Split tunneling: when and why to use it
Most of the time a VPN is all-or-nothing: every app on your device goes through the tunnel. Split tunneling changes that. It lets you send some apps through the VPN while others use your normal connection — handy for a few jobs, but every app you leave out is traffic the VPN no longer protects.
What split tunneling is
By default, a VPN wraps your whole device. Every browser tab, app, and background update travels through the encrypted tunnel. Split tunneling breaks that rule on purpose. You pick which apps (or sometimes which websites) use the VPN, and everything else goes out over your normal internet connection. Think of it as two lanes leaving your device: one private, one regular.
Good reasons to use it
Split tunneling earns its keep in a handful of situations where the VPN gets in the way:
- Local devices and printers. A VPN can hide your home network from you, so your printer or smart TV stops showing up. Excluding that traffic keeps local gear reachable.
- Banking apps that dislike VPNs. Some banks flag VPN traffic and lock you out. Letting just that one app skip the tunnel often fixes it.
- Casting and streaming to nearby screens. Sending video to a Chromecast or smart TV on your own network is simpler when that traffic stays local.
- Speed-sensitive apps. Large downloads, game updates, or video calls sometimes run faster on your normal connection.
The trade-off
Here is the catch: anything you route outside the tunnel is not protected. Excluded apps use your real IP address, and their requests can travel over your normal connection where your network or internet provider can see them. That is fine for a printer on your own network. It is a problem if you accidentally exclude a browser or a messaging app you meant to keep private. The more apps you leave out, the easier it is to lose track of what is protected.
How to set it up
- Find the feature
Open your VPN app and look for “Split tunneling,” sometimes under advanced or per-app settings.
- Choose your mode
Most apps let you either protect everything except a few apps, or protect only the apps you pick. Decide which fits your goal.
- Add the exception
Select the one app that needs to skip the VPN — for example your bank or a casting app — and add it to the list.
- Test both sides
Confirm the excluded app works as expected, then run an IP or DNS leak check on a protected app to be sure the tunnel still holds.
- Review it later
Come back to the list now and then so a temporary exception does not quietly become permanent.
Good candidates to exclude
- Printers, smart TVs, and other devices on your home network.
- Banking or payment apps that block or distrust VPN traffic.
- Casting tools like Chromecast or AirPlay sending video to a nearby screen.
- Work or government portals that need your real location.
- Large, non-sensitive downloads or updates where speed matters more than privacy.
Frequently asked questions
Is split tunneling safe?
The feature itself is safe to use. The risk is human: the apps you exclude are no longer protected, so they use your real IP. Keep the exclude list short and only leave out traffic you are comfortable not hiding.
Should I use it?
Only when you have a clear reason — a local printer, a banking app that blocks VPNs, casting to a TV, or a speed-sensitive download. If you do not have a specific need, leave it off and let the VPN protect everything.
Does iOS support split tunneling?
On iPhone and iPad it is usually unavailable, because Apple limits how VPN apps can route per-app traffic. Support is more common on Windows, Android, and some routers. Check the comparison table for what each provider offers on each platform.
What is the difference between split tunneling and a kill switch?
They solve opposite problems. Split tunneling lets chosen apps skip the VPN on purpose. A kill switch blocks traffic if the VPN drops unexpectedly, so nothing leaks by accident. Many people use both.