Split Tunneling Lets Chosen Apps Skip Your VPN

Split tunneling sends the apps you choose around your VPN, over your normal connection, while everything else stays in the tunnel. Turn it on when one app breaks with the VPN on and exclude just that app, because whatever you exclude goes out on your real IP address.

What it does

NordVPN’s definition is the clearest of the four makers we read: the feature “lets you divide your internet traffic into two routes”. One goes through the tunnel, so sites see the VPN server’s address. The other “connects directly to the internet without a VPN, using your normal connection and IP address.”

Mullvad’s page puts the cost in capitals: “The Internet traffic in the excluded applications will not go through the VPN. Your own IP address will be exposed.” Whatever you exclude is ordinary traffic again: your internet provider, or the café’s Wi-Fi, can see where it goes, as it could before you had a VPN.

There are three ways to draw the line, and apps mix them:

• By app. You pick apps to exclude. The common form.
• By address. You exclude IP addresses or ranges; browser extensions do the same by website.
• Inverse. Everything bypasses the VPN except the apps you choose. Proton calls it Include mode, or Inverse mode on Android.

Who offers what, by platform

Read on each maker’s own pages on 7 October 2026.

Maker	Exclude apps on	Exclude addresses or sites	Inverse mode	iPhone and iPad
Proton VPN	Windows, Mac (experimental), Linux, Android, Android TV	IPs on Windows and Android; domains in the browser extension	Windows, Linux, Android, Android TV, extension	Not listed
Mullvad	Windows, Mac, Linux, Android	Not described	Not planned	“Not possible currently”
NordVPN	Windows, Android, Android TV	Ports and subnets on Linux; sites in the browser extension	Not described	Not listed
ExpressVPN	Windows, Mac (macOS 11 and later), Linux, Android 7.0 and later	IPs and subnets on Windows, Mac and Linux	Desktop apps	Single IPv4 addresses only

Of the four, ExpressVPN is the one that documents any split tunneling on iPhone, and there it excludes single IPv4 addresses, not apps. ExpressVPN itself calls it “a feature not usually available on iPhone VPN apps”.

Apple’s own deployment guide points to why. Its per-app VPN, Apple’s version of the idea, works on iPhone only when “a device management service” manages the app: a company tool, not a switch a consumer VPN can flip. The makers do not give that as their reason, so treat it as context rather than the cause.

Proton charges for it: split tunneling is “available to everyone with a paid Proton VPN plan.”

The catches the makers list

It can clash with the kill switch. Proton says split tunneling “is not compatible” with either of its kill switches on most platforms; Windows is the exception. NordVPN says its kill switch blocks excluded apps whenever it is on, so you lose internet in them until you turn one of the two off. If you rely on a kill switch, and the strict kind is the one worth having, check your app before combining them.

Exclusion can spread. Mullvad’s Windows page lists cases where excluding one app excludes another it launches. If an excluded Chrome opens a magnet link in qBittorrent, the torrent client “will leak your IP even if it’s set to use the Mullvad network interface”. Mullvad’s advice is to start installers from Windows Explorer, not from an excluded browser.

Safari cannot be excluded on a Mac. Both Proton and Mullvad say so, because WebKit apps share networking processes with macOS. Proton’s Mac version excludes apps only, needs its WireGuard or Stealth protocols, and is labelled experimental.

Your DNS may stay in the tunnel. The fear is usually that split tunneling leaks DNS. Mullvad and NordVPN describe the reverse: excluded apps keep using the VPN’s DNS server. NordVPN says this can confuse streaming services, which see one location in the DNS lookup and another in the connection. Mullvad’s fix is DNS over HTTPS in the excluded browser.

Should you turn it on?

Leave it off by default. Mullvad has no plans for an inverse mode because it believes “a VPN should be used by default and not by exception”, and the same reasoning applies to what you exclude.

Turn it on when something specific breaks:

• A site or app that blocks VPNs, such as a bank. Exclude that app, or that site in the browser extension.
• A device on your home network. NordVPN’s feature page says split tunneling lets you reach “printers, smart home appliances, and other LAN devices” that the VPN can cut you off from.
• A game or call that suffers on the VPN. Excluding it removes the detour. If everything is slow, the cause is usually elsewhere: distance to the server is the usual reason a VPN slows your internet, and a closer server fixes every app at once.

Exclude the one app that needs it, and test it: Mullvad suggests excluding a browser and checking that its connection check reports “Not using Mullvad VPN”.

On a work VPN

Company VPNs use the same word for a decision made by IT, not you. Microsoft’s Windows documentation calls the choice “force tunnel”, where all traffic goes through the VPN and which is the default, or “split tunnel”, where only listed routes do. The routes live in the VPN profile, which IT configures in tools such as Intune, so on a work laptop split tunneling is company policy rather than a toggle. The hardware at the far end that terminates all those connections is a VPN concentrator, which is a different thing from a better VPN.

Questions people ask

What is split tunneling in a VPN?

A setting that sends some of your traffic through the VPN and the rest straight out over your normal connection. Usually you pick apps to exclude; some apps also let you exclude IP addresses or websites, or reverse it so only chosen apps use the VPN.

Should I turn on split tunneling?

Only to fix a specific problem, such as a bank, game or local printer that does not work with the VPN on. Exclude that one app. Everything you exclude goes out on your real IP address, visible to your internet provider.

Is split tunneling safe?

Your VPN traffic stays as protected as before. The excluded traffic is not protected at all, and Mullvad documents cases on Windows where an app launched from an excluded app is excluded too, such as a torrent client leaking your IP.

Does split tunneling work on iPhone?

Mostly not. Mullvad says it is not possible currently, and Proton’s and NordVPN’s split tunneling pages do not list iOS. ExpressVPN offers it on iOS for single IPv4 addresses, not for apps.

What is inverse split tunneling?

The reverse: everything bypasses the VPN except the apps you choose. Proton calls it Include or Inverse mode; ExpressVPN offers it in its desktop apps. Mullvad says it has no plans to add it.

Can I use split tunneling with a kill switch?

It depends on the app. Proton says the two are incompatible on most platforms except Windows. NordVPN says its kill switch blocks excluded apps too, so you have to turn one of them off.

Does split tunneling make my VPN faster?

Only for the apps you exclude, because their traffic no longer goes through the VPN server. Apps still in the tunnel run at the same speed as before.