Split Tunneling on Android: Setup Guide

Sooner or later most VPN users meet the same small annoyance. The banking app refuses to open while the VPN is on, the cast button cannot find the living-room TV, or a game's connection gets slower. Switching the VPN off fixes the one app but leaves the rest of the phone unprotected. Split tunneling is the feature that solves this by letting you decide, app by app, which traffic goes through the VPN and which goes straight to the internet.

This guide is about doing it on Android: finding the setting, choosing between the two modes, building a list you will not regret, testing that it works and fixing the usual problems. For the concept itself, read what split tunneling is first; here we assume you already know the idea and want to set it up.

Check that your app has it first

Android does not provide a single system switch for split tunneling that ordinary users can use. The feature lives inside the VPN app, which tells Android which apps may use the tunnel. That means two things for you.

1. Not every VPN app offers it. Open your app's settings and look for wording such as split tunneling, per-app VPN, app exclusions or "choose apps". If you do not find anything, the app does not have it, and no phone setting will add it.
2. Menu names and options differ by app. The steps below are generic. Follow the labels in your own app rather than looking for exact wording from this page.

For customers using the free VPNclient app with an XPASS pass, check the app's settings screen on your phone, as the store listing does not describe which options are shown. If it has no per-app option, the practical alternative is to turn the VPN off briefly for a trusted task, as described later. The download page links to the official listing, and the Android setup guide covers the first connection.

Include or exclude: pick a mode

Apps that support the feature usually offer one of two modes, sometimes both.

Mode	How it works	Best for	Main risk
Exclude (bypass) list	All apps use the VPN except the ones you tick	Most people: protect everything, carve out a few exceptions	The exceptions are unprotected on that network
Include (only these apps) list	Only the apps you tick use the VPN	People who want the VPN for one or two specific apps	New apps and forgotten apps go out unprotected

For most people exclude mode is the safer default. When you install a new app tomorrow, it is covered automatically, and the exceptions you made stay short and visible. Include mode makes sense for a narrow purpose, such as running one work app through the tunnel on a phone that is otherwise left alone. If you choose it, review the list from time to time, because anything you forgot to tick is outside the VPN.

Build your list step by step

Think about what you want before you tick boxes, so the list matches a purpose rather than a mood.

1. Write down the problem. Which app misbehaves with the VPN? Which feature fails: login, payment, casting, speed, or something else?
2. Open the VPN app's settings and find the per-app section. Wait for the list of installed apps to load; it can take a moment.
3. Select the mode. Exclude for most cases.
4. Tick the app or apps involved in your problem. Pick only what you need.
5. Save and reconnect. Many apps apply the change only after disconnecting and connecting again. Check the key icon in the status bar afterwards.
6. Test straight away with the checks in the next section. A list you have not tested is a guess.
7. Note what you changed. A short line in your phone notes saves confusion in three months.

Choose by function, not by app category. A banking app may work happily through a VPN on your phone while a different one does not. Add only the ones that actually fail.

Which apps usually belong on the exclude list

These are common candidates. None of them is a rule; try the app with the VPN first and exclude it only if there is a problem.

• Banking and payment apps that treat VPN connections as unusual and ask for extra checks or refuse to open. The article on using banking apps with a VPN explains why this happens and what to try. Excluding such an app means its traffic goes over your normal network, so use it on mobile data or a trusted home network, not on public Wi-Fi.
• Casting and local-network apps such as screen mirroring, media casting, printer tools and smart-home controllers. They need to find devices on your home network, and a tunnel can hide those devices from the phone.
• Streaming or game apps with latency problems where the delay added by a distant server matters. Keep the VPN for other things.
• Apps tied to your local network operator, such as some carrier account apps, which expect to see your mobile connection.
• Apps that block themselves repeatedly because of security checks. Test whether the block is because of the VPN before excluding.

Apps that should stay inside the tunnel

Keep these protected, especially on public networks.

• Web browsers and any app with a built-in browser.
• Email and calendar apps.
• Messaging and social apps.
• Cloud storage and note-taking apps.
• Work tools that carry client or company data.
• Anything you use to log in to accounts.

If you are unsure, keep it inside. The cost of an app staying in the tunnel is small. The cost of leaving something sensitive outside on an untrusted network can be larger.

Test that it works

Do not trust the toggle. Test the result.

1. Check the status. With the VPN connected, the key icon should be in the status bar.
2. Open a browser that is not excluded and look up your IP address using a "what is my IP" page. It should show the VPN's address, not your normal one.
3. Open an excluded app's own address check, if it has one, or temporarily put a browser on the exclude list and check again. The address should now be your ordinary network address. Then put the list back as you want it.
4. Test the original problem. Does the banking app open? Does the cast button find the TV? If not, you may have ticked the wrong package or the app needs a restart.
5. Repeat on the other network. Test once on Wi-Fi and once on mobile data, because some apps behave differently.

The guide to checking whether your VPN is working has more detail on interpreting results.

DNS and other things split tunneling does not fix

Split tunneling decides which apps use the tunnel. It does not automatically settle every related question.

• DNS. Name lookups may follow the system's setting rather than the app list, depending on how the VPN app and Android's Private DNS option interact. If privacy of lookups matters to you, read Private DNS and VPNs on Android. The Cloudflare explainer on DNS shows what is at stake.
• Excluded apps are exposed. Their traffic is as visible as it would be without a VPN. Treat the exclude list as a list of exceptions to your protection.
• Shared processes. Some apps include components from other developers or call services in other apps. An excluded app may not be the only one involved.
• System apps. Updates, app stores and system services may not appear in the list and may behave according to the app's design, not your choice.
• Always-on and blocking. If you use the option to block connections without the VPN, excluded apps may be blocked as well, since they are not going through the tunnel. Check the combination before travelling; the article on blocking connections without a VPN explains it.

Three practical setups

The commuter with a banking app. Nattha uses the VPN on cafe and train Wi-Fi and her bank app refuses to open. She uses exclude mode, ticks only the bank app, reconnects and tests. When she needs to use the bank, she does so on mobile data and avoids public Wi-Fi for that task. Everything else stays protected.

The remote worker with a printer. Ken works from home and wants his company's chat and file apps through the tunnel but his phone's printing app to find the office-style printer on the home network. Exclude mode with the printing app and the smart-home controller ticked solves the discovery problem, while browser, mail and work apps stay protected.

The parent with a single work app. Bee wants only her work app to use the VPN and leaves the rest alone, to save battery and avoid breaking family apps. She picks include mode with one app. Each month she reviews the list and remembers that her browser is outside the tunnel, so she does not log in to important accounts on public Wi-Fi without turning the VPN on for the whole phone.

Troubleshooting

Symptom	Likely cause	What to try
The excluded app still fails	The app uses the system browser or another package	Check which package the failing screen belongs to; try restarting the app
The included app does not use the VPN	Change not applied	Disconnect, reconnect, then retest
List is empty or very slow	Large number of apps, or a permission is missing	Wait, then reopen; update the VPN app
Everything breaks after enabling	Wrong mode selected	Switch between include and exclude and read the label again
Settings vanished after an update	App reset its list	Re-tick the apps and retest
Casting still fails	Phone and TV are on different networks or the tunnel hides local devices	Exclude the casting app; check both devices are on one Wi-Fi

If nothing helps, contact support with your Android version, the app name that fails and the exact mode you chose.

Summary

Split tunneling lets Android apps choose between the VPN and the normal network, but only if your VPN app offers it; Android has no universal switch. Prefer exclude mode so new apps are protected by default, keep the exception list short, test the result with an IP check and the original problem, and remember that excluded apps are as exposed as they would be without a VPN. Review the list after updates and before travelling.

If you want to try it on your own phone, the pricing page shows pass lengths you can match to a test period.