What Is Split Tunneling?

By default, a VPN sends everything your device does through its tunnel. That is simple and protective, but it is not always convenient. A printer on your home network may stop responding, a banking app may refuse a VPN address, or a game may feel slower than it needs to. Split tunneling is the setting that lets you divide traffic between the VPN and your normal connection.

This article explains the concept in general: how split tunneling works, the different ways it is configured, when it is useful and what you give up. It does not claim that any particular service offers it.

Full tunnel versus split tunnel

In a full tunnel, all traffic goes through the VPN. Your internet provider sees only an encrypted connection to the VPN server, and websites see the VPN server's address.

In a split tunnel, the VPN software applies rules. Traffic that matches the rules goes through the tunnel. Everything else uses your regular connection and shows your real IP address, just as if the VPN were off.

	Full tunnel	Split tunnel
What uses the VPN	All traffic	Only what you select (or everything except what you exclude)
Local network devices	May become unreachable	Usually remain reachable
Protection coverage	Broad	Only the tunnelled part
Setup effort	None	Choose and maintain rules
Typical risk	Slower apps, blocked sites	Forgetting something is outside the tunnel

For the basics of how traffic enters and leaves a tunnel, read how does a VPN work?.

Three common ways to split traffic

1. By app

You pick which apps use the VPN. A browser might go through the tunnel while a video-calling app or a bank app uses your normal connection. This is the easiest form to understand and the one most people mean by split tunneling.

2. By website or domain

Rules are based on the destination. Only chosen sites go through the VPN, or all sites except chosen ones. This needs more care, because one site often loads content from many other domains.

3. By network address

Rules are based on IP ranges. This is common in company setups: traffic for the office network goes through the VPN, while ordinary internet traffic does not. Home and office networks usually use private ranges such as those in RFC 1918, so a rule can say "send 10.0.0.0/8 through the tunnel and leave the rest".

Include mode and exclude mode

Many VPN apps offer one of two styles:

• Include (only these use the VPN). The default is outside the tunnel. You add the apps or sites you want protected. New apps start unprotected until you add them.
• Exclude (everything except these). The default is inside the tunnel. You list the exceptions. This is usually safer, because new apps are protected automatically.

If you have the choice, exclude mode is the more cautious option for privacy. Include mode suits people who want the VPN for one particular job.

When split tunneling is useful

• Reaching local devices. A printer, a network storage box or a smart TV cast target sits on your local network. A full tunnel can route local requests away from them. Excluding the local network keeps them working.
• Apps that block VPN addresses. Some banking, payment and government services treat traffic from VPN servers with suspicion and may ask for extra verification or refuse the login. Excluding that app lets it see your normal connection. This is about convenience on your own accounts, not about avoiding any rules.
• Reducing load on the tunnel. Large downloads or updates that do not need protection can go direct, leaving more capacity for what does. Speed changes with a VPN for many reasons, covered in why internet speed changes with a VPN.
• Remote work. A company may route only internal systems through its VPN so that video calls and general browsing stay fast. Telework guidance from bodies such as NIST discusses the trade-offs between sending everything through a remote-access tunnel and sending only organisation traffic.
• Region-sensitive services. You might want a local site to see your home location while another app uses the VPN. The effect depends on the sites and their rules, so do not assume anything unlocks.

A plain example

You are on a hotel Wi-Fi network. You want your email and web browser protected, but you also want to print a boarding pass to a wireless printer in the business centre and use your bank's app, which rejects logins from VPN servers. With a full tunnel, the printer is unreachable and the bank app complains. With split tunneling in exclude mode, you leave the printer's local network and the bank app outside the tunnel and keep everything else inside it.

The catch: the bank app now runs over the hotel network. Banking apps normally use their own encryption, but you have chosen to make that connection directly visible to the hotel's network as a connection, even if the content stays encrypted. That is a judgement call you should make knowingly.

How to set it up sensibly

1. Decide what you are protecting. Write down the one or two reasons you want the VPN, for example public Wi-Fi or hiding browsing from the local network.
2. Check whether your VPN app or operating system supports it. The location differs between apps, and not every connection method offers it.
3. Prefer exclude mode when it is available.
4. Exclude as little as possible. Add one app at a time and only when something genuinely breaks.
5. Verify with an IP-check page. Open a browser that should be inside the tunnel and confirm its address is the VPN's. Then test the excluded app separately. See how to check if your VPN is working.
6. Review your list now and then. Rules tend to be forgotten, and apps update themselves.

Limits and what to watch for

• Excluded traffic is unprotected by the VPN. On public Wi-Fi, that traffic can be seen by the network operator as connection metadata. Read public Wi-Fi safety before excluding anything you use outside the home.
• Apps are not always one thing. An app may contain a built-in browser, load content from other services or start helper processes that follow different rules from the main app.
• DNS can be inconsistent. Depending on how the software is built, name lookups for excluded apps can still go to your own provider, or lookups for tunnelled apps can leak. Test for it, using what is a DNS leak? as a guide.
• Kill-switch behaviour may not cover excluded apps. A kill switch blocks traffic when the VPN fails, but excluded apps are by definition allowed outside the tunnel.
• It is a convenience feature. It does not add security. It reduces coverage in return for compatibility.

Summary

Split tunneling divides traffic between the VPN tunnel and your normal connection, by app, website or address range. It helps with local devices, apps that reject VPN addresses and performance, but everything outside the tunnel loses the VPN's protection. Use exclude mode when you can, keep exceptions few and test your setup.

If you want to try a VPN for a set number of days without automatic renewal, the pricing page shows how prepaid passes work, and the Help Center covers setup on common devices.