What split tunneling means (and how it works)

Split tunneling is a VPN configuration where only specific traffic uses the VPN tunnel. Other traffic continues through your regular internet connection.

In practice, your VPN client applies rules such as:

  • App-based rules: specific programs send their traffic through the VPN.
  • Domain-based rules: only certain websites go through the VPN.
  • IP-range rules: traffic to selected IP addresses routes through the VPN.

When split tunneling is enabled, the client decides for each connection attempt whether it matches the “use VPN” rules. Matching traffic is sent through the VPN; non-matching traffic is sent normally. Because of that, split tunneling can improve speed or keep local services working, but it also changes your security assumptions—your non-VPN traffic is not protected by the VPN tunnel.

Step-by-step: enable split tunneling in your VPN client

The exact wording and location differ across VPN clients, but the steps below match how most desktop and mobile apps expose the feature.

1) Confirm your VPN client supports split tunneling

Look in the client’s settings for items named similar to:

  • “Split tunneling”
  • “Bypass VPN” / “Exclude traffic”
  • “Routes” or “Smart routing” (sometimes used to describe split behavior)

If you cannot find anything related to split tunneling, the client may not support it in your build, or access to the setting may be restricted by organization policy.

2) Open the VPN client settings

Start the app and go to its Settings or Preferences area.

3) Switch split tunneling on

Enable the toggle for split tunneling (or turn on the equivalent mode).

Some clients offer more than one style:

  • Include list mode (only specified apps/domains go through VPN)
  • Exclude list mode (everything goes through VPN except specified items)

Choose the mode that matches what you want to route.

4) Add the rules for “VPN traffic” and “bypassed traffic”

Create rules using the interface provided. Typical inputs include:

  • Selecting apps from a list (desktop clients often support this)
  • Entering domains (e.g., example.com)
  • Adding IP ranges (more common in advanced/network-oriented clients)

If the client supports both “include” and “exclude,” avoid mixing them unless the client clearly defines how conflicts are resolved.

5) Configure DNS and IPv6 handling (if offered)

Many clients include options about DNS behavior when tunneling is split.

  • Some let you route DNS queries through the VPN.
  • Others keep DNS local, which can change what traffic is actually visible where.

If you see a setting like “DNS over VPN,” “Use VPN DNS,” or “Local DNS,” pick the option that aligns with your goal. If you are unsure, keep it at the default and rely on testing (next section).

6) Save changes, then reconnect

After adding rules, save your changes and restart the VPN connection (disconnect/reconnect) so the client applies the new routing rules.

7) Verify the rules actually take effect

Open the sites or run the applications you intended to route through the VPN and compare behavior with items that should bypass it.

Practical checks to confirm split tunneling is working

Because rule matching can be subtle, verification is important.

Check 1: Compare the public IP for VPN-routed traffic vs bypassed traffic

  • Visit an IP-echo or “what is my IP” page while the VPN is connected.
  • Then test a site or application that should bypass the VPN.

If both show the same IP behavior, your bypass rules may not be applied as expected.

Check 2: Test the exact apps/domains you configured

Split tunneling is rule-based. For each configured rule:

  • Launch the specific app you selected (not just a different browser tab).
  • Access the exact domain(s) you added.

If the rule is domain-based, note that redirects and CDNs can lead to different final hostnames.

Check 3: Watch for rule priority and conflicts

Some clients apply rules in a specific order (for example, “more specific match wins”). If you notice unexpected results:

  • Remove overlapping entries.
  • Temporarily disable one rule group.
  • Re-test.

Check 4: Validate DNS behavior

If DNS is handled locally, domain lookups may occur outside the VPN while the subsequent connections may or may not follow the intended route. If your client offers DNS settings, confirm which option is active.

Check 5: Re-test after reconnecting

Some clients only apply routing changes after a reconnect. If changes seem ignored, disconnect/reconnect and try again.

Split tunneling changes the traffic protection model, so these limitations matter.

Limitation 1: Non-VPN traffic is still your responsibility

Traffic that is bypassed is not routed through the VPN tunnel. That means it can still be observed and affected like any normal connection. If your goal is to protect all traffic, split tunneling is not the right fit.

Limitation 2: DNS, IPv6, and “leaks”

Even when split tunneling is configured, practical details like DNS handling and IPv6 can cause surprises. Some environments may still generate traffic patterns you did not intend to bypass. Testing helps identify what actually happens in your setup.

Limitation 3: What counts as “app traffic” varies by OS

On some platforms, app selection may not capture all network activity (for example, helper processes or system components). Domain-based rules can be more predictable, but not always.

Two common approaches:

  • Include rules: only listed items use the VPN.
  • Exclude rules: everything uses the VPN except listed items.

If you invert the logic accidentally, you’ll get the opposite of what you intended.

Some clients treat split tunneling as route/policy management; others treat it as application filtering. The user interface may hide this difference, but it affects what is realistically controllable.

If you can’t find split tunneling in your client

Not every VPN client offers it, and sometimes the option is hidden due to configuration or policy.

If you can’t enable split tunneling:

  • Double-check the client’s settings for alternative names like bypass rules or smart routing.
  • Ensure you’re using the app version that supports the feature (version support can vary).
  • If this is a work/school-managed VPN, your organization may disable advanced routing settings.

When split tunneling is unavailable, you can still compare your use-case with routing choices like “always VPN,” but you won’t be able to selectively route certain apps/domains through the tunnel using that client’s UI.

Final checklist (so you can be confident)

  • You found a split tunneling (or bypass/exclude) setting. - You turned it on, chose the right mode (include vs exclude), and saved changes. - You added rules that match the exact apps/domains you plan to test. - You reconnected the VPN after changes.