VPN Split Tunneling Explained: When and How to Use It

Q: Does VPN split tunneling reduce my privacy?

Split tunneling does expose some traffic to your ISP, but if you route sensitive activities like banking and email through the tunnel and only exclude low-risk traffic, the practical privacy impact is minimal. The key is being deliberate about which traffic you allow outside the tunnel.

Q: Can I use split tunneling on my router instead of individual devices?

Yes. Routers running DD-WRT, OpenWrt, or Tomato firmware, as well as many consumer routers with built-in VPN clients, support policy-based routing that assigns specific devices or VLANs to either the VPN or the direct connection, eliminating the need to configure a VPN client on every device.

Q: Will split tunneling affect my connection speed?

Split tunneling typically improves speeds for excluded traffic since that traffic no longer routes through a VPN server. The routing decision itself adds no meaningful overhead, and tunnelled traffic performs the same as with a full-tunnel VPN.

Q: What is the difference between split tunneling and a kill switch?

A kill switch blocks all internet traffic if the VPN unexpectedly drops, while split tunneling deliberately routes some traffic outside the tunnel while the VPN is active. You can and should use both features simultaneously for optimal security and flexibility.

Q: Is split tunneling supported by all VPN providers?

Most major VPN providers support app-based split tunneling on Windows and Android, but macOS, iOS, and Linux support varies. iOS in particular restricts per-app split tunneling, so verify platform support before choosing a provider.

Q: Can split tunneling expose my device to security risks from both networks?

When your device has routes to both a VPN network and the internet simultaneously, a compromised resource on either network could theoretically use your device as a bridge. This risk is low for home users but is a legitimate concern in corporate environments handling sensitive data.

by Tommy N. Updated Apr 23, 2026

VPN split tunneling is one of the most powerful — and most misunderstood — features available to home network users and remote workers alike. Instead of forcing every byte of your internet traffic through an encrypted VPN tunnel, split tunneling lets you choose exactly which apps or destinations travel through the VPN and which ones use your regular connection. Understanding when and how to use VPN split tunneling can dramatically improve your speeds, protect your privacy where it counts, and solve everyday frustrations like slow streaming or inaccessible local devices.

Diagram showing VPN split tunneling routing some traffic through an encrypted VPN tunnel while other traffic goes directly to the internet — Figure 1 — VPN Split Tunneling Explained: When and How to Use It

In this guide you will learn exactly what split tunneling is, how it differs from a full-tunnel VPN, the different types available, and step-by-step instructions to configure it on your device or router. Whether you are trying to keep your banking traffic private while streaming local content at full speed, or you need to access your home network while connected to a work VPN, the concepts here apply directly. If you are also interested in how your router handles IP addressing, check out our primer on what an IP address is and our guide to understanding DHCP — both are closely related to how split tunneling routes traffic.

VPN Split Tunneling Explained: When and How to Use It — complete visual guide showing tunneled vs. non-tunneled traffic flows — Figure 2 — VPN Split Tunneling Explained: When and How to Use It at a Glance

What Is VPN Split Tunneling and How Does It Work?

A traditional VPN creates a single encrypted tunnel between your device and a VPN server. Every packet you send — whether it is headed to your bank, a Netflix server, or your smart home hub — travels through that tunnel, gets decrypted at the VPN exit node, and then continues to its destination. This maximises privacy but at a cost: the extra hop adds latency, your VPN server becomes a bottleneck, and traffic that never needed encryption (like a local printer or a streaming service already geo-accessible to you) still pays the performance penalty.

Split tunneling breaks that all-or-nothing model. When enabled, your VPN client maintains two simultaneous paths: the encrypted tunnel and your normal internet connection. A routing policy — defined either by app, by IP address range, or by domain — decides in real time which path each packet takes. Traffic destined for your corporate intranet goes through the VPN; traffic headed to YouTube takes the direct route. The decision happens at the network layer before the packet ever leaves your device, so there is no perceptible delay from the routing decision itself.

Under the hood, the VPN client installs custom routing table entries when split tunneling is active. In a standard full-tunnel configuration the VPN pushes a default route (0.0.0.0/0) that captures all traffic. With split tunneling, only specific CIDR blocks or resolved IP addresses are pushed into that VPN route, and everything else continues to use your default gateway — typically your router's LAN IP. This is the same routing table your operating system consults for every connection, so the process is fast and deterministic.

It is worth distinguishing between three common flavours of split tunneling you will encounter in VPN clients. Inclusive split tunneling (also called standard or route-based) routes only specified traffic through the VPN and everything else goes direct — this is the most common default. Exclusive split tunneling (sometimes called inverse or reverse split tunneling) routes everything through the VPN except a defined exclusion list, which is useful when you want broad protection but need to carve out specific local services. App-based split tunneling makes routing decisions per-process rather than per-destination, so you can say "route all Firefox traffic through the VPN but leave Chrome on the direct connection" regardless of where either browser is connecting.

How to Set Up VPN Split Tunneling: Step-by-Step

The exact steps vary by VPN client and platform, but the following process covers the most common scenario — configuring split tunneling in a consumer VPN application on Windows or macOS.

Open your VPN client's settings panel — Look for a section labelled "Split Tunneling," "Per-App VPN," or "Manage Apps." Most major clients (ExpressVPN, NordVPN, Mullvad, ProtonVPN) expose this under Advanced or Connection settings. If you are configuring a router-level VPN, log in to your router's admin interface instead and look for the VPN client or policy routing section.
Choose your split tunneling mode — Decide whether you want inclusive (only listed apps/IPs use the VPN) or exclusive (all traffic uses the VPN except listed apps/IPs). For most home users protecting sensitive browsing while keeping streaming fast, inclusive mode targeting your browser or specific apps is the right choice. For remote workers who need broad corporate protection, exclusive mode that carves out local devices makes more sense.
Add your apps or IP ranges to the policy — In app-based mode, select the executables you want to include or exclude. In IP/subnet mode, enter the CIDR ranges you want routed through the tunnel. For example, adding 192.168.1.0/24 to the exclusion list ensures your local printer and NAS remain reachable even while the VPN is active. Use our subnet calculator if you need help expressing your network range in CIDR notation.
Apply the policy and reconnect — Most VPN clients require you to disconnect and reconnect for routing table changes to take effect. After reconnecting, the client will install the new routes. On Windows you can verify by opening a Command Prompt and typing route print; on macOS use netstat -rn in Terminal. Confirm that VPN-bound destinations show your VPN tunnel adapter and excluded destinations show your physical adapter.
Test both paths to confirm correct routing — Visit our What Is My IP tool while connected through an app that should use the VPN — the displayed IP should be your VPN server's exit IP. Then check from an excluded app or browser tab; the IP should be your real ISP-assigned address. Run a ping test to a local device such as your router to confirm LAN traffic is not hairpinning through the tunnel.

Split Tunneling Methods Compared

Not all split tunneling implementations are equal. The table below compares the four main approaches across the dimensions that matter most for home users and remote workers.

Method	Granularity	Performance Impact	Typical Use Case
App-based (inclusive)	Per process	Minimal — only listed apps tunnel	Routing a browser or torrent client through VPN while streaming direct
App-based (exclusive)	Per process	Low — most traffic tunnels	Corporate VPN with local printer/NAS exclusions
IP/subnet routing	Per destination CIDR	Very low — purely routing-table based	Accessing a remote office subnet while keeping other traffic direct
Domain-based	Per domain (DNS-resolved)	Slightly higher — requires DNS interception	Routing a specific SaaS tool through VPN without affecting all HTTPS
Router-level policy routing	Per device or VLAN	Depends on router hardware	Sending one VLAN of smart-home devices through VPN, leaving gaming consoles direct

Quick Tip: Use Router-Level Split Tunneling for Whole-Device Coverage

If you run a VPN client on your router rather than on individual devices, you can assign entire device groups — by MAC address or VLAN — to either the VPN or the direct connection. This means every app on a covered device is automatically tunnelled without installing a VPN client on phones, smart TVs, or IoT gadgets that don't support one. Check your router's documentation for "policy-based routing" or "selective routing" options, and see our guide to setting up a guest network for a practical VLAN segmentation approach you can adapt.

Troubleshooting Split Tunneling & Best Practices

Split tunneling is elegant in theory but can produce confusing results when misconfigured. The most common symptom is traffic that was supposed to go through the VPN appearing on your direct connection (or vice versa), which you can diagnose with the IP-check method described in Step 5 above. DNS leaks are a related hazard: even if your data travels through the VPN, a misconfigured DNS resolver can reveal your browsing habits to your ISP. Always pair split tunneling with a secure DNS configuration on your router and verify there are no leaks using our DNS lookup tool.

Performance issues are the second most common complaint. If excluded traffic feels slower than expected, your router may be a bottleneck rather than the VPN tunnel — run a speed test with the VPN fully disabled to establish a baseline. If speeds recover without the VPN but are still sluggish on excluded traffic, investigate whether your router's NAT table is being exhausted by VPN connection state entries. Routers with limited memory can struggle when maintaining both a VPN tunnel and large numbers of direct connections simultaneously.

Security-conscious users should audit their split tunneling rules periodically. Apps get updated, IP ranges for corporate resources change, and what seemed like a sensible exclusion six months ago may now route sensitive traffic in the clear. Keep your policy minimal: only exclude what genuinely needs to be excluded, and err on the side of routing ambiguous traffic through the tunnel.

Always verify the VPN exit IP from within a tunnelled app after any configuration change — do not assume the policy applied correctly
Enable DNS leak protection in your VPN client even when split tunneling is active, to prevent hostname lookups from revealing excluded destinations
Avoid excluding entire protocol ranges (e.g., all UDP) as a performance shortcut — this creates unpredictably large security gaps
On corporate VPNs, check your employer's acceptable-use policy before enabling split tunneling — many organisations prohibit it for compliance reasons

Pro Tip: Use our VPN Protocol Comparison tool to evaluate which VPN protocol (WireGuard, OpenVPN, IKEv2) best supports split tunneling on your platform. WireGuard in particular handles policy-based routing with very low overhead compared to older protocols, making it an excellent choice for router-level split tunneling on modest hardware.

Common Split Tunneling Mistakes to Avoid

Excluding your entire local subnet and then forgetting that smart-home devices on that subnet can now see traffic from both your VPN identity and your real IP simultaneously — a potential privacy leak
Using domain-based split tunneling for services that use CDNs with frequently rotating IP addresses — DNS-resolved routes can go stale within minutes, causing intermittent routing failures
Enabling split tunneling on a work-managed device without IT approval — many endpoint-security tools actively detect and block non-standard routing policies and may flag your device as non-compliant
Forgetting to update split tunneling rules after a VPN server or corporate IP range change — stale CIDR entries silently route traffic to the wrong path with no error message

Frequently Asked Questions

Does VPN split tunneling reduce my privacy?

Split tunneling does mean that some of your traffic is visible to your ISP and any on-path observers, so it inherently provides less blanket privacy than a full-tunnel VPN. However, privacy is not all-or-nothing: if you carefully route sensitive traffic (banking, email, research) through the tunnel and only exclude low-risk activities like local streaming or gaming, the practical privacy impact is minimal. The key is being deliberate about which traffic you expose rather than accidentally routing sensitive data in the clear. You can verify which addresses are resolving outside the tunnel using our DNS lookup tool.

Can I use split tunneling on my router instead of individual devices?

Yes, and router-level split tunneling is often the most convenient approach for households with many devices. Routers running DD-WRT, OpenWrt, or Tomato firmware — as well as many consumer routers with built-in VPN clients — support policy-based routing that assigns specific devices, MAC addresses, or VLANs to either the VPN interface or the direct WAN interface. This eliminates the need to configure a VPN client on every phone, tablet, and smart TV separately. The trade-off is that router-based VPN clients generally support fewer split tunneling modes than dedicated desktop clients.

Will split tunneling affect my connection speed?

Done correctly, split tunneling typically improves speeds for excluded traffic because that traffic no longer takes the detour through a VPN server. Tunnelled traffic will have the same performance characteristics as a full-tunnel VPN. The routing decision itself is essentially instantaneous — it happens in the kernel's routing table lookup — so there is no meaningful overhead from maintaining two simultaneous paths. The main performance risk is on low-memory routers that struggle to track both VPN and direct connection state simultaneously.

What is the difference between split tunneling and a kill switch?

A kill switch and split tunneling solve opposite problems. A kill switch is a safety net that blocks all internet traffic if the VPN tunnel unexpectedly drops, preventing accidental exposure of your real IP. Split tunneling is a deliberate policy that intentionally sends some traffic outside the tunnel while the VPN is fully active and healthy. You can — and generally should — use both features simultaneously: configure split tunneling to define your routing policy, and enable the kill switch so that if the VPN connection fails, excluded traffic is not suddenly joined by your previously tunnelled traffic on the direct path.

Is split tunneling supported by all VPN providers?

Most major consumer VPN providers now support at least app-based split tunneling on Windows and Android, but support on macOS, iOS, and Linux varies considerably. iOS in particular imposes restrictions on third-party VPN apps that make true per-app split tunneling difficult — most iOS VPN clients can only offer full-tunnel or full-exclusion modes. Before choosing a VPN provider, verify that split tunneling is available on all the platforms you use and that it supports the mode (app-based vs. IP-based) your use case requires.

Can split tunneling expose my device to security risks from both networks?

This is a legitimate concern sometimes called a "split-horizon" attack. When your device has active routes to both the VPN network and the internet simultaneously, a compromised resource on either network could theoretically use your device as a bridge to reach the other. In practice this requires an attacker who already has code execution on your device or on a resource you are actively connected to, so the risk is relatively low for typical home users. Corporate environments take this more seriously — which is why many IT departments disable split tunneling on managed devices — and if you handle sensitive work data, it is worth discussing with your security team before enabling it.

Key Takeaways

Split tunneling routes only specified traffic through the VPN while other traffic goes directly to the internet, improving speed and flexibility without sacrificing targeted privacy
The three main types are inclusive (whitelist), exclusive (blacklist), and app-based — choose based on whether you want broad protection with carve-outs or selective protection for specific apps
Always verify your routing policy is working correctly by checking your exit IP from both tunnelled and excluded applications after any configuration change
DNS leak protection is essential alongside split tunneling — even perfectly routed data traffic can leak hostname information through an unprotected DNS resolver
Router-level split tunneling lets you apply policies to every device on your network without installing VPN clients on individual devices, making it ideal for smart-home gear and media players

Related Guides

For authoritative networking standards and specifications, refer to the Internet Assigned Numbers Authority (IANA) or IETF RFC documents.

About Tommy N.

Tommy is the founder of RouterHax and a network engineer with over ten years of experience in home and enterprise networking. He has configured and troubleshot networks ranging from simple home setups to multi-site enterprise deployments, with deep hands-on experience in router configuration, WiFi optimization, and network security. At RouterHax, he oversees editorial direction and covers home networking guides, mesh WiFi system reviews, and practical troubleshooting resources for everyday users.