What is split tunneling? Definition and uses

When you switch on a VPN, by default all of your traffic runs through the encrypted tunnel. Split tunneling breaks that all-or-nothing rule: it lets you sort what goes through the VPN and what bypasses it. Convenient, but not harmless from a security standpoint. Here is a clear definition, the real use cases, the limits worth knowing, and how to set it up.

What exactly is split tunneling?

Split tunneling is a feature offered by most serious VPNs that divides your internet traffic into two separate streams. One stream travels through the encrypted VPN tunnel (with your IP hidden), the other goes directly through your internet provider, as if the VPN did not exist. You decide how the split works, app by app or site by site.

Without split tunneling, things are simple but rigid: the VPN is a global switch that protects all your traffic at once. With it, you get fine-grained control. Here is what happens, concretely, when you turn it on.

How does split tunneling work?

Depending on the VPN and the platform, split tunneling comes in two opposite logics, and it pays to tell them apart so you do not pick the wrong setting:

• Exclusion mode (inverse): the VPN protects everything except the apps you drop into a list. Ideal when a single app is causing trouble (a bank, a delivery app) while everything else stays secured.
• Inclusion mode: nothing goes through the VPN except the apps you add. Useful when you only want to encrypt one or two specific uses (a browser, a torrent client) and leave the rest direct.

The split is most often done per app (on desktop and on Android), but some VPNs also handle split tunneling per URL or per domain through a browser extension, or per IP address on routers. Technically, the VPN client edits the system routing table to send each packet to the right network interface.

What is split tunneling used for day to day?

Split tunneling answers very concrete situations, where routing “everything through the VPN” gets in the way:

• Reaching local and foreign services at once: watching a US streaming catalog through the VPN while keeping access to your local bank or a government website, which tend to dislike foreign IP addresses.
• Keeping local network devices reachable: printer, NAS, smart-home hub. These often become unreachable when all traffic goes into the tunnel; exclusion keeps them within reach.
• Encrypting only what matters: protecting just your P2P downloads or one browser, without slowing down the rest.
• Avoiding unwanted geo-blocks: some banking or payment apps block themselves or demand extra verification the moment they detect a VPN IP. Excluding them avoids that friction.

What are the benefits of split tunneling?

The main upside is everyday convenience, but there is a real performance gain too:

• More speed: encryption and the detour through a remote server always cost a little speed. By pushing bandwidth-hungry activities that do not need protection out of the tunnel (online gaming, updates, streaming a local service), you free up bandwidth for what stays in the VPN.
• Fewer conflicts: no more websites thinking you are abroad when you only wanted to secure a different tab.
• Local network preserved: your connected devices stay reachable without cutting protection.
• A VPN you actually keep on: because it becomes less restrictive, you are less tempted to switch it off “just for two minutes”, which are exactly the two minutes when you are exposed.

What are its security limits?

The honesty point you cannot skip: by definition, anything you route out of the tunnel is no longer protected. That traffic travels with your real IP address, visible to your internet provider and to the sites involved, without the VPN’s encryption. Split tunneling is a trade-off, not a free setting.

• Partial exposure: an app excluded by mistake, or one handling sensitive data, ends up in the open. On public Wi-Fi, that is exactly the risk a VPN was meant to neutralize.
• Possible DNS leaks: depending on the implementation, the DNS requests of excluded traffic can travel in the clear through your provider and reveal the sites you visit.
• Configuration mistakes: a badly set rule can leak more than intended, with no visible warning. You think something is protected when it is not.
• The kill switch does not cover everything: the kill switch, which cuts the connection if the tunnel drops, only watches the traffic inside the VPN. The excluded stream keeps flowing no matter what.

Split tunneling trades a little security for convenience. If you do not know what to exclude, it is better to exclude nothing.

How do you set up split tunneling?

The steps vary from one VPN to another, but the logic stays the same across most desktop apps and on Android:

Which VPNs offer split tunneling?

It has become a common feature among premium providers, but its scope varies by platform. Among the VPNs offering it as of July 2026: NordVPN (Windows and Android), Surfshark (under the name “Bypasser”), Proton VPN (Windows and Android, open source), and ExpressVPN. Watch the platform nuances: availability on macOS and the near-universal absence on iOS mean split tunneling should not be your only buying criterion. Expect a good paid VPN to cost between $2 and $3.50 per month on a two-year commitment (indicative promotional pricing observed in July 2026, renewal excluded).