How to Set Up VPN Split Tunneling on Windows

Windows gives you more than one way to send some traffic through a VPN and the rest straight to the internet, and the right one depends on how your VPN is installed. This guide covers windows vpn split tunneling from the practical side: how to decide what to leave outside the tunnel, which of the three methods fits your setup, and how to check afterwards that the split is real and not just a hopeful setting. If you want the concept explained from scratch first, read what split tunneling is and come back.

Here we stay on one machine, a Windows 10 or Windows 11 PC. Menu names change between builds, so treat the paths below as a guide and use the search box in Settings if a label has moved.

Decide what stays outside the tunnel before you touch a setting

The most common failure with split tunneling is not technical. People turn the feature on, tick a few apps at random, and then cannot say which traffic is protected. Spend five minutes on a list first.

Ask one question for each app or device: "Would I be comfortable sending this over the network I am currently on, without the tunnel?" If the answer is yes, it is a candidate to exclude. If it is no, it stays inside.

Traffic	Usually exclude?	Reason
Network printer or scanner at home	Yes	It lives on your local network and often fails when pushed into a tunnel
NAS, media server, smart-home hub	Yes	Same reason: local addresses must stay local
Banking or payment app that rejects VPN connections	Sometimes	Only on a network you trust, such as your home router
Online game or voice chat with latency problems	Sometimes	A direct route can lower delay, but you lose the tunnel for that app
Work tools reached over the company VPN	No	They are the reason the tunnel exists
Web browser on hotel or cafe Wi-Fi	No	This is the traffic the tunnel protects most
Software updates and large downloads	Sometimes	Excluding them saves tunnel capacity but exposes the download source to the local network

Write your own version of this table on paper. Two columns, "inside" and "outside", is enough. Everything you cannot place with confidence goes inside, because the safe default is the full tunnel.

What actually happens on a Windows PC

A Windows PC keeps a routing table: a list of rules that says "traffic for this destination leaves through that adapter". When a VPN connects, it adds a virtual adapter and either replaces the default rule so all traffic goes into the tunnel, or adds narrower rules so only some destinations do.

Split tunneling is just a different set of rules. Two styles exist.

• Exclude mode. Everything goes through the tunnel except the apps or addresses you list. Good for a home PC where a few devices must stay local.
• Include mode. Nothing goes through the tunnel except the apps or addresses you list. Good for a work laptop that only needs the office network through the tunnel and everything else direct.

Most consumer VPN apps that offer this feature work per app, which is easy to understand. Windows' own VPN profiles work per destination network, which is more precise but needs addresses. The three methods below follow that split.

Method 1: use the split tunneling option in your VPN app

This is the simplest route and the one to try first. Open your VPN app, look through its settings for a section named something like split tunneling, app exclusions or bypass list, and check which mode it offers.

1. Disconnect the VPN so you are testing from a known starting point.
2. Open the app's settings and find the split tunneling or per-app section. Wording varies by app and version.
3. Choose the mode. For a home PC, exclude mode is usually the right start.
4. Add the apps by picking their executable files, normally under C:\Program Files or C:\Program Files (x86). Browsers and launchers often run helper programs as well, so exclude the main program and test.
5. Save, reconnect, and run the tests in the verification section further down.

If the app has no such setting, do not assume you did something wrong. Many apps keep a single full-tunnel mode on purpose. The free VPNclient app that XPASS customers use does not document a split tunneling screen in its store listings, so check what your copy shows rather than relying on this article. If there is nothing, the options are to leave the VPN on for everything, to disconnect it briefly for the one app that needs it, or to use Method 2 when you have a Windows VPN profile. You can see how the whole pass works on the download page and the pricing page.

Method 2: split a Windows VPN profile with settings or PowerShell

This method applies only when the connection is a VPN profile stored in Windows itself, visible under Settings, Network and internet, VPN. Apps that install their own virtual adapter manage their own routes, and changing a Windows profile will not affect them.

Using the classic adapter window

1. Press the Windows key, type "View network connections", and open the result.
2. Right-click the VPN adapter and choose Properties.
3. On the Networking tab, select Internet Protocol Version 4 (TCP/IPv4) and choose Properties, then Advanced.
4. On the IP Settings tab, clear "Use default gateway on remote network".
5. Click OK on each window and reconnect.

With the box cleared, Windows no longer sends everything into the tunnel. The catch is that only the networks the VPN advertises by default (often its own subnet) will use it. To add specific destinations, use PowerShell.

Using PowerShell

Open PowerShell and run these in order. Replace the name with your profile name exactly as it appears in Settings.

Get-VpnConnection
Set-VpnConnection -Name "Office" -SplitTunneling $True
Add-VpnConnectionRoute -ConnectionName "Office" -DestinationPrefix 10.20.0.0/16

The first command lists your profiles so you can copy the name. The second enables split tunneling. The third adds a destination that must go through the tunnel, written in CIDR form. Private ranges such as 10.x.x.x and 192.168.x.x are described in RFC 1918, which is a useful read if the notation is new. To undo a route, Remove-VpnConnectionRoute takes the same parameters. Microsoft's support page on connecting to a VPN in Windows explains how profiles are created and where they appear.

This is include mode in practice: the VPN carries the networks you listed, and the rest goes out directly. If you want the opposite, a full tunnel with exceptions, use Method 1 or Method 3.

Method 3: read and adjust the routing table by hand

Use this only when you understand what you are changing, because a wrong route can cut you off from the internet. It is also the best way to see what any of the other methods actually did.

1. Open Command Prompt and run route print. Look at the IPv4 Route Table. The line with destination 0.0.0.0 and netmask 0.0.0.0 is the default route.
2. Note the interface address and the metric. Lower metric wins when two routes match equally.
3. Connect the VPN and run route print again. If the default route now points at the VPN adapter with a lower metric, you have a full tunnel.
4. To keep one local address direct, add a more specific route through your normal gateway, for example route add 192.168.1.50 mask 255.255.255.255 192.168.1.1. Use your own printer address and router address.
5. Reboot or disconnect and the route disappears, because it was added without the -p option. That is a safety feature while you experiment.

More specific routes beat the default route, which is why a single-address rule for a printer works even inside a full tunnel. Do not add routes you cannot explain, and never add the persistent option until the route has behaved well for a few days.

Prove the split is real

A setting you have not tested is a guess. Run this short check every time you change something, and again after the first reboot.

1. Compare public addresses. In a browser that is routed through the tunnel, look up your public IP address. Then do the same from the excluded app or from a browser profile that you excluded. The two addresses should differ. If they match, the app is still inside the tunnel, or the VPN is not connected.
2. Trace one destination. Run tracert 8.8.8.8 for an included destination and tracert to your printer's address for an excluded one. The first hop should be the VPN gateway for the first and your home router for the second.
3. Look at DNS. Split tunneling can leave name lookups going to the wrong resolver. Read what a DNS leak is and run a test with the VPN on, checking that lookups for protected traffic do not appear at your internet provider.
4. Restart and repeat. Some drivers and per-app rules only apply cleanly after a restart. If the result changes, trust the one after the reboot.

If the result is not what you expected, change one thing at a time. Two edits at once make it impossible to know which one fixed or broke it.

Three realistic setups

A home office with a network printer. Priya works from her desk PC and keeps the VPN on all day for company tools and general browsing. Every time it connects, the laser printer vanishes from the printer list. She excludes the local subnet using her app's local network option, or adds a single-address route as in Method 3. The printer returns, and her browser stays inside the tunnel.

A student who needs the campus portal and a safe cafe connection. Somchai studies at a cafe and wants the VPN on while browsing. The university portal asks for extra confirmation whenever it sees a tunnel. He does not leave the tunnel off all day. He excludes only the browser profile he uses for the portal, tests it at home first, and keeps everything else inside. If his app lacks per-app exclusion, he disconnects for the portal login and reconnects straight afterwards.

A remote worker who only needs the office network. Lin has a company-managed Windows VPN profile. IT gave her the office subnet. She enables split tunneling in the profile and adds the office range with Add-VpnConnectionRoute. Video calls and streaming music go out directly, and file servers go through the tunnel. Her company decides whether this is allowed, so she checks the policy first; NIST's guide to telework security discusses why organisations choose full or split tunnels for exactly this reason.

Common mistakes and quick fixes

• Excluding the wrong executable. A launcher is excluded but the real program is a different file. Check Task Manager's Details tab for the process name that actually makes the connection.
• Forgetting helper processes. Browsers use separate processes for network access. If an excluded browser still shows a tunnel address, exclude the helper too, or test with a different browser.
• Leaving an app outside on public Wi-Fi. The reason to exclude a banking app at home does not apply at an airport. Switch the exclusion off, or use mobile data for that task.
• Mixing methods. Running an app-level exclusion and a Windows profile route at the same time makes results hard to read. Use one method.
• Typing a route with the wrong mask. A mask of 255.255.255.0 covers 254 addresses, not one. Be sure you meant that.
• Never testing after a reboot. A route added without the persistent flag disappears on restart, which looks like the VPN "forgetting" your settings.
• Blaming the VPN for a firewall prompt. If Windows asks whether to allow a program on private or public networks, answer it. The VPN not connecting guide covers prompts that block the tunnel itself.

Limits and what to watch for

Split tunneling trades protection for convenience. Anything you exclude is no better protected than if the VPN were switched off, including the destinations it contacts and the network operator's view of it. An excluded app can also reveal your real address to a service, which may matter if you chose the VPN to keep that address private.

It is also not a fix for slow connections in general. If everything is slow, read why a VPN can be slow before assuming the tunnel is the cause. Per-app lists can drift as programs update their file locations, so review the list now and then. And remember that a company-issued laptop may be locked down by policy; changing its VPN routes can break compliance rules even if Windows lets you do it.

Finally, do not use exclusions to dodge a service's rules. If an app blocks VPN connections, the supported answer is to use it without the tunnel on a network you trust, not to hunt for a trick.

Summary

For windows vpn split tunneling, start with a written list of what stays inside and what stays outside, choose the method your setup supports (an app setting, a Windows VPN profile with PowerShell, or a careful routing-table edit), and always confirm the result with public-address, trace and DNS checks, including after a reboot. Keep sensitive traffic inside the tunnel, keep exclusions few, and revisit them when you change networks.

If you want a pass that matches a trip or a project, you can look at the pricing page at your own pace.