Split Tunneling on macOS: Options and Limits

A Mac is rarely used for one thing at a time. A video call runs next to a file download, a bank tab sits beside a work document, and a printer on the home network is expected to keep working. When a VPN sends all of that through a single tunnel, something usually misbehaves, and that is when people search for mac vpn split tunneling.

This article is about the Mac specifically: what macOS gives you, what it does not, three realistic ways to approach splitting, and how to check whether the split you configured is real. If you want the general concept first, read what split tunneling is. Here we stay practical and platform-specific, and we are open about the limits, because the honest answer on macOS is "it depends on your VPN app".

What macOS does and does not provide

macOS manages VPNs through a system layer that apps plug into. A VPN app asks permission to add a configuration, you approve it with your password or Touch ID, and from then on the system routes traffic through a virtual network interface. You can see these in Terminal as names beginning with utun.

What the system layer does not give an ordinary user is a switch that says "send this app outside the VPN". Open System Settings, go to the VPN section and you can toggle a connection on or off, view its details and remove it. You cannot assign applications to it. Per-app VPN rules do exist in Apple's platform, but they are delivered through device-management profiles that a company IT team installs on managed Macs, not through a personal settings page.

So for a personal Mac there are really three places splitting can come from:

1. The VPN app itself, if its developer built an exclusion feature.
2. The routing table, which you can read and, carefully, edit.
3. Habits and workarounds that avoid the problem without splitting at all.

Everything below sorts into one of those. Which one is available to you depends on the app version you run, so check before you plan around it. We do not claim here that any particular app has the feature; look in its settings, and if it is not there, move down the list.

Option one: exclusions inside the VPN app

When a VPN app offers split tunneling, it usually takes one of two shapes.

An exclude list. Everything uses the VPN except the apps or sites you add. This is the safer default, because new software you install later is protected automatically.

An include list. Only the apps or sites you add use the VPN; everything else goes out normally. This suits someone who wants the VPN for one browser and nothing else, but it is easier to get wrong, because anything you forget is unprotected.

On macOS, an app-based list is harder for developers to build than on some other systems, since the traffic of one process has to be recognised and steered by the network extension. Some apps therefore offer site-based or address-based lists instead, which is a different thing: a rule for a destination rather than for a program. The two behave differently when a program such as a browser talks to many destinations.

If you do find a split tunneling option, a sensible first configuration looks like this.

1. Connect normally and confirm your public IP address changes (open any "what is my IP" page in your browser).
2. Add one item to the exclusion list, not five.
3. Reconnect, because many apps apply the list only when the tunnel is established.
4. Test the excluded app and a non-excluded app separately (see the testing section below).
5. Only then add the next item.

Adding items one at a time sounds slow, but when something breaks you will know exactly which change caused it.

If the VPN app has no such feature, do not despair. The VPN you use daily may well be a simple full-tunnel app. In that case options two and three are your real toolbox.

Option two: reading and shaping the routing table

Every Mac keeps a routing table: a list that decides which network interface carries traffic for which destination. A full-tunnel VPN works by making the tunnel interface the default route. Split tunneling at the route level means some destinations keep a route that points to your normal connection instead.

You can look at this safely, because reading changes nothing. Open Terminal and run:

netstat -rn -f inet

You will see rows for the default route, for your local network and for the VPN server itself. While a full tunnel is up, the default row typically points to a utun interface, while a row for your home subnet (something like 192.168.1.0/24, one of the private ranges defined in RFC 1918) still points to en0. That is the reason a Mac often still sees its printer: the more specific local route wins over the default.

To ask the system how it would reach one specific address, run:

route -n get 192.168.1.20

Replace the address with your printer, NAS or any destination. The output contains an interface: line. If it says en0 (Wi-Fi on most laptops) or en1, that traffic does not enter the tunnel. If it says utun followed by a number, it does.

Editing is possible with sudo route, for example adding a host route for one address through your home router. We mention it so you know it exists, not because we recommend it for everyday use, for these reasons:

• A route added by hand lives in memory. A restart, a Wi-Fi change or a reconnect of the VPN app can remove it, or the app can overwrite it.
• A typing mistake can cut off your own connection. If that happens, restarting the Mac clears manual routes.
• You are now responsible for traffic that bypasses the tunnel, and you must remember that you did it.
• On a Mac managed by an employer or school, do not change routing at all. It may breach policy, and the management profile may undo it.

Treat route editing as a diagnostic skill for confirming what the VPN did, which is how most people actually benefit from it.

Option three: workarounds that avoid splitting

Often what people want is not split tunneling as such but a specific annoyance removed. A few ordinary habits solve most of them.

• Pause the VPN for one task. If a bank, a government portal or a payment page insists on seeing your normal connection, disconnect, finish the task on a network you trust, and reconnect. The guide on turning off a VPN on any device covers the clean way to do that so nothing is left half-connected.
• Use a different device for the awkward task. Do the banking on your phone using mobile data, and keep the Mac on the VPN.
• Give the awkward service its own browser profile and check it is the only one open. This does not change routing, but it keeps cookies separate and lets you close the session quickly before reconnecting.
• Use the app's own settings. Some services, such as video call tools, work better when you pick a different server location in the VPN app rather than leaving the tunnel.
• Use a hotspot for the exception. A second device on a phone hotspot sits outside the Mac's tunnel by design.

None of these is as elegant as a per-app list. Their advantage is that they are visible and reversible, and you cannot forget that something is exposed.

What people usually leave outside, and what they should not

Not every app deserves the same treatment. The table is a starting point for thinking, not a rule.

Traffic	Reason to exclude	Reason to keep inside
Printer, NAS, smart-home hub on your LAN	These devices talk to your Mac locally and may be unreachable through a tunnel	Usually already reachable through the local route, so exclusion is often unnecessary
Banking and payment sites	Some treat VPN connections as unusual and add checks	Public Wi-Fi is exactly where you want protection; use mobile data instead if possible
Video calls and live games	Delay-sensitive; the extra hop adds latency	Calls with confidential content gain from the tunnel on shared networks
Large downloads from a trusted local source	Saves tunnel capacity	Downloads from unknown sources benefit from protection
Work tools reached through a company VPN	Two VPNs on one Mac often conflict	Follow your employer's instructions instead of guessing
Browser with many logged-in accounts	Rarely a good candidate	This is the traffic a VPN is there to protect

The pattern is that you exclude things because they are local, sensitive to delay or actively fussy about VPN connections, never merely because the VPN feels slow. If speed is the actual complaint, the guide on why a VPN is slow and how to speed it up is the better starting point.

Three scenarios on a real Mac

The home-office worker. Priya uses a MacBook on the home Wi-Fi. She wants the VPN on while she works in a shared flat, but her network printer vanishes whenever it is connected. She runs route -n get for the printer's address and sees en0, so the route is fine. The problem turns out to be a "block local network" style setting in her VPN app. Once she disables that single option, printing works with no splitting at all.

The student on a campus network. Tom connects to a university portal that sends an extra verification each time he logs in from an unfamiliar-looking connection. He keeps the VPN on for his email and browsing, disconnects for the five minutes the portal needs, then reconnects. A split list would be overkill for one site, and he avoids the risk of forgetting what is excluded.

The remote worker with two VPNs. Mei Ling has a company VPN for her employer's tools and a personal VPN for café Wi-Fi. Running both at once makes one of them lose its default route. She stops trying to combine them: she uses the company VPN on work tasks, the personal one on everything else, and never both together. When she is unsure, she checks netstat -rn -f inet to see which tunnel owns the default route.

Testing that your split really works

A configuration you have not tested is a guess. Use this short procedure whenever you change anything.

1. Baseline. With the VPN off, note your public IP address from a "what is my IP" page.
2. Tunnel on. Connect and reload the page. The address should change. If it does not, the VPN is not carrying that browser's traffic at all, which is a different problem; see the Mac troubleshooting guide.
3. Test the excluded item. If the exclusion is an app, use that app's own "what is my IP" feature if it has one, or watch whether it reaches the local resource. If the exclusion is a destination, run route -n get for that destination.
4. Test a protected item. Browse with the main browser and confirm it still shows the VPN address.
5. Reconnect and repeat. Disconnect, reconnect, and test again. A split that vanishes after reconnecting was never durable.
6. Check for leaks. Look at DNS and IPv6 behaviour, because a split can leave name lookups on the wrong path. The articles on DNS leaks explain what to look for.

Write down what you changed and keep the note somewhere you will find it. A forgotten exclusion is the most common way people end up unprotected without realising.

Limits and common mistakes

Even a well-built split tunnel has built-in trade-offs.

• Leaving something outside means leaving it exposed. Traffic outside the tunnel is visible to the local network operator in exactly the way it would be with no VPN.
• Domain-based rules are slippery. A website often loads scripts, images and APIs from many other domains. Excluding the main name may not exclude everything the page uses, and the reverse is also true.
• IPv6 may behave differently. If your exclusion rules cover IPv4 only, IPv6 traffic can take a path you did not intend.
• DNS may not follow the split. The destination can be excluded while the name lookup still goes through the tunnel, or the other way round, which can cause odd failures.
• Updates can reset things. A macOS update or a VPN app update may change how the extension works and clear your list.
• Your VPN may not offer it at all. That is not a defect; many deliberately simple apps protect the whole connection and nothing else.

Common mistakes are easy to list: excluding five apps on day one, forgetting what was excluded, editing routes on a managed Mac, adding an include list and then wondering why a new browser is unprotected, and blaming the VPN for slowness when the actual cause is the Wi-Fi.

Summary

macOS has no personal per-app split tunneling switch, so mac vpn split tunneling comes from three places: an exclusion feature inside the VPN app, careful use of the routing table, or simple workarounds such as pausing the VPN for one task. Whatever you choose, change one thing at a time, test with your public IP address and route -n get, remember that excluded traffic is unprotected, and prefer the simplest solution that removes your actual annoyance. For a straightforward full-tunnel setup on a Mac, you can download the free VPNclient app and compare passes on the pricing page when you are ready.