Split tunneling is one of the most practical VPN features because it lets you choose what goes through the encrypted VPN connection and what uses your normal internet connection. If you’ve ever wanted to keep work tools protected on public Wi‑Fi while still using local websites, printers, banking apps, or a nearby streaming library, split tunneling is the setting that makes that possible. This guide explains what VPN split tunneling is, how it works under the hood, and when it genuinely helps with speed and usability. It also covers the trade-offs: any traffic you exclude from the VPN is no longer protected by the VPN’s encryption, DNS handling, and IP masking—so it changes your privacy posture. By the end, you’ll know how to use split tunneling safely and what to look for in a provider if this feature is a priority.
What is split tunneling in a VPN?
VPN split tunneling is a routing feature that allows some apps or destinations to use the VPN tunnel while others go directly to the internet through your ISP (or local network). Instead of forcing all traffic through one path, your device uses two paths at the same time:
- VPN route: traffic is encapsulated and encrypted, and it exits via the VPN server’s IP address.
- Direct route: traffic goes out normally, using your real IP address and your usual DNS/network settings.
The result is more control. For example, you can route a browser through the VPN for privacy while keeping a video call app on the direct route to reduce latency—or do the opposite if you need the call protected on untrusted Wi‑Fi.
Common split tunneling modes you’ll see
- App-based split tunneling: pick specific apps to include or exclude from the VPN (common on Windows and Android).
- Website/domain-based rules: route certain domains outside (or inside) the tunnel (less common, more complex).
- Inverse split tunneling: everything uses the VPN except the apps/sites you exclude (often the safest default).
- LAN bypass: allows access to local devices (printers, NAS, casting devices) while still using the VPN for internet traffic.
How split tunneling works (and what it means for security)
Most VPN apps create a virtual network interface on your device. When the VPN is connected, your operating system typically sends all traffic to that interface, and the VPN client handles encryption and forwarding to the VPN server. Split tunneling changes those routing decisions using policy rules.
Routing: who goes where
At a high level, the VPN client sets rules such as “Traffic from App X goes to the VPN interface” while “Traffic from App Y goes to the normal gateway.” On some platforms, this is done with per-app VPN APIs; on others it uses firewall rules or policy-based routing. This is why split tunneling quality varies between VPNs: it depends on how cleanly the client integrates with the OS network stack.
DNS: the detail that often breaks privacy
DNS decides how domain names resolve into IP addresses. With split tunneling, you can end up with two DNS paths:
- Apps inside the VPN may use the VPN’s DNS (good for privacy and avoiding some DNS-based geo mismatches).
- Apps outside the VPN may use your ISP or local DNS (faster locally, but reveals queries to that resolver).
If DNS handling is sloppy, you can see “DNS leaks” where queries go outside the tunnel even when the app is meant to be inside it. Good VPN clients account for this, but it’s a real limitation to understand.
VPN Technology & Encryption: what stays protected (and what doesn’t)
Traffic that goes through the VPN tunnel is protected by the VPN protocol’s encryption and integrity checks (for example, AES-based ciphers in OpenVPN/IKEv2 or modern AEAD ciphers commonly used with WireGuard). Traffic that bypasses the tunnel has none of those protections from the VPN. It may still be encrypted at the application layer (HTTPS), but it won’t get a VPN IP address or VPN-level privacy.
For a readable reference on modern cryptographic strength and acceptable algorithms, see NIST’s guidance: NIST Cryptographic Standards and Guidelines.
When split tunneling is genuinely useful (real-world scenarios)
Used thoughtfully, vpn split tunneling can make a VPN feel less “all or nothing” and more like a daily tool.
1) Streaming while keeping local services working
- Route your streaming app through a VPN location when you need a specific catalogue.
- Keep local apps (delivery, local news, banking) outside the tunnel to avoid extra verification prompts or regional blocks.
- Keep casting or smart TV control apps on the local route so they can still discover devices on your Wi‑Fi.
One important reality check: streaming access is never guaranteed because platforms actively detect VPN usage and licensing rules change. Netflix explicitly notes that VPN/proxy detection can affect what you can watch: Netflix help on proxies and VPNs.
2) Remote work: protect sensitive tools without breaking everything else
If you’re traveling, working from cafés, or frequently switching networks, you may want corporate tools protected while leaving low-risk traffic direct.
- Send email, work chat, and admin dashboards through the VPN.
- Leave software updates, large downloads, or local intranet resources outside the VPN if required by policy.
- Use LAN bypass so printers and local development devices remain reachable.
Note: some employers require a full-tunnel VPN for compliance. In that case, split tunneling may be disabled by policy or technically incompatible with endpoint security requirements.
3) Gaming and video calls: reduce latency where it matters
A VPN can add latency because your traffic takes a detour via a VPN server and gets encrypted/decrypted. With split tunneling, you can keep latency-sensitive apps on the direct route while securing everything else. This can help when:
- You’re on a stable home network and want maximum ping stability in competitive games.
- You’re on public Wi‑Fi and want your browser protected, but need the smoothest possible video meeting.
However, if your ISP is congested or throttling certain traffic types, routing that specific app through the VPN can sometimes improve consistency. The “best” route depends on your ISP, location, and server proximity.
4) Torrenting and P2P: separate risk profiles
If you use P2P, many users prefer to route only their torrent client through the VPN while leaving normal browsing direct. This keeps the VPN’s IP address tied to the P2P traffic, while the rest of your device behaves normally.
- Include your torrent client in the tunnel.
- Exclude your browser if you prefer local speeds and local logins.
This approach can work well, but it raises the stakes for correct configuration. If the torrent client accidentally bypasses the VPN (after a reconnect, sleep/wake, or app update), your real IP could be exposed.
Pros and cons: the honest trade-offs
Benefits
- Better usability: local websites, banking, and LAN devices can work normally while you keep selected apps protected.
- Potential speed improvements: heavy local traffic (updates, backups, streaming) can bypass VPN overhead.
- Lower latency for selected apps: keep gaming/VoIP direct if the VPN adds ping.
- More control: you choose where you want privacy and where you prefer convenience.
Limitations and risks
- Reduced privacy for excluded traffic: bypassed apps use your real IP and non-VPN DNS unless you manage DNS separately.
- More complexity: misconfiguration can cause leaks or unexpected routing.
- Kill switch interactions: some kill switches block all traffic when the VPN drops, which can conflict with split tunneling expectations.
- Not equally supported on all platforms: iOS support is often limited compared to Windows/Android.
- Geo and account friction: some sites may flag logins if part of your traffic appears from a VPN location and part appears local.
Does split tunneling make a VPN faster?
It can, but it’s not a magic speed boost. A VPN adds overhead from encryption and longer routing. In speed tests, the biggest performance variables are usually:
- Distance to the VPN server (often the largest factor for latency).
- Server load and capacity.
- Protocol efficiency (WireGuard is typically faster than older configurations, but results vary).
- Base ISP speed and peering quality.
Split tunneling helps performance in a more targeted way: you keep the VPN for the traffic that needs it, and avoid slowing down everything else. For example, leaving a large cloud backup outside the tunnel can free up VPN bandwidth and reduce congestion for the apps you do route through the VPN.
How to use split tunneling safely (practical checklist)
If you want the convenience of vpn split tunneling without unpleasant surprises, treat it like a privacy setting, not just a speed setting.
Step 1: Choose an “inverse” approach if available
If your VPN offers “everything through the VPN except…” use that. It reduces the chance that a sensitive app is accidentally left outside the tunnel.
Step 2: Decide what must never bypass the VPN
- Torrent clients (if you use P2P).
- Password managers (especially on public Wi‑Fi).
- Work tools containing customer or business data.
- Messaging apps if you’re in a high-censorship or high-risk environment.
Step 3: Test your routing (don’t assume)
- Check your IP location inside and outside the VPN using two different apps (for example, a browser versus the app you excluded).
- Verify DNS behaviour if your VPN client provides DNS leak testing or diagnostics.
- Re-test after OS updates; split tunneling rules can break after major network stack changes.
Step 4: Understand kill switch behaviour
Some VPNs offer an “app kill switch” (closes selected apps if the VPN drops) as well as a “system kill switch” (blocks all connectivity). For split tunneling, app-level control is often more compatible: you can protect the apps that must stay inside the tunnel without killing the direct-route apps.
Step 5: Avoid mixing identities for sensitive accounts
If you log into the same account from both your local IP and a VPN IP in the same session, some services may trigger security checks. It’s not inherently unsafe, but it can be inconvenient. For banking and critical logins, many users simply keep those apps outside the VPN for consistency.
Split tunneling on different devices: what to expect
Windows
Windows VPN clients often offer the most granular app-based split tunneling. It’s also common to see per-app exclusions and LAN bypass. Because Windows has a complex networking environment (multiple adapters, virtualisation tools, security software), stability varies by provider and setup.
macOS
macOS support is mixed. Some VPNs provide split tunneling, but others don’t due to how their apps are built and OS-level constraints. When it’s available, it’s often app-based and generally reliable, but you may have fewer advanced options than on Windows.
Android
Android has strong OS support for per-app VPN rules. Many providers implement split tunneling cleanly here, letting you include or exclude apps. This is one of the easiest platforms to use vpn split tunneling day-to-day.
iOS/iPadOS
Split tunneling is often limited on iOS compared to Android and Windows. Some enterprise configurations support per-app VPN, but consumer VPN apps frequently can’t offer the same level of control. If split tunneling is a must-have for iPhone users, check the provider’s current iOS feature list carefully.
Routers
Router-based VPN setups usually don’t offer per-app split tunneling because the router only sees devices, not individual apps. You can sometimes create “device-based” split tunneling by routing only certain devices through the VPN (for example, a streaming stick through the VPN, while your work laptop stays direct).
What to look for in a VPN that offers split tunneling
Not all split tunneling implementations are equal. If you’re choosing a provider with this feature in mind, focus on the fundamentals first, then the convenience features.
Privacy and security essentials
- Clear no-logs policy with specific claims about what is and isn’t stored.
- Independent audits or transparency reporting (when available).
- Strong protocol support and modern cipher suites as part of good VPN Technology & Encryption hygiene.
- Leak protection: DNS leak protection, IPv6 handling, and WebRTC considerations (browser-side).
Split tunneling quality indicators
- Inverse mode (everything tunneled except exclusions).
- Per-app rules that survive reboots, sleep/wake, and network changes.
- LAN bypass toggle (useful for printers, casting, smart home devices).
- Kill switch options that work sensibly with split routing.
Performance and coverage considerations
- Server locations close to where you actually are (to keep latency down).
- Consistent speeds at peak times, not just “best case” results.
- Good regional coverage if you travel frequently (UK/EU/US plus popular travel hubs).
Conclusion
VPN split tunneling is best seen as a control feature: it lets you decide which traffic deserves the VPN’s protection and which traffic is better kept local for speed, compatibility, or account stability. It can improve everyday usability and sometimes performance, especially when you’re balancing streaming, work tools, and local network devices. The trade-off is simple but important: anything excluded from the tunnel is excluded from VPN privacy protections. If you use split tunneling, choose a VPN with solid leak protection, sensible kill switch options, and reliable per-app routing—and take a few minutes to test that traffic is going where you think it is.
Frequently Asked Questions
Is split tunneling safe to use?
It can be safe if you only exclude low-risk apps. Remember: excluded traffic uses your normal connection and real IP. Keep sensitive apps (work, passwords, P2P) inside the VPN and test for leaks.
Will split tunneling stop my ISP from seeing what I do?
Only for the traffic routed through the VPN. Any app or site you exclude will be visible to your ISP in the usual way (at least domains and metadata), even if the content is protected by HTTPS.
Does split tunneling help with streaming?
It can help with convenience by keeping local apps outside the VPN while routing a streaming app through it. Access isn’t guaranteed, though—streaming services can detect VPN use and change availability.
Can I use split tunneling for torrenting only?
Yes. Many people route only their torrent client through the VPN. Use a kill switch or binding feature if available, and re-check after updates to ensure the torrent app can’t fall back to your real connection.
Why doesn’t my iPhone VPN app have split tunneling?
iOS limits what many consumer VPN apps can do with per-app routing. Some providers offer partial solutions, but full split tunneling is more common on Android and Windows.
Does split tunneling make a VPN cheaper or reduce data use?
No. Pricing usually doesn’t change. It may reduce how much traffic passes through the VPN server, but your total internet data usage stays about the same—you’re just choosing the route.
