Split tunneling is a VPN setting that lets you choose which apps, sites or devices send their traffic through the encrypted tunnel, while everything else uses your normal internet connection. It can make everyday use more convenient, but every app you exclude is an app that is no longer protected by the VPN.
How split tunneling works
By default, a VPN sends all of your device’s traffic through the tunnel. That is sometimes called a full tunnel. With split tunneling, the app adds rules so that only part of your traffic goes that way. The rest goes directly out through your regular network, using your ISP-assigned IP address.
There are two usual ways to set the rules, and many apps let you pick between them.
- Include list (sometimes called inverse split tunneling): only the apps or sites you name use the VPN. Everything else goes directly.
- Exclude list: everything uses the VPN except the apps or sites you name.
The include approach tends to be easier to reason about if you only need the VPN for one or two purposes. The exclude approach is safer as a default, because new apps are protected automatically unless you add them to the list.
Why people use it
A full tunnel is simple, but it is not always practical. Here are the situations where splitting traffic is genuinely handy.
Reaching local devices
Printers, network storage, smart speakers and casting devices usually sit on your local network. Some VPN configurations block or interfere with local traffic, so excluding those apps, or allowing local network access, can keep them working.
Services that react badly to VPNs
Some banking apps, payment services or online platforms may flag or block traffic from VPN server addresses as a precaution. Excluding such an app lets you use it normally while the rest of your device stays protected. Check the terms of any service first, as policies differ, and do not use this to get around rules you have agreed to.
Saving bandwidth and speed
Large downloads, game updates or video calls may not need the tunnel. Letting them use your direct connection avoids the extra hop and the load on the VPN server. The saving depends on your connection and the service, so do not expect a fixed improvement.
Work and personal traffic together
If you connect to a company network by VPN, the organisation may set up split tunneling so that only work traffic goes through the company’s systems. Whether that is allowed is up to your employer’s IT policy, and you should follow it.
What you give up
Anything outside the tunnel gets none of the VPN’s protection. That has three practical consequences.
- Your ISP and local network can see it. Destinations and any unencrypted content are visible to them, as without a VPN.
- Websites see your real IP address. An excluded app reveals your actual address and approximate location to the service it contacts.
- Mistakes are easy. If you forget which apps are excluded, you may assume you are protected when you are not. Browsers are a common example, since people often add one browser to the list and then use it for everything.
On public Wi-Fi, this matters most. Risky networks are exactly where you want everything inside the tunnel, as we explain in our guide to public Wi-Fi safety. If you must exclude something there, limit the exclusions to the minimum.
Full tunnel or split: a quick comparison
| Feature | Full tunnel | Split tunneling |
|---|---|---|
| Traffic protected by the VPN | All of it | Only the selected part |
| Access to local devices | Can be restricted | Easy to allow |
| Chance of forgetting something | Low | Higher |
| Load on the VPN server | Higher | Lower |
How to set it up sensibly
The wording and location of the setting differ between apps and between operating systems, and not every platform supports it equally. Look for a section named something like “split tunneling”, “app exclusions” or “per-app VPN”. Then follow these habits.
- Prefer an exclude list for general use and add only what you really need to leave out.
- Write down what you have excluded and why, so it does not become a forgotten loophole.
- After changing the list, run an IP address lookup in each app or browser to confirm which address it shows.
- Pair it with a working kill switch so that protected apps do not leak if the tunnel drops. Our guide to the VPN kill switch explains how.
- Review the list now and then and remove entries you no longer need.
When to leave it off
If your goal is to keep your activity private from your ISP or a network you do not trust, use the full tunnel. Split tunneling is a convenience feature, not a privacy feature. It also does not help with the wider anonymity question that we answer in our anonymity explainer.
Where to start
Begin with the full tunnel and only introduce exceptions when something stops working, such as a printer or a payment app. Add the smallest exception you can, test it, and note it down. If you are still deciding which VPN supports the features you need, read how to choose a VPN, then browse more settings explained in our VPN basics section.
Frequently asked questions
Is split tunneling safe?
It is safe when used with care, but anything excluded from the tunnel loses the VPN's protection. Keep exclusions to a minimum and avoid them on untrusted networks.
Does split tunneling make my VPN faster?
It can reduce load by letting some traffic go directly, but results depend on your connection and the service. Do not expect a guaranteed improvement.
Is split tunneling available on every device?
No. Support differs between operating systems and VPN apps, so check the settings of your app on each device.
Should I put my browser on the exclude list?
Generally not, because browsers handle most of your sensitive activity. Excluding one means those sites see your real IP address.
