Definition and the simple model

Split tunneling is a VPN setup where not all traffic is routed through the VPN tunnel. Instead, you define which traffic should use the VPN and which traffic should go directly to the internet.

A simple model is:

  • VPN traffic: selected apps, networks, or destinations (often by domain or IP) that you want protected.
  • Direct traffic (bypass): everything else that is allowed to leave your device without the VPN tunnel.

Because the bypass part is outside the VPN tunnel, it changes the privacy and control you get for that traffic.

What you typically configure (the main parts)

Most split-tunneling setups require you to make one or both of these choices:

  1. Selection method

    • App-based: choose which installed apps should use the VPN.
    • Destination-based: choose domains, URLs, or IP ranges to route via the VPN.

  2. Direction of the rule

    • Route selected through VPN (whitelist-style): only the chosen apps/destinations go through the VPN.
    • Exclude selected from VPN (bypass-style): most traffic uses the VPN, except what you list to bypass.

  3. What happens to DNS (important) Even if only some traffic is tunneled, DNS behavior affects what traffic you reveal to your network. If the VPN supports it, many users aim to ensure that DNS used for tunneled destinations is handled in a way that matches their privacy expectations.

Exceptions, limits, and what can change the outcome

Split tunneling is powerful, but these factors can affect results:

  • Not all apps behave the same: Some applications open connections in ways that make it unclear whether rules apply as expected.
  • Domains can be tricky: If you select by domain but the app uses IPs directly, or resolves through different paths, traffic may not match your intended list.
  • Bypass traffic is still “real” network traffic: Traffic that does not go through the VPN can still be observed by your local network or by the destination, depending on your environment.
  • “Leak” protections may not align with bypass rules: If your goal is to prevent any DNS or routing exposure for certain destinations, you should confirm what your specific setup does for both tunneled and bypassed traffic.

If a provider’s app does not expose split tunneling options, you may not be able to achieve it with the same interface, and you should plan around that limitation.

Practical checklist to set it up and verify it

Use this provider-agnostic workflow to configure and then verify split tunneling:

  1. Decide the selection approach

    • If you want protection for specific programs (for example, a browser or work apps), use app-based selection.
    • If you want protection for certain websites or services, use destination-based selection.

  2. Pick whitelist vs bypass carefully

    • Whitelist-style: you route only what you select through the VPN.
    • Bypass-style: you route most traffic through the VPN, then exclude what you want direct.

  3. Handle DNS expectations If your VPN app offers DNS-related options tied to tunneling, set them in a way that matches your intention for tunneled vs bypassed destinations.

  4. Verify with controlled tests

    • Test a chosen app/destination and confirm it uses the VPN path.
    • Then test a bypassed app/destination and confirm it does not.

    Because test methods vary by device and environment, treat verification as essential rather than assumed.

  5. Re-check after changes Updates to apps, OS networking, or VPN software can change routing behavior. Re-run your verification after major updates.

Summary: the key takeaway

To set up split tunneling, define what you want protected (selected apps/destinations) and what you want to bypass, then verify DNS and actual routing behavior for both categories. The biggest limitation is that bypass traffic is not protected by the VPN tunnel, so your expectations for privacy and leakage must match that reality.