Split tunneling explained: when to use it

What split tunneling actually is

With a normal VPN connection, every app on your device sends its traffic into the encrypted tunnel, and everything comes out at the VPN server with the server's IP address. Split tunneling adds a routing decision in front of that. For each app, your device asks one question: does this go through the tunnel, or straight out over the normal connection?

Apps in the tunnel behave exactly as they would on any VPN connection: encrypted on the way out, seen by websites as the VPN server. Apps outside the tunnel behave as if the VPN were off: they use your real IP address and whatever protection your network already has, which on the open internet is none from the VPN. That is the whole feature. The power and the risk both come from that split.

Exclude mode and include mode

Most implementations offer two directions. Exclude mode, sometimes called inverse split tunneling in reverse, sends everything through the VPN except the apps you list. Include mode flips it: only the listed apps use the VPN and everything else goes direct. Some VPNs also offer site-based rules in a browser, where specific websites bypass the tunnel rather than whole apps.

If you are unsure which to use, exclude mode is the safer default. New apps you install are protected automatically, and your list stays short: just the things that genuinely need to bypass the VPN. Include mode makes sense when you only want the VPN for one or two specific apps, like a torrent client, and want everything else untouched.

When split tunneling earns its keep

The classic case is an app that refuses to work over a VPN. Banking apps are the usual suspects: many flag VPN IP addresses as suspicious and block or challenge you. Excluding just the banking app lets it see your real connection while your browser and everything else stay protected. Read more on why this happens in our answer on why banks block VPNs.

It also helps with services that need to know where you really are, like local delivery apps, and with latency-sensitive games where the extra hop to a VPN server costs you, while you keep browsing protected in the background. And if the thing you cannot reach is a printer or NAS on your own network, you may not need split tunneling at all: ROOT's Allow LAN option keeps local devices reachable while the tunnel stays up for everything else.

The trade-offs to keep in mind

Excluded traffic is exposed traffic. It leaves your device unencrypted by the VPN, from your real IP, visible to your network and internet provider like any ordinary connection. That is fine when it is deliberate. The trouble starts when you forget: an app you excluded months ago for one errand quietly keeps bypassing the VPN forever. Review the list occasionally, and keep it as short as you can.

It is also worth knowing what split tunneling is not. It is not a kill switch: a kill switch guards the moment the tunnel drops, while split tunneling is a standing decision about which traffic uses the tunnel at all. The two work well together, and our post on how a VPN kill switch works covers that side. If you just want the short definition, the split tunneling answer page has it.