Guide
How to set up split tunnelling
How to send some applications or addresses outside the tunnel while everything else stays inside, what every exception costs, and the check that proves the split is the one you asked for. Written against the clients of late 2026 and Android 17.
What this settles
Split tunnelling sends a chosen set of applications or addresses outside the tunnel and leaves everything else inside it. Each item on the list is traffic the VPN no longer touches, in full, on the ordinary network. Set up properly, it fixes the printer and the banking app without touching anything else; set up loosely, it is a leak you configured yourself. The steps below are the narrow version.
Two kinds of rule
Per application
The rule names a program, and that program's connections bypass the tunnel. Windows, macOS and Android clients offer it; since Android 17 a client can hand the list to a screen the system manages, so the exclusions are enforced by the operating system rather than the client — a client that opens that screen from its own settings is using it. iOS offers no per-app split to ordinary clients; the nearest thing is the local-network toggle below.
Per address or subnet
The rule names a destination, and traffic to that destination from any program bypasses the tunnel. It is coarser and harder to read back, because an address rule covers whatever answers at that address tomorrow. It is the right tool for a device on your own network and the wrong one for a service on the internet.
What goes outside
- A device on your own network — a printer, a NAS, a media server — that the tunnel's routing hides from you. Try the local-network toggle first; it is the smaller setting and covers most of these without a rule.
- An application that refuses connections from the exit's addresses, typically a bank's. The rule lets that one application see your real address and nothing else does. The bank then knows where you are, which is the trade.
- Nothing else by default. Every entry is an application whose traffic the network you are on can read. A long list is a VPN that protects the browser and little more.
An exception is for an application that will not work through the tunnel. It is not a way to reach a service that has decided not to serve the exit's country; that is the service's decision, and routing around it is outside what this page covers.
Setting the rule
- Open the client's split tunnelling section, often under connection or advanced settings. On Android 17 and later the client may open a system-managed screen for the same list; either way there is one list, and it is the client's own section that leads to it.
- Check the mode before adding anything. Most clients offer two: the listed apps bypass the tunnel, or only the listed apps use it. The second is inverse split tunnelling, and with an empty list it means nothing is tunnelled. Make sure the mode reads as you intend.
- Add the application, not its folder, and add the one executable that makes the connection. A suite with several processes may need each one; adding the installer's folder adds its updater too.
- Quit the application fully and reconnect the client. Rules apply to new connections. An application that stayed open keeps its old path and gives a false reading at the check.
Inverse mode
In inverse mode only the listed applications use the tunnel and everything else bypasses it. It is the right shape when one application needs the tunnel and the rest of the machine should behave as if no client were installed, and the wrong shape for anything else, because every application you forgot to list is on the open network. If you use it, the kill switch covers only the listed applications on most clients; the rest were never inside it to begin with.
Local network access
Most clients have a single switch that lets your own network's addresses through while keeping everything else in the tunnel. It is split tunnelling by subnet, chosen for you, and it covers the printer and the NAS without a rule. On a network you run yourself it costs little; on a public network it lets every device on that network reach yours, which is the reason it is off by default and worth turning off again before you leave.
Confirm the split is the one you asked for
- In the excepted application, find its own address check — a banking app's session details, a torrent client's address panel, any page opened in an excepted browser — and expect your own address and country.
- In any application you did not except, run the address check and expect the exit's. Do this in a browser you did not add to the list, and in one other application if you have one that shows its address.
- Run the full battery once from how to check your VPN is working, with the rules in place. A rule that covers more than you meant shows up there as a leak in something you expected to be inside.
What those checks prove
+The applications you listed, and only those, are on the ordinary network
+Everything else still leaves through the exit, lookups included
+The mode is the one you intended, and not its inverse
What they do not
−They say nothing about what the provider keeps of the traffic that is inside — that is answered on the retention pages
−A leak test cannot see a deliberate exception; the excepted application is checked from inside itself or not at all
−A rule set today follows the application through its updates, and an updated application may open connections from a process you did not list
When the split does not hold
The excepted app still shows the exit's address
The rule did not take, and the usual reason is that the app was already running. Split tunnelling applies to connections made after the rule is set; quit the app fully, reconnect the client and open it again. On Android, check whether the rule is in the client or in the system setting, because an app excepted in one and not the other follows whichever the operating system enforces.
A browser is the hardest case: its background processes keep connections open across a window being closed, so it needs quitting from its own menu, not from the window.
An app I did not except is showing my own address
Something broader than a per-app rule is in force. A per-address or subnet rule that happens to cover the destination, an inverse mode set by mistake so that only the listed apps are tunnelled, or a local-network toggle on a network that hands out public addresses will each do it. Read every rule, not only the app list, and turn the whole feature off to confirm that the address returns to the exit's; then add the rules back one at a time.
The printer or NAS still cannot be reached
Local network access is a smaller setting than split tunnelling and sometimes a separate one: it allows the addresses of your own network through while routing everything else. If the client has it, turn it on before adding a subnet rule by hand. If the device is reached by name rather than address, the name may be resolved through the tunnel's DNS, which cannot see your network; use the address instead.
A leak test passes but I excepted an app
The test ran in the browser, and the browser is inside the tunnel. A deliberate exception is invisible to a leak test by design: the excepted app's traffic is on the ordinary network, in full, and no page you open elsewhere will report it. The check for an exception is the excepted app's own address, as the last section describes, not the test page's.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.