Split Tunneling

Beginner

A VPN feature that lets you choose which apps or sites go through the encrypted tunnel and which use your normal connection directly.

In depth

Split tunneling divides your traffic into two lanes: selected apps, sites, or IP ranges travel through the VPN's encrypted tunnel, while everything else uses your regular internet connection. Instead of the all-or-nothing choice a basic VPN imposes, you route per-purpose.

Why you'd want it

Speed where privacy isn't needed: game clients, video calls, and large downloads skip the VPN's latency and throughput cost.
Avoiding false fraud flags: banking apps and payment sites often challenge or block VPN IPs; routing them outside the tunnel keeps them happy while the rest of your traffic stays protected.
Local + remote at once: reach LAN devices (printers, NAS) normally while geo-shifted traffic flows through the VPN.
Streaming conflicts: watch a local service directly while other apps operate through a foreign VPN location.

Modes and mechanics

Implementations vary: per-app selection (most common on Windows and Android), per-URL/domain rules (usually via browser extensions), and inverse split tunneling, where everything is protected except an exclusion list. Under the hood, the VPN client adjusts routing rules so excluded traffic bypasses the virtual network interface.

Mind the split

Every excluded app exposes your real IP by design. Audit your split-tunnel rules whenever your threat model changes — an exclusion added for convenience last month may be a leak today. Note iOS and macOS support is often limited compared with Windows and Android.

Examples

A user routes their browser through a VPN for privacy while their game launcher connects directly for lower ping.
A remote worker tunnels corporate apps through the company VPN while personal streaming bypasses it.
A banking app is excluded from the VPN so its fraud system stops challenging every login.

Common use cases

Gaming alongside VPN privacyBanking without VPN flagsLAN device accessBandwidth-heavy downloadsRemote work setups

FAQs

It's a deliberate trade-off: excluded traffic gets zero VPN protection and reveals your real IP. That's fine for trusted apps like banking, risky if you forget what's on the exclusion list. Review your rules periodically.

For the excluded traffic, yes — it skips encryption overhead and the detour through the VPN server entirely. Tunneled traffic is unaffected, though your overall connection has more capacity when bulk transfers bypass the VPN.

Apple's platform restrictions limit per-app traffic control, so many VPNs offer split tunneling only on Windows, Android, and routers, or restrict iOS to website-level rules. Check the provider's feature matrix per platform before buying.