Split tunneling is a VPN setting that lets you choose which traffic goes through the encrypted tunnel and which goes directly to the internet. A full tunnel sends everything through the VPN; a split tunnel sends, for example, your browser through the VPN and your banking app, printer and game straight out. It exists because "everything through the VPN" is the safest default but not always the most practical one.

How the two modes differ

Full tunnel. The VPN app creates a virtual network interface and routes every packet from every app into it. Your ISP and local network see one encrypted connection. Websites see the VPN server's address. Nothing leaks unless something is misconfigured. This is what you want on public Wi-Fi and whenever privacy is the point.

Split tunnel. The app keeps the tunnel up but adds exceptions. Depending on the implementation, exceptions are by app (this program bypasses the VPN), by destination (this website or IP range bypasses the VPN), or inverted (only these apps use the VPN, everything else goes direct). The traffic that bypasses the tunnel behaves exactly as if the VPN were off: your real IP, your ISP's DNS, no encryption beyond what the app itself does.

In networking terms, the difference is in the routing table. Full tunnel sets the default route to the VPN interface. Split tunnel keeps the default route on your normal connection and adds specific routes, or uses per-app rules in the operating system, to steer selected traffic into the tunnel.

When split tunneling helps

  • Banking and payment apps that refuse to work through a VPN or lock your account when your country changes. Excluding them keeps the rest of your traffic protected.
  • Local devices: printers, NAS, smart TV casting, a game console on the same Wi-Fi. A strict full tunnel can hide the local network; excluding local addresses fixes it.
  • Speed-sensitive apps: an online game or a large download that does not need privacy can skip the VPN's detour. The overhead is explained in does a VPN slow down your internet.
  • Work tools that must see your real location or corporate network, while the browser stays private.
  • Streaming on a TV app that behaves differently by region, while the phone's other apps stay on the VPN.

When it is a risk

Every excluded app is fully exposed. The three mistakes people make:

  1. Excluding the browser because a site did not load, then forgetting. The browser is usually the one thing that should always be inside the tunnel.
  2. Excluding by destination on a shared network. On café Wi-Fi, the excluded traffic is visible to the network exactly as without a VPN. Use split tunneling at home, not on public networks.
  3. DNS outside the tunnel. Some split configurations send DNS queries directly even for apps inside the tunnel, which exposes the list of sites you visit. After setting up a split tunnel, run the checks in is my DNS leaking.

A kill switch protects only the traffic inside the tunnel. Excluded apps keep working when the VPN drops, by design.

Setting it up

Android. Split tunneling by app is native: the VPN app shows a list of installed apps with checkboxes. Android also offers "Always-on VPN" and "Block connections without VPN" in system settings; the second one applies to apps inside the tunnel only.

iPhone and iPad. iOS does not expose per-app split tunneling to ordinary VPN apps, except for managed devices. What VPN apps on iOS can do is exclude destinations, for example local network addresses, and use on-demand rules that switch the VPN on for certain Wi-Fi networks. If an iOS app claims per-app split tunneling, check what it actually excludes.

Windows and macOS. Most VPN apps list installed applications and let you tick the ones to exclude or include. macOS additionally allows "exclude local network" so printers and AirPlay keep working.

Routers. Split tunneling on a router means policy routing: some devices go through the tunnel, others do not. It is the only way to run a router VPN without slowing down every device, covered in VPN on router vs on each device.

Inverse split tunneling

Some apps let you flip the logic: only the selected apps use the VPN, everything else goes direct. This is convenient when you want just one program protected, say a torrent client or a browser profile for research, and do not want the rest of the system affected. The exposure is the mirror image: everything you did not select is outside the tunnel, so treat the list as the thing you are protecting, not as exceptions.

A sensible default

Full tunnel everywhere, with two exclusions at most: local network access, and one or two apps that genuinely break through a VPN. Review the exclusion list every few months. And on public Wi-Fi, switch the exclusions off entirely; that is where the tunnel matters most, and where excluded traffic is most visible.

404 VPN supports split tunneling by app on Android, Windows and macOS, excludes local network access on request, and keeps DNS inside the VLESS or WireGuard tunnel for the apps that use it, with a kill switch for the protected traffic. Details are on the features page; get started here.