network.

The core idea behind a split tunneling vpn setup, whichever variant you use, is the same: you are trading the simplicity of "everything is protected the same way" for the flexibility of "I decide, connection by connection, what gets encrypted and rerouted, and what does not."

How Does Split Tunneling Actually Work Behind the Scenes?

Understanding roughly what happens under the hood makes it much easier to reason about when split tunneling helps and when it does not.

App-based split tunneling

When you add an app to a split tunneling list, the VPN app tags that application's network traffic — usually by process name or ID — and routes packets from that specific process differently than packets from everything else. Depending on how you have configured it, the app you selected either always goes through the VPN's virtual network adapter (and gets the VPN server's IP address, encryption, and any geographic routing that implies), or always goes directly out through your device's normal network interface, bypassing the VPN adapter and using your real IP address and your normal, unencrypted route to the internet. Everything not on the list follows whichever default you set — either "route through VPN unless excluded" or "bypass VPN unless included," depending on the app's design.

Inverse split tunneling

Some apps frame this as "inverse split tunneling": instead of choosing which apps use the VPN, you choose which apps are excluded from it, with everything else defaulting to the VPN tunnel. Functionally this produces the same outcome as app-based split tunneling — it is really just a difference in which list you are asked to build, the include list or the exclude list.

URL/domain-based and IP-based split tunneling

A smaller number of VPN apps support routing decisions based on the destination rather than the source app — for example, "always bypass the VPN for mybank.com" or "always route traffic to this specific IP address range through the VPN." This is more granular than app-based routing because a single app, like a browser with many tabs open, can have some of its traffic go through the VPN and some bypass it depending on which site each tab is talking to. It is also less commonly available, since it requires the VPN app to inspect destination traffic rather than just tag it by source process.

What does not change either way

Regardless of which variant you use, split tunneling does not weaken the encryption or security of the traffic that does go through the VPN — that portion of your traffic is protected exactly as it would be with the VPN fully on. What changes is that the traffic you excluded is not protected by the VPN at all; it travels over your normal connection exactly as if you were not using a VPN for that particular app or site.

Why Would You Actually Want to Use Split Tunneling?

Split tunneling solves a specific, recurring set of problems that come up once you start using a VPN regularly rather than just occasionally. A few of the most common reasons people turn it on:

• Accessing local network devices while connected. When a full VPN tunnel is active, your device is routed as if it is physically at the VPN server's location, which commonly breaks access to devices on your own local network — a home printer, a network-attached storage drive, a smart TV, or a router's admin page. Excluding the app you use to reach those devices (or your whole device's local traffic, on VPNs that support that distinction) from the VPN keeps local access working while everything else stays protected.
• Keeping bandwidth-heavy tasks fast. Routing traffic through a VPN adds some overhead from encryption and the extra hop to a VPN server, which can meaningfully affect large downloads, video calls, or cloud backups, especially to a nearby local server that does not benefit from the VPN's rerouting. Excluding that specific task from the tunnel while keeping browsing or streaming apps protected is a common way to get both speed and protection where each matters most.
• Avoiding conflicts with banking or government apps. Some banks, payment services, and government portals flag or block logins that appear to come from a VPN's IP address, sometimes triggering extra verification steps or an outright block. Excluding that one app from the VPN sidesteps the problem without requiring you to disconnect the VPN for everything else.
• Using a work VPN and a personal VPN at the same time. If your employer requires a corporate VPN client for work traffic, running a second personal VPN for everything else can conflict — routing tables clash, or the corporate VPN's security policy blocks a second tunnel outright. Split tunneling on the personal VPN, configured to exclude the corporate VPN client itself, is one common way people avoid that conflict.
• Region-specific access for one app while browsing normally otherwise. Some people want a specific streaming or shopping app to appear to connect from a particular country while the rest of their browsing continues from their real location and IP address — split tunneling lets you apply the VPN to just that one app.
• Reducing simultaneous load on the VPN connection. If several apps are competing for bandwidth through a single VPN tunnel, moving traffic that does not need protection outside the tunnel frees up more of the tunnel's capacity for the traffic that does.

Notice that none of these reasons require using split tunneling for every session — many people leave it off entirely and only reach for it in the specific moments one of the scenarios above comes up.

What Are the Downsides or Risks of Split Tunneling?

Split tunneling is a genuine tradeoff, not a strictly better version of a VPN, and it is worth being clear-eyed about what you give up.

• Excluded traffic is genuinely unprotected. Anything you route outside the VPN tunnel gets none of the VPN's benefits for that traffic — your real IP address is visible to those sites and to your ISP, and the traffic is not re-encrypted by the VPN. This is the entire point of the feature, but it is easy to forget in practice which apps you excluded weeks after setting it up.
• It can undermine the reason you wanted a VPN in the first place. If your main goal is hiding your overall browsing pattern from your ISP, or maintaining a consistent, private IP address across everything you do, split tunneling works against that goal by design, since your ISP can still see the traffic you excluded, and websites can still see your real IP for that traffic.
• It adds a layer of configuration to keep track of. A full-tunnel VPN is simple to reason about: on means everything is protected, off means nothing is. Split tunneling means the actual protection state depends on a list you configured, possibly some time ago, which is easy to lose track of — especially after installing new apps that are not yet added to either list.
• Not every platform or VPN app supports it, or supports it fully. Split tunneling is more commonly available on desktop and Android apps than on iOS, where Apple's platform restrictions limit how much control apps are allowed over system-wide network routing. A feature that works smoothly on your laptop may not exist at all in the same provider's iPhone app.
• DNS leaks are a known edge case. Depending on how a specific VPN app implements split tunneling, DNS lookups (which translate website names into IP addresses) for excluded traffic can sometimes leak information about which sites you are visiting even when the connection itself is routed correctly, or vice versa. This is an implementation detail that varies by app rather than a universal rule, but it is a real category of subtle misconfiguration worth being aware of if DNS-level privacy specifically matters to you.

None of this means split tunneling is a bad feature — it solves real, common problems. It means it is a deliberate tradeoff of protection for flexibility on the specific traffic you exclude, and it is worth using intentionally rather than turning on and forgetting about.

Do You Actually Need Split Tunneling?

This is really the core question, and the honest answer is: most people do not need it to get real value from a VPN, but a meaningful subset of users run into a specific, recurring friction point that split tunneling directly solves. A simple way to think about it is to check whether any of the following describes your situation.

You probably want split tunneling if:

• You regularly need to reach devices on your home or office local network (printers, NAS drives, smart home devices, a router's admin panel) while the VPN is connected, and reconnecting the VPN off and on to do so is annoying.
• You use a specific banking, government, or payment app that reliably has problems when a VPN is active, and disconnecting the VPN entirely every time is more disruptive than excluding just that one app.
• You already run a required corporate/work VPN and want a personal VPN for other traffic without the two conflicting.
• You do large downloads, video calls, or other bandwidth-sensitive tasks regularly and notice a meaningful, consistent slowdown with the VPN on for those specific tasks, but still want VPN protection for browsing and other apps.
• You want one specific app or service to use a VPN's regional routing while the rest of your activity uses your real location.

You probably do not need split tunneling if:

• Your main reason for using a VPN is general privacy from your ISP, or protection on public Wi-Fi, and you are comfortable with the small, occasional inconvenience of toggling the VPN off briefly for the rare app that has issues with it, rather than maintaining a standing exclusion list.
• You are not currently running into any of the specific friction points above — nothing is broken, so there is nothing split tunneling needs to fix for you yet.
• You would rather keep your setup simple and know, with certainty and without checking a configuration list, that "VPN on" means everything is protected.
• Privacy consistency matters more to you than convenience — for instance, if you specifically do not want your ISP to see a partial picture of your activity that could be pieced together from whatever traffic split tunneling left unencrypted.

It is also worth noting that split tunneling is not a permanent, binding decision. It is a setting you can turn on when a specific need comes up — say, you start a new job that requires a corporate VPN — and turn back off once that need passes, rather than something you have to commit to using indefinitely the first time you try it.

How Do NordVPN, Proton VPN, PureVPN, and FastestVPN Handle Split Tunneling?

Split tunneling support, exact naming, platform availability, and default configuration can all change between app versions, so the most reliable way to confirm what is available to you is always the current settings menu of the specific app on the specific device you plan to use — this section is meant to help you know what to look for, not to replace checking yourself.

NordVPN is a large, long-established provider with apps across desktop, mobile, and router platforms, and split tunneling (app-based, letting you choose which apps use the VPN) is a feature reasonable to look for in its settings on the platforms where it is supported — as with any provider, availability can differ between desktop and mobile versions of the app. Proton VPN, built by the team behind Proton Mail with a strong privacy-first reputation and a genuine free tier, also includes split tunneling settings worth checking directly in its app preferences for your platform. PureVPN, generally positioned around a generous simultaneous-device allowance at a lower price point, includes split tunneling functionality worth confirming per platform before you rely on it for a specific use case. FastestVPN, a more budget-focused, entry-level option, is worth checking the same way — confirm the specific split tunneling mode (app-based, URL-based, or both) and platform availability directly inside the current version of the app rather than assuming from the brand's general marketing.

The useful takeaway here is not a ranking of which provider's split tunneling is "best" — we do not publish comparative feature-quality scores without independently verified, ongoing testing, and no price or star rating is claimed for any of the four providers on this site. It is a checklist: whichever of these four you use or are considering, open the app, look in settings for "split tunneling," "app exceptions," or similarly worded options, confirm the mode it supports (app-based versus URL/IP-based), and confirm it is available on your specific device — rather than assuming every platform behaves the same as the one you are most familiar with.

How Do You Set Up Split Tunneling? (General Steps)

Exact menu names and steps vary between VPN apps and between platforms, but the general process for turning on and configuring split tunneling looks similar across most providers:

1. Open your VPN app's settings or preferences

Look for a settings icon, usually a gear or three-line menu, within the main VPN app screen — split tunneling is virtually always a setting rather than something in the main connect/disconnect screen.

2. Find the split tunneling section

It may be labeled "split tunneling," "app exceptions," "bypass," "VPN exceptions," or something similar depending on the app. If you cannot find it by browsing, the provider's own support site or in-app search is usually the fastest way to locate it, and also the fastest way to confirm whether the feature exists at all on your platform if you suspect it might not.

3. Choose the mode, if the app offers more than one

Some apps ask you to choose between "only these apps use the VPN, everything else bypasses it" and "everything uses the VPN except these apps." Pick whichever matches how you actually want most of your traffic to behave by default, since this determines what happens to any app you have not explicitly added to the list.

4. Add the specific apps (or URLs/IPs, if supported) you want to include or exclude

Most apps present a list of installed applications you can toggle individually. Add only the apps relevant to your actual need — for example, just the app that has trouble with the VPN, or just the app you specifically want to route through the VPN — rather than trying to configure everything at once.

5. Reconnect the VPN and test

Split tunneling settings commonly apply from your next connection rather than instantly to an already-active session. After reconnecting, check a site that displays your public IP address from within both an included and an excluded app to confirm the routing is behaving as expected — an included app should show the VPN server's IP, an excluded app should show your real IP.

6. Revisit the list periodically

New apps you install are not automatically added to an existing split tunneling list, and old apps you no longer use can be safely removed. Treating this as a list you check back on occasionally, rather than a one-time setup, avoids the most common source of confusion — assuming an app is protected (or intentionally excluded) when the list was actually configured before that app existed on your device.

What Are the Most Common Split Tunneling Problems?

A handful of issues come up often enough with split tunneling to be worth knowing about before you rely on it:

• Forgetting what is excluded. The single most common practical problem is simply losing track, over time, of which apps are excluded from the VPN — leading to an assumption of protection that is not actually accurate for a specific app. Periodically reviewing the list, as noted above, is the straightforward fix.
• Newly installed apps default unpredictably. Depending on the app's "include" versus "exclude" mode, a newly installed app you have not yet configured may default to being protected or unprotected — and that default is easy to get backward from what you assumed. Check the mode explicitly rather than guessing.
• DNS requests not following the same rule as the rest of the traffic. As mentioned earlier, some split tunneling implementations handle DNS lookups separately from the rest of an app's traffic, which can create a mismatch between what you expect (based on the app's inclusion/exclusion setting) and what actually happens at the DNS level. This is implementation-specific and worth testing directly if DNS-level privacy is a specific concern for you.
• Reduced platform support compared to the full VPN feature set. Split tunneling is commonly less available, or available in a more limited form, on iOS compared to desktop or Android, due to platform-level restrictions on background network control that Apple imposes on all apps, not something specific to any one VPN provider. If you specifically need split tunneling on an iPhone, confirm it is supported before assuming.
• Interference from other network or security software. Firewalls, antivirus network filters, or a second VPN running at the same time can sometimes conflict with a split tunneling configuration's routing rules. If routing does not behave as expected, temporarily disabling other network software one at a time is a reasonable way to isolate the cause.
• Assuming split tunneling protects you the same way a full tunnel does. This is less a "bug" and more a conceptual mismatch — split tunneling is not a lighter-weight version of full VPN protection, it is a deliberate reduction of protection for whatever you exclude, in exchange for convenience. Problems tend to arise less from the feature malfunctioning and more from expecting it to behave like a full tunnel when, by design, it does not.

Does Split Tunneling Work the Same Way on a Router-Level VPN?

Most of what this article covers assumes you are running the VPN app directly on the device — a laptop, phone, or tablet — that is doing the split tunneling. Setting up a VPN at the router level, so every device on your home network is covered automatically, changes the picture, because a router generally does not know which app on a given device generated a particular packet — it only sees IP addresses and network traffic, not the process or app name behind it.

That means router-level split tunneling, where it is supported at all, typically works per-device rather than per-app: you can often configure certain devices on your network (a smart TV, a game console, a specific laptop) to bypass the VPN while others use it, but you generally cannot say "let this one app on this laptop bypass the VPN while everything else on the same laptop uses it" from the router alone. If you need that finer, app-level control on a specific device, the more reliable approach is running the VPN app's own split tunneling feature on that device directly, in addition to or instead of a router-level VPN, rather than expecting the router to make app-level decisions it is not generally positioned to make.

Not every router supports VPN configuration at all, and not every VPN provider offers router-compatible setup instructions or firmware, so if a whole-home, router-level VPN with selective device bypass is what you are after, checking the specific provider's router support documentation is a necessary step before assuming it works the way app-based split tunneling does.

Split Tunneling for Gaming, Torrenting, and Other Bandwidth-Sensitive Uses

A few specific activities come up often enough in split tunneling discussions to be worth addressing directly, since the right approach differs by activity.

Gaming

Online games are sensitive to latency (ping) in a way that raw bandwidth-heavy tasks like downloads are not, and routing game traffic through a distant VPN server can add noticeable delay. Many people who use a VPN for privacy on other apps choose to exclude their game client from the tunnel specifically to avoid that added latency, while keeping the VPN on for browsing, streaming, or other traffic on the same device. If you specifically want a VPN for gaming — for example, to reduce exposure to denial-of-service attacks sometimes aimed at gamers' visible IP addresses, or to access a region-locked game server — the opposite approach applies: include the game client in the tunnel and pick a VPN server as geographically close as practical to minimize the added latency.

Torrenting

If part of why you use a VPN is to keep torrent traffic associated with the VPN's IP address rather than your own, split tunneling is worth using carefully here: you want your torrent client specifically included in the VPN tunnel (not excluded), ideally paired with a working kill switch so that if the VPN drops, torrent traffic stops rather than silently falling back to your real IP address. Excluding a torrent client from split tunneling would defeat the purpose entirely for that traffic, so double-check the direction of your configuration — included, not excluded — if this is your goal.

Large downloads and cloud backups

For tasks like syncing a large cloud backup or downloading big files from a nearby, trusted server, the privacy benefit of routing through a VPN is often smaller relative to the speed cost of the extra hop and encryption overhead. Excluding these specific apps from the tunnel while leaving the VPN on for everything else is a common, reasonable way to keep both fast transfers and general protection.

The common thread across all three: split tunneling is only useful when you are deliberate about which direction — included or excluded — matches what you are actually trying to accomplish for that specific activity, rather than applying the same default to everything.

Split Tunneling vs. Full-Tunnel VPN: When Should You Choose Each?

Framed simply, a full-tunnel VPN (the default, everything-through-the-VPN mode) and split tunneling are not competing products — split tunneling is a mode within the same VPN app, and most people move between the two depending on what they are doing at a given moment, rather than permanently committing to one.

Choose full-tunnel (VPN on, no exceptions) when: you are on public or untrusted Wi-Fi and want everything protected without having to think about which app is which; your priority is consistent privacy from your ISP across all your activity; you are not currently running into any specific friction that split tunneling would solve; or you simply want the mental simplicity of "on means everything is protected."

Choose split tunneling when: you have a specific, recurring need — local network access, a banking app that conflicts with the VPN, a required work VPN running alongside a personal one, or a bandwidth-heavy task that does not need encryption — and you would rather solve that one problem with a targeted exception than by disconnecting the VPN entirely, losing protection for everything else in the process.

A genuinely reasonable approach many people land on is using full-tunnel mode as the default and only reaching for split tunneling configuration when a specific, concrete problem shows up — rather than treating split tunneling as something to configure exhaustively on day one before you know which apps, if any, will actually give you trouble.