A VPN promises one simple thing: encrypt your traffic so nobody, not your internet provider, not a stranger snooping on public wifi, can see what you're doing online. That protection is real, but it isn't free. Routing every request through an encrypted tunnel adds latency, and a growing number of banking apps, streaming platforms, and workplace tools actively detect and block connections that look like they're coming from a VPN server. That normally leaves users with an awkward choice: switch the VPN off every time an app complains, or put up with the slowdown. A feature called split tunneling gets around that trade-off by letting you decide, app by app or site by site, which traffic goes through the encrypted tunnel and which travels over your regular, unencrypted connection instead.
What split tunneling actually does
Turn on a VPN the normal way, and every byte leaving your device gets pushed through an encrypted tunnel that hides your IP address. That's exactly what you want if the goal is privacy or getting around censorship, but it turns into a problem the moment you open a banking app that flags VPN connections, try to print something over your home wifi, or use a service that needs to confirm your real geographical location. Split tunneling carves out exceptions for precisely those situations. Depending on the provider, it works either as a blocklist, where you choose which apps get routed through the VPN, or as a whitelist, where specific apps and services are granted a direct, unencrypted connection to your regular network. Support for the feature is far from consistent across the industry. Proton offers solid split tunneling support across all of its platforms, while NordVPN runs into trouble on operating systems that enforce stricter network rules, such as macOS and iPhone.
How the feature works under the hood
There are two common ways providers build split tunneling. Surfshark and IPVanish use a whitelist model: you add specific apps or websites as exceptions, and any traffic tied to them skips the VPN encryption entirely and travels over your normal network instead. ExpressVPN flips that logic around. Rather than listing exceptions, you build a list of the apps and websites that should get the encrypted tunnel, and everything else runs on your unencrypted connection by default. Then there are providers like NordVPN and CyberGhost that offer both the include-list and the exclude-list approach, so you can pick whichever setup is easier for you to manage. Several of the bigger providers also let you configure split tunneling at the router level, meaning the rules apply to your entire wifi network directly from a supported router, without needing to touch individual devices. Which version works best for you comes down to how much day-to-day network security you actually need.
When it's worth switching on
Split tunneling isn't something every VPN user has to bother with, but a handful of everyday situations make it genuinely useful. It helps when you're connecting to devices on your own local network, like a printer, a doorcam, or a smart speaker, none of which need an encrypted connection to work properly. It also matters for high-security apps and services, such as banking websites or zero-trust digital workspaces, that specifically block IP addresses commonly associated with VPN providers. Bandwidth-heavy activities, including online gaming, video calls, and streaming in 4K, often struggle over a VPN unless your internet connection is fast enough, and split tunneling lets you route just those apps outside the encrypted tunnel. It's equally useful for services that rely on accurate geolocation data, such as weather apps or ridesharing apps, which tend to give better results when they can see your actual network location instead of a VPN server's.
When you should leave it off
Bypassing the VPN for certain apps can improve performance, but it comes with a real cost: split tunneling exposes your IP address, your geolocation data, and other identifying markers to whichever apps or websites sit on the unencrypted side of the connection. It also tends to switch off the tracker-blocking and ad-blocking protections a VPN usually provides. In effect, setting up a split tunnel is like flipping the VPN's off switch for select apps and services, leaving you exposed to precisely the things the VPN was meant to guard against. That makes split tunneling a poor choice on public wifi networks or when connecting through an internet provider that isn't fully trusted. There's also a subtler risk worth knowing about. Even when a VPN provider lets you keep your DNS, meaning your domain name server requests, masked while using split tunneling, those DNS requests can still leak outside the tunnel depending on how solid that provider's underlying security setup actually is. Anyone worried about DNS leaks while using split tunneling can check with a dedicated DNS leak test tool, such as BrowserLeaks, IPLeak, or the free testing tools offered by ExpressVPN and Surfshark, to confirm that traffic is routing the way it's supposed to.
Which VPN providers support it
Split tunneling is still a fairly new addition to the VPN toolkit, and it hasn't reached every provider yet. Even among the companies that do offer it, Apple's network protection tools on iOS and macOS make the feature difficult to implement properly, which is why support and functionality differ so much from one VPN to the next, with no two companies offering quite the same level of control. Several major providers have built it in regardless. Surfshark offers a tool called Bypasser that gives specific whitelisted apps and services unrestricted access to your home network, and it's available on Windows, macOS, Android, iOS, and iPadOS, with the browser extension even running its own separate version of Bypasser, making it one of the more complete split tunneling implementations on the market. ProtonVPN, the company behind ProtonMail, supports split tunneling on every operating system it runs on, including Linux, though Linux support is more limited than on other platforms because of technical constraints. Norton VPN has offered split tunneling on Windows and Android for a while, and as of June 2026 the feature is now also available for Mac and iOS devices. NordVPN, despite being one of the biggest names in the VPN market, doesn't support native split tunneling on Apple devices, but its implementation for Windows and Android is well built and highly configurable. ExpressVPN's support for Apple devices is newer and still improving, though its split tunneling features for Windows, Android, and Linux users are solid, and it can also be configured directly at the router level with popular router models, applying the rules before traffic even reaches individual devices.
