Most VPN users run in full tunnel mode: all traffic goes through the VPN, all the time. Split tunneling changes this by letting you route specific apps, websites, or IP ranges outside the VPN while everything else stays protected. The main use cases are speed (excluding bandwidth-heavy services like local video streaming) and local network access (printers, NAS drives, home automation).
How Split Tunneling Works
When your VPN is active in full tunnel mode, your device sends all traffic to the VPN server first. The VPN server decrypts, forwards, and returns responses through the encrypted tunnel. Split tunneling creates two paths simultaneously: encrypted traffic through the VPN tunnel and unencrypted traffic through your regular internet connection.
The VPN client on your device manages which path each packet takes. App-based split tunneling routes by application (e.g., Chrome goes through VPN, Netflix does not). IP-based or URL-based split tunneling routes by destination address.
Standard vs Inverse Split Tunneling
Standard split tunneling: Default is no VPN. You add specific apps or sites that should use the VPN. Everything else bypasses it. Use this when you only need VPN for specific activities (work applications, sensitive browsing) and want everything else at full local speed.
Inverse split tunneling: Default is VPN for everything. You add specific apps or sites that should bypass the VPN. Use this when you want broad VPN coverage but need a few local services to work normally. NordVPN calls this "Bypasser" mode; ExpressVPN calls it "Split tunneling - Don't use VPN for specific apps."
When Split Tunneling Is Worth Using
- Local network access: Printers, NAS drives, smart home devices, and network-attached storage often fail when your full traffic goes through a VPN. Adding these local IP ranges to the bypass list solves this without disabling the VPN entirely.
- Bandwidth-heavy streaming: If you are already in the right country for a streaming service and do not need to unblock anything, routing that traffic outside the VPN gives you full local bandwidth speeds without the VPN overhead.
- Work + personal traffic on the same device: Remote workers who use a corporate VPN can use split tunneling to route work applications through the corporate VPN while personal browsing goes through a consumer VPN or directly.
- Banking and financial apps: Some banking apps block connections from known VPN IP ranges. Adding the banking app to the bypass list (or using inverse tunneling to whitelist it) lets it work normally while other traffic stays protected.
- Gaming: VPNs add latency to online games. Split tunneling lets you route your game client directly for the lowest ping while browser and background traffic still goes through the VPN.
Split Tunneling Support by Provider
| Provider | Split tunneling support | Type available | Platforms |
|---|---|---|---|
| NordVPN | Yes (called Bypasser) | App-based + inverse | Windows, Android |
| ExpressVPN | Yes | App-based | Windows, Mac, Android, routers |
| Surfshark | Yes (called Bypasser) | App-based + URL-based | Windows, Android, Mac |
| Private Internet Access | Yes | App-based | Windows, Mac, Android, Linux |
| ProtonVPN | Yes | App-based + IP/domain-based | Windows, Mac, Android, Linux |
| Mullvad | Limited (DNS-based) | DNS split tunnel only | All platforms |
Note: iOS restricts split tunneling at the OS level for third-party VPN apps. Most providers cannot offer full split tunneling on iOS; the workaround is per-app VPN configurations available only to enterprise users via MDM.
How to Set Up Split Tunneling
The exact menu names differ by app, but the steps are the same everywhere: open the VPN app, go to Settings, find Split Tunneling (or Bypasser), enable it, choose whether you are listing apps that use the VPN or apps that bypass it, then add those apps or IP ranges and reconnect.
- Open your VPN application and go to Settings or Preferences.
- Find Split Tunneling, Bypasser, or the equivalent menu for your provider.
- Enable the feature.
- Choose your mode: apps or addresses that bypass the VPN, or apps that must use the VPN (inverse).
- Add the specific apps or IP ranges you want to configure.
- Reconnect to the VPN for the new rules to take effect.
For local network access specifically, add the IP range 192.168.0.0/16 to the bypass list. This lets every device on your home network keep talking to each other while all other traffic still routes through the VPN.
The Privacy Tradeoff
Any traffic you exclude from the VPN is visible to your ISP, network administrator, and anyone performing a man-in-the-middle analysis on your network. If you split-tunnel your browser while keeping torrents or messaging in the VPN, your browsing history is as exposed as if you had no VPN at all. Be intentional about what you route outside the tunnel. If in doubt, use full tunnel mode and accept the speed tradeoff.