Split Tunneling Explained: Route Some Apps, Not All

Split tunnelling is a VPN feature that lets you choose which apps or sites go through the encrypted tunnel and which connect to the internet directly. Instead of all-or-nothing, you split your traffic in two: the apps you select get the VPN's protection and IP address, while everything else uses your normal connection.

Split tunnelling trades a little protection for a lot of convenience. Anything you route outside the tunnel gets none of the VPN's privacy — so it's a scalpel, not a default.

How split tunnelling works

Normally a VPN sends every app's traffic through a single encrypted tunnel. With split tunnelling on, the VPN app keeps a list of exceptions and sorts your outgoing traffic accordingly: matching apps or destinations go down the tunnel, and the rest are handed to your ordinary connection as if the VPN weren't there. It usually works one of two ways — an inclusion list (only these apps use the VPN) or an exclusion list (everything uses the VPN except these).

When split tunnelling is useful

Split tunnelling earns its place when the VPN gets in the way of a specific app. The common reasons:

• Keeping a banking or payment app on your real address so it doesn't flag a foreign login while the VPN protects your browsing.
• Reaching local devices — a printer, a smart-home hub, a network drive — that aren't available through the VPN.
• Running a speed-sensitive service directly while keeping a download or browser on the VPN.
• Using a service that outright blocks VPN traffic, without losing VPN protection everywhere else.

The privacy trade-off

The catch is simple and important: anything you route outside the tunnel has no VPN protection at all. Its traffic is visible to your ISP and the local network, and it uses your real IP address. That's fine for the app you deliberately excluded, but it becomes a leak if you forget what's on the list, or if an app you excluded starts handling something sensitive. Because of that, split tunnelling is best used sparingly and reviewed occasionally, rather than set once and forgotten.

Should you turn it on?

Leave split tunnelling off unless you have a concrete reason to turn it on — a specific app that needs your real address or your local network. When you do use it, keep the exception list short and revisit it now and then. If you're still forming the big picture of what protection you're actually getting, the guide to what a VPN is covers what full-tunnel protection does and doesn't include.

Inclusion versus exclusion, in practice

The two modes look similar but fail in opposite directions, and choosing the wrong one is the most common split-tunnelling mistake. Exclusion mode protects everything by default and lets you carve out a few exceptions — so a new app you install is covered automatically, and only the handful you deliberately excluded runs outside the tunnel. Inclusion mode does the reverse: only the apps on your list use the VPN, and everything else, including anything new, connects directly with no protection.

For privacy, exclusion mode is the safer choice, because the failure mode is "too much is protected" rather than "something leaked without me noticing." Inclusion mode makes sense only when you want the VPN to touch as little as possible — say, routing just one app through it — and you're comfortable that everything else is exposed. If you're not sure which you've got, assume the strict interpretation and check the setting.

A subtle gotcha: DNS and shared identifiers

Split tunnelling can interact with DNS in ways that surprise people. Depending on how the app handles it, the name-lookups for your excluded apps may go to your ISP's resolver rather than the VPN's, which quietly tells your ISP a bit about what those apps are doing. On some systems the DNS behaviour isn't cleanly split at all, so it's worth testing rather than assuming. If that sounds abstract, the mechanics are in IP addresses and DNS explained.

There's also an identity angle. If you route your browser through the VPN but keep an app that's logged into the same account outside it, the two can still be linked by that shared login — the split hides the network path, not who you are. Split tunnelling is a routing tool, not an anonymity tool, and it's easy to over-trust when apps that know you are running on both sides of the divide.

None of this makes the feature bad — it makes it a precision tool. Used deliberately, with a short exclusion list and an occasional check of what's actually going through the tunnel, split tunnelling solves real problems. Used carelessly, it's a slow leak you set up yourself and then forget about. The habit worth building is simple: turn it on for a specific reason, name the exception, and turn it off again when that reason has passed rather than leaving it running out of habit.