VPN Split Tunneling Explained and When to Turn It On

Your VPN is on, and now the network printer has vanished, your bank flags every login, and your video call stutters while a download crawls. VPN split tunneling is the setting that lets you keep the protection without breaking the half of your life that hates being routed through a server in another city.

It is also a setting that people switch on carelessly and then forget about, which quietly undoes the reason they installed the VPN. So here is what it does, which version to use, and the cases where I tell people to leave it off.

What VPN Split Tunneling Actually Does

A normal VPN connection is a full tunnel. Every packet from your device, whether it is a web page, a game update or a smart TV app, goes through the encrypted connection to the VPN server first and out to the internet from there.

Split tunneling divides that traffic into two routes. Some of it goes through the VPN tunnel. The rest goes straight out through your normal internet connection, exactly as if the VPN were off. You choose the split.

Most VPN apps offer it in one of three forms:

• App-based exclusion. Everything goes through the VPN except the apps you list. This is the most common and the safest default.
• App-based inclusion. Only the apps you list use the VPN; everything else goes direct. Riskier, because any new app you install is unprotected by default.
• Route or IP-based splitting. You exclude address ranges such as 192.168.1.0/24, which keeps your local network reachable. Common on desktop clients and business VPNs.

Good Reasons to Turn It On

Split tunneling solves real problems. These are the ones I see most:

1. Local devices disappear. Printers, network drives, Chromecasts and smart speakers live on your home network. A full tunnel can hide them. Excluding your local subnet brings them back without exposing your browsing.
2. Banking apps lock you out. Many banks treat VPN server IPs as suspicious. Excluding the banking app lets it connect from your real home IP while the browser stays covered.
3. Video calls and gaming suffer. If your VPN server is 800 km away, you might add 20 to 40 ms of latency. For a work call on Teams or Zoom, routing direct often fixes choppy audio.
4. Large downloads crawl. A 90 GB game update does not need privacy from your ISP in most cases. Letting the launcher go direct can double or triple the speed on slower VPN servers.
5. Region-specific services. A local streaming app or government portal that rejects foreign IPs can be excluded while the rest of your traffic still uses a different location.

When I Tell People to Leave It Off

The usual advice online is that split tunneling is a pure win, the "best of both worlds." I do not agree. For a large group of users it is the wrong choice, and here is who they are.

People on public Wi-Fi. The whole point of a VPN at a cafe, airport or hotel is that the network itself is untrusted. Any app you exclude is now exposed to whoever runs or snoops on that network. If you use split tunneling at home, switch it off before you connect at the airport. Hotel networks have their own headaches, which we covered in the guide to streaming on hotel Wi-Fi without portal loops.

People who want the VPN mostly for ISP privacy. Every excluded app reveals its destination to your internet provider. Exclude the browser "just for this one site" and you have handed over most of your browsing history.

People who rely on the kill switch. Many apps weaken or disable the kill switch for excluded traffic, because by design that traffic should flow without the tunnel. If you depend on the kill switch to catch leaks, read what a VPN kill switch does and why it matters before you mix the two.

My rule is boring but reliable: use exclusion mode, keep the list under five apps, and review it every few months. Inclusion mode is for specialists who know exactly what they are doing.

How to Set It Up Without Leaking

The menu names differ between apps, but the steps are the same on Windows, macOS and Android. (iOS mostly does not allow app-based split tunneling, so most iPhone apps offer only on or off.)

1. Open your VPN app settings and look for "Split tunneling," "Bypass," or "App exceptions."
2. Choose the mode that sends everything through the VPN except selected apps.
3. Add one app at a time, starting with the one causing the problem.
4. Reconnect the VPN. Many apps only apply the change on a new connection.
5. Test it. Open a browser that is still in the tunnel and check your public IP; it should show the VPN location. Then check the excluded app works as expected.
6. Run a DNS leak test from the tunneled browser. If your ISP's DNS servers appear, enable the VPN's own DNS option.

Write down what you excluded and why, even in a phone note. Six months later, you will not remember why your torrent client or work browser is on the list. Each time you update the VPN app, open the split tunneling screen again too, because some updates reset the list or quietly switch the mode back to the default.

Split Tunneling and Free VPNs

Free VPNs often push split tunneling as a feature, partly because it lowers the traffic they carry on their own servers. That saves them bandwidth, not you privacy. If a free service makes split tunneling the default, or applies it to the browser automatically, that tells you something about its priorities. We looked at the wider trade in what free VPNs take in exchange for zero cost.

FAQ

Is VPN split tunneling safe?

It is safe for the traffic that stays in the tunnel. Anything you exclude has no VPN protection at all, so it is only as safe as the network you are on. At home that is usually fine; on public Wi-Fi it is not.

Does split tunneling make my internet faster?

For the excluded apps, yes, because they skip the trip to the VPN server and the encryption overhead. Traffic inside the tunnel runs at the same speed as before. You will notice it most on downloads and video calls.

Why can't I find split tunneling on my iPhone?

Apple restricts how VPN apps route traffic on iOS, so most providers cannot offer per-app splitting there. Some business VPNs can do it through device management profiles, but consumer apps usually offer the full tunnel only.

Should I exclude my browser from the VPN?

Usually not. The browser carries most of your private activity, so excluding it removes most of the reason to run a VPN. Exclude a specific app like a banking client instead, or use a second browser just for the sites that block VPNs.