How to Set Up VPN Split Tunneling

To set up split tunneling, open your VPN app's settings, find the Split Tunneling option, and choose which apps or sites should skip the VPN while everything else stays protected. It's a per-app routing rule, and it solves the annoyance of flipping the VPN on and off for one program. This guide shows how to configure it and when it's the right tool.

What split tunneling does for your setup

Split tunneling lets some traffic use the VPN and some use your normal connection at the same time. That's useful when a VPN gets in the way of a specific task: a banking app that blocks VPNs, a local printer or media server you can't reach through the tunnel, or a service that runs slowly on a distant server. Instead of disconnecting the VPN entirely and dropping protection for everything, you carve out an exception for just that app.

Two modes to understand first

Most apps offer split tunnelling in one of two directions, and picking the right one avoids mistakes. In 'bypass' mode, the VPN protects everything except the apps you list — good when only one or two apps need the real connection. In 'only these apps' (inverse) mode, the VPN protects only the apps you list and everything else uses your normal connection — good when you want just a browser tunnelled. Choose bypass mode unless you specifically want the narrower coverage.

Set it up on Windows

Windows apps have the most complete split-tunnelling support. The steps:

1. Open the app's Settings and find Split Tunneling, usually under a Connection or Advanced section.
2. Turn it on and choose the mode — bypass ('disable VPN for selected apps') or inverse ('enable VPN only for selected apps').
3. Add the apps by browsing to their executable or picking from the installed list.
4. Save, reconnect if prompted, and test each app to confirm it's using the connection you intended.

Set it up on Android

Android split tunnelling is common and works per app. In the VPN app's settings, open Split Tunneling (sometimes called Bypass VPN or App exclusions), choose whether the listed apps bypass the VPN or are the only ones using it, then tick the apps from your installed list. It applies immediately. This is the tidiest way to keep, say, a banking app on the normal connection while the rest of the phone stays tunnelled. Note that iOS does not offer per-app split tunnelling in the same way, due to platform limits.

When not to use it

Split tunnelling is a convenience feature, not a privacy upgrade — anything you route outside the VPN uses your real IP, which is the whole point but also the risk. Don't exclude a browser or messaging app you actually want protected. And remember the kill switch and split tunnelling interact: excluded apps keep working even when the VPN drops, because they were never in the tunnel. Use split tunnelling deliberately, for specific apps, and review the list occasionally.

Fitting it into your setup

Set up the VPN normally first, confirm it works, then add split-tunnelling rules only for the apps that need them. If you're just getting started, how to set up a VPN covers the core steps, and how to use a VPN explains the day-to-day decisions split tunnelling helps with.

Real examples of good split-tunnelling rules

It's easier to get the rules right with concrete cases. A banking app that refuses to work over a VPN is the classic candidate for a bypass rule — exclude just that app and the rest of your device stays protected. A local media server or network printer you can't reach through the tunnel is another: excluding the app that talks to it restores access without dropping your VPN. And if you use a work application that expects your real corporate IP, bypassing it while keeping everything else tunnelled avoids the tug-of-war between two VPNs.

In each case the pattern is the same: identify the one app that has a genuine reason to use the real connection, exclude only that, and leave everything else inside the VPN. Resist the temptation to exclude apps just because they feel slow — switching to a nearer server usually fixes speed without giving up protection.

Test your rules before you rely on them

After setting up split tunnelling, confirm each side behaves as intended. Open an excluded app and check it's using your real connection — for a browser you excluded, a 'what is my IP' page should show your own address. Then open an app that should be protected and confirm it shows the VPN server's address instead. This two-minute check catches the most common mistake: choosing inverse mode by accident, which flips which apps are protected and can leave everything except your listed apps exposed.

Re-test after big app updates too, since a renamed or repackaged app can quietly fall out of your rule list and start using the wrong connection. A quick check now and then keeps your split-tunnelling setup doing what you meant it to.

Bottom line

Split tunnelling is a per-app routing rule you set once in the app: choose which apps skip the VPN while the rest stay protected. Use bypass mode by default — VPN on for everything except the apps you list — and reserve inverse mode for when you truly want only a browser or two tunnelled. It's most at home solving concrete problems: a banking app that blocks VPNs, a local printer or media server, or a work app that expects your real IP. It's a convenience feature, not a privacy boost, so exclude only what genuinely needs the real connection and keep sensitive apps inside the tunnel. Set it up on Windows or Android where support is strongest, test both sides with a quick IP check, and re-verify after major app updates. Done deliberately, it removes the temptation to turn the VPN off entirely.