Split tunneling: useful everyday scenarios, security trade-offs, and setup questions

Most people flip a VPN to "on" and route everything through it. That is the simplest, safest default — but it is not always the most practical. Split tunnelling lets you decide, app by app or site by site, what goes through the encrypted tunnel and what uses your normal connection instead. Used well it removes friction. Used carelessly it quietly leaves things exposed that you assumed were protected.

This guide covers the everyday scenarios where split tunnelling genuinely helps, the security trade-offs it introduces, and the setup questions worth answering before you turn it on.

What split tunnelling is

Normally a VPN captures all of your device's traffic. Split tunnelling breaks that into two paths: some traffic goes through the VPN, and the rest goes directly over your regular internet connection. You choose which is which. Depending on the app, you can split by application (this browser through the VPN, that game outside it) or, less commonly, by destination (these websites bypass the tunnel).

There are usually two logical modes:

• Include mode: only the apps you list use the VPN; everything else stays on the normal connection.
• Exclude mode: everything uses the VPN except the apps you list, which bypass it.

The distinction matters, because a mistake in either direction has opposite consequences — more on that below.

Everyday scenarios where it helps

Split tunnelling earns its place when a full tunnel gets in the way:

• Local devices while staying protected online. Routing everything through a distant VPN server can break access to a home printer, a NAS, a smart-TV, or your router's admin page, because those live on your local network. Excluding local traffic lets you reach them while your browsing stays encrypted.
• Speed-sensitive apps. Latency matters for video calls, cloud gaming, and large downloads from a service that is already fast for you. Sending those outside the tunnel avoids the extra hop while your sensitive browsing keeps its protection.
• Region needs to differ per app. Sometimes you want one app to appear in another country while a banking or shopping site must see your real location to avoid fraud flags. Split tunnelling lets both be true at once.
• Services that dislike VPNs. Some banking apps, payment flows, and streaming or delivery services block or challenge VPN traffic. Excluding just those apps keeps them working without forcing you to disconnect the VPN entirely.
• Work and personal separation. You can route a work browser or client through the VPN while personal apps use the normal line, or the reverse.

The security trade-offs

Every app you send outside the tunnel is an app the VPN is no longer protecting. That is the whole trade, and it is easy to underestimate:

• Excluded traffic is fully exposed. Anything outside the tunnel uses your real IP and your ISP (or the local Wi-Fi operator) can see it, just as if the VPN were off. On an untrusted network that can matter — which is one reason a full tunnel is the safer default on public Wi-Fi.
• "Exclude one app" can leak more than you think. Modern apps spawn background processes, and a single browser may not be the only thing that talks to a site. Confirm that what you excluded is really the only thing bypassing the tunnel.
• DNS can betray you. Depending on the implementation, DNS lookups for excluded apps may or may not go through the VPN's resolver. If they leak to your ISP, an observer can still see which sites you are visiting even for "protected" apps.
• Set-and-forget drift. A rule that made sense on your home network may be a liability on hotel Wi-Fi. Split tunnelling is a per-context decision, not a permanent setting.

It is also worth being clear about what split tunnelling does not change: it is a routing choice, not an anonymity feature. It will not make excluded traffic private, and it does not alter any of the things a VPN simply cannot protect you from.

Setup questions to answer first

Before enabling it, work through these:

1. Include or exclude? If your priority is privacy, prefer exclude mode with a very short exclusion list — everything stays protected except the few apps you deliberately trust. Include mode (only listed apps protected) is riskier, because anything you forget to add is exposed by default.
2. What exactly am I bypassing, and why? Write down the reason for each excluded app. If you cannot state the reason, it should probably stay in the tunnel.
3. Where do DNS queries go? Check whether your VPN forces its own DNS for all traffic or only tunnelled traffic. If you are not sure, test it.
4. Does this rule suit my current network? Loosen split rules on trusted networks; tighten or disable them on public Wi-Fi.
5. Am I doing this at the device or the router? A router-level VPN protects every device but makes per-app splitting harder; a device-level app gives finer control. If you route through your router, our guide on setting up a VPN on a router explains the trade-offs.

For the bigger picture of how split tunnelling sits alongside features like the kill switch and multi-hop, see our overview of kill switch, split tunnelling, Meshnet and multi-hop.

The practical takeaway

Split tunnelling is a convenience tool with a security cost, and the cost is invisible until something you excluded gets exposed at the wrong moment. Use exclude mode with the shortest possible list, know exactly what each exclusion is for, verify your DNS is not leaking, and revisit the rules whenever you change networks. If you cannot justify sending an app outside the tunnel, the safest answer is to leave it inside.