Last updated: July 2026. Written by Morgan Logan.
By default, a VPN routes all your internet traffic through an encrypted tunnel. Split tunneling changes that: it lets you decide which traffic goes through the VPN and which connects directly to the internet. That sounds useful. In the right scenario, it is. In the wrong one, it quietly defeats the purpose of using a VPN at all. This guide covers what split tunneling actually does, the three different types, when it is the correct tool, and when to leave it off.
For background on what a VPN actually does at the network level, start there.
What VPN Split Tunneling Actually Does
VPN split tunneling is a routing feature that divides your internet traffic into two separate paths. One path goes through the encrypted VPN tunnel, where your traffic is protected and your IP address is masked. The other path connects directly to the internet through your regular ISP connection, bypassing the VPN entirely. You control which apps, IP ranges, or domains use which path. Without split tunneling, every packet from every app on your device goes through the VPN, which adds encryption overhead and routes traffic through a VPN server before reaching its destination. Split tunneling eliminates that overhead for the traffic you designate as direct. The trade-off is explicit: traffic outside the tunnel is unencrypted and visible to your ISP and any network observer. Split tunneling is not a way to have full VPN protection with faster speeds. It is a deliberate choice to reduce protection scope in exchange for routing flexibility.
The Three Types of Split Tunneling
Not all split tunneling works the same way. Understanding the differences matters for configuring it correctly.
App-based split tunneling
The most common implementation. You specify which apps use the VPN and which connect directly. For example: your browser and torrent client route through the VPN; Netflix and your printer connect directly. Most consumer VPN providers implement this mode on Windows and Android. It is the easiest to configure and the right starting point for most users.
The limitation: you are trusting that each app only handles the data you think it handles. A browser configured to bypass the VPN carries your browsing data outside the tunnel (which may be exactly what you intended, or may be a problem depending on what you do in that browser).
URL/IP-based split tunneling
More granular than app-based. You specify domains or IP address ranges that bypass the VPN, while everything else goes through it. Useful for accessing local network resources (a home NAS, a work intranet) without routing that traffic through a VPN server in another country. Private Internet Access (PIA) offers the most complete URL-based split tunneling of any consumer VPN we tested on Windows.
This mode is more common in corporate VPN deployments than consumer ones. It requires knowing which IPs or domains you want to exclude, which is not practical for most personal use cases.
Inverse split tunneling
The most secure configuration. Instead of specifying what bypasses the VPN, you specify the few apps that are allowed to bypass it; everything else goes through the VPN by default. This is a secure-by-default approach: new apps you install are automatically protected unless you explicitly exclude them.
Standard split tunneling is opt-in protection (you add things to the VPN list). Inverse split tunneling is opt-out protection (you remove things from the VPN). When the goal is privacy with selective exceptions for streaming or local access, inverse split tunneling is the better design. NordVPN on Windows calls this mode the split tunneling blocklist.
When Split Tunneling Makes Sense
These are the specific scenarios where split tunneling solves a real problem rather than just adding complexity.
- Local network devices: Printers, NAS drives, smart home hubs, and Chromecast devices typically cannot be reached while a VPN is active, because the VPN routes traffic away from your local subnet. Excluding these devices or their IP range from the tunnel fixes the problem without disabling the VPN entirely.
- Banking apps that block VPN IPs: Some banks and financial services flag VPN IP addresses and refuse connections. Excluding the banking app from the VPN while keeping your browser protected is a practical workaround. The banking app connects with your real IP (which the bank already knows), while your browsing stays encrypted.
- Streaming speed on home networks: Streaming services occasionally detect and block VPN IP ranges. Routing Netflix or YouTube direct resolves buffering caused by VPN server congestion, at the cost of the streaming provider seeing your real IP.
- Dual VPN use case: If you use a corporate VPN for work and a personal VPN for privacy, split tunneling lets work apps route through the corporate VPN while personal traffic goes through your own provider. Without it, the two VPNs conflict.
- Gaming: Route the game client direct for lower ping; keep your browser and communication apps through the VPN. Note that if DDoS protection is your reason for using a VPN while gaming, the game client must stay in the tunnel. See our VPN kill switch guide for the related question of what happens when the VPN drops during a gaming session.
When Split Tunneling Is the Wrong Choice
Split tunneling is not a universal optimization. There are specific situations where enabling it creates real risk.
Public Wi-Fi: On a hotel, airport, or cafe network, any traffic outside the VPN tunnel is exposed to other devices on the same network and potentially to a malicious access point. Split tunneling that seemed fine at home becomes a liability the moment you connect to an untrusted network with the same configuration.
Torrenting with the torrent client excluded: If you configured split tunneling to route your torrent client direct (for speed), your torrent activity is visible to your ISP and to copyright monitoring organizations that log peer IP addresses. The point of using a VPN for torrenting is to keep that traffic protected. Excluding the torrent client defeats it entirely.
When you cannot audit app behavior: Some apps send data through unexpected channels. A messaging app that routes calls through a separate process may have that process bypass the VPN even if the main app is in the tunnel. If you cannot verify exactly what each excluded app does with your data, the risk is harder to assess.
For more on what a VPN actually does and what it protects against, that context matters when deciding what to exclude.
Split Tunneling by Platform: What Actually Works
Platform support varies significantly, and some providers have removed or limited split tunneling on specific operating systems.
Windows
The strongest split tunneling support across all major providers. NordVPN, ExpressVPN, and PIA all offer app-based split tunneling on Windows, with NordVPN and PIA also offering inverse mode. In our testing on Windows 11, all three implementations worked cleanly without routing leaks.
Android
Strong support. Android's VPN framework gives apps granular control over per-app routing. NordVPN, ExpressVPN, Mullvad, and PIA all support split tunneling on Android. You can also configure per-app VPN exclusions at the system level: Settings > Network and Internet > VPN > tap your VPN > Per-app VPN.
macOS
Limited. ExpressVPN supports app-based split tunneling on macOS. NordVPN removed macOS split tunneling in a 2024 update due to system extension changes in macOS Sequoia and has not restored it as of July 2026. Mullvad supports it on macOS. ProtonVPN does not. If split tunneling on macOS is a requirement, ExpressVPN or Mullvad are the current options.
iOS
Mostly unavailable. Apple's App Store policies and iOS VPN framework restrictions prevent true per-app split tunneling for most providers. ExpressVPN is the notable exception; it supports split tunneling on iOS through a proprietary implementation. NordVPN, Mullvad, and ProtonVPN do not offer split tunneling on iOS. If you need this feature on iPhone, ExpressVPN is currently the only major provider that delivers it. For iOS VPN configuration generally, see our VPN setup guide.
Is Split Tunneling Safe?
VPN split tunneling is safe when configured correctly for the right context, and a specific privacy risk when misconfigured or used on untrusted networks. Traffic routed outside the VPN tunnel is unencrypted and visible to your ISP, network operators, and any observer on the same network. Three concrete risks exist: first, if the wrong app is excluded (one that handles sensitive data), that data transmits unprotected. Second, on a device with malware, the direct-to-internet path bypasses any VPN-level DNS filtering or traffic inspection. Third, DNS queries for excluded apps may resolve through your ISP's DNS rather than the VPN's, leaking browsing intent even if content is encrypted. The mitigation for all three is the same: use inverse split tunneling (secure-by-default, explicit exclusions only), audit your exclusion list regularly, and never assume a split tunneling configuration safe for home use is equally safe on public Wi-Fi.
Which VPNs Support Split Tunneling?
In our testing across Windows 11, Android 15, macOS Sequoia, and iOS 18, here is the current state of split tunneling support:
| VPN | Windows | macOS | Android | iOS | Inverse mode? |
|---|---|---|---|---|---|
| NordVPN | Yes | No | Yes | No | Yes (Windows) |
| ExpressVPN | Yes | Yes | Yes | Yes | No |
| Mullvad | Yes | Yes | Yes | No | No |
| PIA | Yes | No | Yes | No | Yes |
| ProtonVPN | Yes | No | Yes | No | No |
- ExpressVPN is the only provider with split tunneling on all four platforms, including iOS.
- NordVPN offers the most flexible Windows implementation with both standard and inverse modes. The macOS removal is a meaningful gap.
- Mullvad supports split tunneling but their documentation explicitly notes it reduces the privacy guarantees their architecture is designed to provide.
- PIA has the most granular URL-based routing on Windows, useful for IP-specific exclusions.
For detailed scores and test results: see our NordVPN review and Mullvad VPN review.
Frequently Asked Questions
Does split tunneling slow down the VPN?
No. It reduces load on the VPN connection, which can make the protected tunnel faster. Traffic going direct uses your full ISP speed without VPN overhead. Split tunneling will not slow down your VPN; it may marginally improve the speed of traffic that stays in the tunnel.
Should I enable split tunneling by default?
Only if you have a specific reason. If you are uncertain which apps to exclude or how your traffic is routed, leave split tunneling off. The default (all traffic through VPN) is simpler, safer on unfamiliar networks, and removes the risk of misconfiguration. Enable it for a specific solved problem: a banking app that blocks VPN IPs, local printer access, a streaming speed issue.
Does iOS support VPN split tunneling?
Mostly no. Apple's iOS VPN framework blocks the per-app routing controls that split tunneling requires. ExpressVPN is the only major provider with a working iOS implementation as of July 2026. NordVPN, Mullvad, ProtonVPN, and PIA do not offer split tunneling on iOS.
What is the difference between split tunneling and a kill switch?
They solve different problems. A kill switch blocks all internet traffic when the VPN drops unexpectedly. Split tunneling intentionally routes some traffic outside the VPN at all times. They can work together: the kill switch protects the apps routed through the VPN, while split-tunneled apps bypass both the VPN and the kill switch. See our VPN kill switch guide for a full explanation.
