Split Tunneling: Which Traffic Bypasses the VPN and What That Exposes

Split tunneling is a VPN setting that divides your traffic between two routes: what you select travels through the encrypted tunnel to the VPN server, while the rest leaves over the ordinary Wi-Fi, Ethernet or mobile line under your real IP. Without it, a VPN works as a full tunnel, pushing every packet into the encrypted channel. Anything sent outside behaves as if the VPN were off: sites see your home address, and the provider sees where that traffic goes.

How a VPN app decides which traffic goes where

Two routing approaches exist. Per-app rules look at which program opened the connection, so the bank app bypasses the tunnel while the browser stays inside it. Destination rules match where packets are going: one IP address, a subnet, or a domain name resolved at runtime. Domain rules have a weak spot, since large sites run on content delivery networks whose addresses shift and get shared across unrelated services, so a rule tied to one IP can break or catch sites you never meant to touch.

Android shapes per-app behavior in most phone apps. The system API takes either an allowed list or a disallowed list of programs, never both at once, and the list must be set before the connection starts; after an edit the tunnel comes back up only via a reconnect (Android developer documentation).

Exclude mode (also called bypass) keeps everything in the tunnel except the items on your list. Inverse mode flips that: only listed apps or destinations use the VPN, and everything else goes direct.

Inverse mode, when only the listed apps are protected

Inverse (include) mode suits people who need the VPN for one blocked service or work resource and want the rest untouched. The trap: anything installed later starts outside the tunnel until you add it, and nothing warns you.

Good reasons to switch it on

• Local devices: a local network bypass toggle keeps printers, NAS boxes, smart TVs and the router's admin page reachable while the tunnel is up.
• Banking: payment apps that refuse VPN exit addresses still run from your home IP.
• Gaming: match traffic avoids the detour to the VPN server, keeping ping low.
• Speed: large updates, video calls and local streaming don't eat into the VPN's bandwidth.
• Local services: sites of your own country that refuse foreign IPs open normally.

Device support: Android and Windows yes, iPhone mostly no

Apple reserves per-app VPN for apps managed through device management (MDM), so a consumer app on a personal iPhone cannot route by program. Proton VPN, for example, lists Windows, macOS, Linux, Android, Android TV and its browser extension, with no iPhone app on the list; Hotspot Shield covers apps and sites on Windows and Mac but only sites on iOS. Check the settings of the exact app on your platform before relying on it.

How traffic ends up outside the tunnel by mistake

Excluded traffic carries your real IP, and DNS queries from such apps typically end up at the provider's resolver. Leaks rarely stem from software faults; they come from rules nobody revisits: an exclusion made for one evening and kept for a year, a domain pattern wider than planned, an inverse list missing a newly installed browser. On corporate networks, bypassed traffic also skips company filtering and monitoring, which is why administrators often disable the option.

To check your setup, open an IP lookup page inside a tunneled app and inside an excluded one, then compare both the visible address and the resolver.

Split tunneling next to a kill switch

A kill switch protects only traffic inside the tunnel (how it works). Excluded apps never use the tunnel, so when the VPN drops, they stay online on the bare connection by design. Some apps won't run both features together or soften the kill switch whenever exclusions are active, and a strict "block everything without the VPN" mode overrides your rules outright.

How many services publish the feature

Of 377 services in VPNRadarLab's main ranking, 124 say they offer split tunneling, 13 offer it partially, 36 say they don't, and 204 publish nothing about it. "Not stated" means the provider documents nothing, not that the feature is missing. Our split tunneling VPN ranking compares the services that do list it.

FAQ

Should split tunneling be on or off?

Keep it off until a specific app or site fails behind the VPN, then enable it just for that case.

Is split tunneling safe?

Traffic inside the tunnel is protected; whatever you exclude gets no VPN protection at all.

How is it different from a full tunnel?

A full tunnel sends every packet through the VPN; a split one sends only what you picked.

Split tunneling at a glance

The feature routes selected traffic around the VPN, per app, per address or domain, or in inverse mode. It helps with home networks, banking apps, gaming ping and heavy downloads, it's usually absent on personal iPhones, and a wrong or forgotten rule sends traffic outside the tunnel silently. Keep the exclusion list short, recheck it, and don't expect the kill switch to cover what you sent outside.