Split Tunneling Explained: Route Some Traffic Through VPN

Split tunneling is one of the most useful — and most overlooked — features a VPN can offer. By default, when you connect a VPN, all of your device's traffic goes through the encrypted tunnel. Split tunneling changes that: it lets you choose which apps, websites, or IP addresses use the VPN and which use your regular connection. Want to torrent through the VPN while streaming Netflix directly for maximum speed? Split tunneling. Want to access your local network printer while routing all internet traffic through the VPN? Split tunneling. In this guide, we explain how split tunneling works, the different modes, use cases, and which VPNs implement it best.

How Split Tunneling Works

When you enable split tunneling, the VPN app installs routing rules that classify each outbound packet. Packets matching the rules you define (by app, by destination IP, or by domain) go through the VPN tunnel. Everything else goes through your default network interface. The classification happens at the OS network stack, so it works transparently — apps do not know whether they are on the VPN or not.

There are three main modes of split tunneling, and the mode you choose affects both security and convenience:

Mode 1: App-Based Split Tunneling

You select specific apps to include or exclude from the VPN. For example, you could include only your torrent client and web browser on the VPN, leaving your email client and banking app on the regular connection. This is the most user-friendly mode and is supported by NordVPN, ExpressVPN, Surfshark, PIA, and most modern VPNs on Windows and Android. macOS support is less common because of Apple's Network Extension framework limitations, but ExpressVPN and NordVPN both support it on recent macOS versions.

Mode 2: Domain-Based Split Tunneling

You specify domains (e.g., netflix.com, yourbank.com) that should bypass the VPN. This is useful for services that block VPN traffic. ExpressVPN and Surfshark offer domain-based split tunneling in their browser extensions, and NordVPN recently added it to the main app.

Mode 3: IP-Based Split Tunneling

You specify IP addresses or CIDR ranges to include or exclude. This is the most flexible mode but requires technical knowledge. It is useful for accessing local network resources (printers, NAS, intranet) while routing internet traffic through the VPN. PIA, Mullvad, and OpenVPN (manual configuration) all support IP-based split tunneling.

Common Use Cases

1. Streaming While Torrenting

This is the most common use case. Put your torrent client on the VPN for privacy, and let Netflix, Hulu, and other streaming apps use your direct connection for maximum speed. This avoids the VPN speed penalty on streaming and prevents Netflix from blocking you for using a VPN. Configure this with app-based split tunneling: include your torrent client, exclude everything else.

2. Accessing Local Network Devices

When the VPN is on, you may lose access to local network devices — your printer, NAS, smart TV, or corporate intranet. With IP-based split tunneling, you can route traffic to 192.168.0.0/16 (or whatever your local subnet is) outside the VPN, while all internet traffic goes through the VPN. This is essential for home office setups.

3. Bypassing VPN-Blocking Services

Some services — banking sites, corporate portals, local government sites — block known VPN IPs. Instead of disconnecting the VPN every time you need to check your bank, configure split tunneling to route your banking app or banking domains outside the VPN. This is both more convenient and more secure than toggling the VPN.

4. Remote Work with Corporate VPN

If you use a corporate VPN for work, you can configure split tunneling so that only traffic destined for corporate IP ranges goes through the corporate VPN. Your general internet traffic goes through your personal VPN (or direct connection). This reduces load on the corporate VPN and improves performance.

5. Gaming on VPN, Browsing Direct

Competitive gamers who want DDoS protection can route only their game through the VPN while keeping voice chat, web browsing, and streaming on the direct connection. This minimizes VPN overhead for latency-sensitive game traffic while keeping other apps at full speed.

How to Set Up Split Tunneling

The exact steps vary by provider, but the general process is similar. Here is how to set up app-based split tunneling in NordVPN on Windows:

1. Open the NordVPN app and click the gear icon (Settings).
2. Click "Split Tunneling" in the left sidebar.
3. Toggle "Let specific apps bypass the VPN."
4. Click "Add app" and select the apps you want to exclude from the VPN (e.g., your banking app, local printer software).
5. Click "Apply" and connect to a VPN server.
6. Verify: Visit an IP-checker site in both an included and excluded browser. The included browser should show the VPN IP; the excluded browser should show your real IP.

For ExpressVPN on Windows:

1. Open ExpressVPN and click the three dots (…) > Options.
2. Go to the "General" tab and check "Do not allow specific apps to use VPN."
3. Click the "+" button and select the apps to exclude.
4. Click OK and connect.

Split Tunneling Security Considerations

Split tunneling introduces security trade-offs you should understand:

• Excluded traffic is unencrypted: Any app or domain you exclude from the VPN sends traffic over your regular connection. On public WiFi, this is a risk. Do not exclude sensitive apps on untrusted networks.
• DNS leaks on excluded apps: Some VPNs handle DNS for VPN-routed traffic but let excluded apps use the system DNS. This is usually fine, but verify with a DNS leak test.
• Kill switch interactions: If your kill switch is system-level (blocking all traffic when the VPN drops), excluded apps may also be blocked when the VPN disconnects. Application-level kill switches handle this better. Check your VPN's documentation.
• IP leaks via excluded apps: If you exclude a browser and visit a site that correlates sessions, the site may link your VPN IP and real IP, de-anonymizing you. Do not use split tunneling for high-anonymity needs.

VPN Split Tunneling Support Compared

VPN	Windows	macOS	Android	iOS	Mode
ExpressVPN	App	App	App	No	App-based
NordVPN	App	App	App	No	App-based
Surfshark	App + Domain	No	App	No	App + Domain
PIA	App + IP	No	App	No	App + IP
ProtonVPN	App + IP	No	App	No	App + IP
Mullvad	IP	IP	No	No	IP-based
CyberGhost	App	No	App	No	App-based

Note that iOS does not support true split tunneling due to Apple's Network Extension API restrictions. Some VPNs offer limited split tunneling on iOS through per-app VPN profiles, but this is configured via MDM (Mobile Device Management) and is primarily an enterprise feature.

Inverse Split Tunneling (Include Mode)

Most VPNs default to "exclude mode" — everything goes through the VPN except the apps you specify. Some VPNs (PIA, ProtonVPN, Mullvad) also offer "include mode" — nothing goes through the VPN except the apps you specify. Include mode is more secure because only explicitly trusted apps use the VPN. It is useful for sensitive workflows where you want only your browser or only your torrent client on the VPN and everything else on the direct connection.

The Bottom Line

Split tunneling is a power-user feature that dramatically improves the VPN experience. It lets you protect sensitive traffic without paying the speed penalty on everything else, access local network devices while encrypted, and bypass VPN-blocking services without disconnecting. For the best split tunneling experience in 2026, we recommend NordVPN (best app-based mode), PIA (best IP-based mode for advanced users), and ExpressVPN (best cross-platform consistency). Pair split tunneling with a kill switch, and you get the best of both worlds — privacy where you need it, speed where you don't.