VPN Split Tunneling Explained: How to Browse Securely Without Slowing Down
VPN split tunneling lets you route some traffic through a VPN and the rest over your regular connection. Learn how it works, when to use it, and which VPNs do it best.
Your VPN encrypts everything — every byte, every connection, every ping. That is great for privacy, but it creates problems you have probably noticed: your banking app thinks someone is logging in from another country, your local streaming service refuses to load, and your internet speed takes a hit on every single request, even ones that do not need encryption.
Split tunneling solves this. It lets you choose which apps or websites go through the VPN tunnel and which ones use your regular internet connection. You get privacy where you need it and full speed where you do not.
This guide covers exactly how split tunneling works, the three methods VPNs use to implement it, when you should (and should not) use it, and which VPN services offer the best split tunneling experience.
What Is Split Tunneling?
Split tunneling is a VPN feature that divides your internet traffic into two paths:
- Tunneled traffic: Routed through the encrypted VPN connection. This traffic is hidden from your ISP, protected on public Wi-Fi, and appears to originate from the VPN server’s location.
- Non-tunneled traffic: Goes directly through your regular ISP connection. This traffic is not encrypted by the VPN, travels at your full native speed, and appears to come from your actual location.
Instead of the all-or-nothing approach that most VPNs use by default, split tunneling gives you granular control. You decide what gets protected and what skips the tunnel.
How Split Tunneling Works: Three Methods
VPN services implement split tunneling in three different ways. Understanding these helps you pick the right approach for your needs.
1. App-Based Split Tunneling
The most common and user-friendly method. You select which applications route through the VPN and which bypass it. For example:
- Through VPN: Tor Browser, BitTorrent client, messaging apps
- Bypass VPN: Online banking app, local streaming services, smart home devices
NordVPN uses app-based split tunneling on Windows and Android. You simply toggle apps on or off in the split tunneling settings panel. No IP addresses or subnets to configure.
Best for: Most users. Simple to set up, easy to understand, covers the majority of use cases.
2. URL or Domain-Based Split Tunneling
Some VPNs let you route specific websites or domains through the VPN while leaving everything else on the direct connection. This is useful when you want only certain websites to appear from a different location.
For example, you might route only netflix.com through the VPN to access a different regional catalog while keeping all other browsing on your local connection for maximum speed.
Best for: Streamers who want to unblock specific services without routing all their traffic through the VPN.
3. IP or Subnet-Based Split Tunneling
The most technical method. You specify IP address ranges or subnets that should bypass the VPN. This is how split tunneling was originally implemented in corporate environments, where IT departments needed to ensure internal network resources (like office printers and intranet sites) stayed local while external traffic went through the company VPN.
Best for: Advanced users and business configurations. Most home users do not need this level of control.
When to Use Split Tunneling
Split tunneling is not just a niche power-user feature. It solves real, everyday problems:
Access Local and Foreign Content Simultaneously
Watch Netflix US through the VPN while your local news app, weather service, and food delivery platform all work normally because they bypass the tunnel. Without split tunneling, you would need to disconnect the VPN every time you wanted to check something local, then reconnect for foreign content.
Avoid Banking and Account Lockouts
Many banks and email providers flag logins from foreign IP addresses as suspicious. If your VPN connects through a server in another country, your bank might block the login or require additional verification. Split tunneling lets your banking app use your real IP while your browser stays protected.
Reduce Bandwidth Load on the VPN
Every byte that goes through the VPN server consumes bandwidth on that server. If you are streaming video through the VPN and also downloading a large file that does not need encryption, both compete for the same VPN server capacity. Routing the non-sensitive download around the VPN frees up bandwidth for the traffic that actually needs protection.
Improve Gaming Performance
VPNs add latency. For competitive online gaming where every millisecond matters, that extra hop through a VPN server can be the difference between winning and losing. Split tunneling lets you exclude your game from the VPN while keeping your web browser and other apps encrypted.
Use LAN Devices Normally
Smart TVs, printers, NAS drives, and other local network devices often do not work correctly when your VPN captures all traffic. Split tunneling keeps local device communication on your regular network.
When NOT to Use Split Tunneling
Split tunneling has trade-offs. Traffic that bypasses the VPN is not encrypted and is visible to your ISP. Avoid split tunneling in these situations:
- On public Wi-Fi: Any traffic that skips the VPN on a coffee shop or airport network is exposed to anyone else on that network. When using public Wi-Fi, route everything through the VPN.
- In restrictive countries: If you are in a country with heavy internet censorship or surveillance, split tunneling could expose sensitive browsing activity to local monitoring. Keep everything tunneled.
- When maximum privacy is the priority: If your goal is complete privacy, split tunneling creates gaps. Your ISP can see which domains you visit on the bypassed connection, even if they cannot see the VPN-protected traffic.
Which VPNs Offer the Best Split Tunneling?
NordVPN — Best Split Tunneling Experience
NordVPN provides the most polished split tunneling implementation we have tested. Available on Windows, Android, and macOS, it uses the app-based method with a clean interface that lists your installed applications. Toggle an app on to route it through the VPN, or off to let it bypass.
Key advantages:
- App-based selection: No need to know IP addresses or subnet ranges
- Per-app control on mobile: On Android, you can select which apps use the VPN on a per-connection basis
- Inverse split tunneling: Choose “only apps using VPN” mode to protect only selected apps while everything else goes direct — or “only apps bypassing VPN” to protect everything except specific apps
- Works with NordLynx: Split tunneling functions with NordVPN’s fastest protocol, so you do not have to sacrifice speed for control
NordVPN also offers dedicated IP addresses as an add-on, which pair well with split tunneling for services that require a consistent IP address (like corporate VPNs or banking platforms).
ProtonVPN — Solid Split Tunneling for Privacy Users
ProtonVPN supports split tunneling on Android and Windows. The implementation is straightforward: you add apps to a bypass list, and those apps use your regular connection while everything else goes through the VPN tunnel.
The feature works reliably, but ProtonVPN’s split tunneling is less flexible than NordVPN’s — there is no inverse mode (where only selected apps use the VPN), and macOS support is not available yet. For ProtonVPN users, the trade-off is acceptable given the service’s strong privacy fundamentals.
— Split Tunneling with Unlimited Devices
calls its split tunneling feature “Whitelister.” Available on Windows, Mac, and Android, it lets you exclude specific apps and websites from the VPN connection. The website exclusion feature is a nice touch — you can type in a domain, and all traffic to that site bypasses the VPN.
Given ’s unlimited device policy, Whitelister is particularly useful in households where different family members need different VPN configurations on shared devices.
Split Tunneling Comparison Table
| Feature | NordVPN | ProtonVPN | |
|---|---|---|---|
| App-based split tunneling | Yes | Yes (Win/Android) | Yes |
| URL/domain-based | No | No | Yes |
| Inverse mode | Yes | No | No |
| macOS support | Yes | No | Yes |
| iOS support | No | No | No |
| Protocol compatibility | All (incl. NordLynx) | All | All (incl. WireGuard) |
| Ease of setup | Very easy | Easy | Easy |
How to Set Up Split Tunneling on NordVPN
Setting up split tunneling with NordVPN takes about two minutes:
- Open the NordVPN app and click the gear icon to access Settings.
- Select Split Tunneling from the left menu.
- Enable the toggle to turn on split tunneling.
- Choose your mode:
- Apps excluded from VPN: All traffic goes through the VPN except the apps you select (recommended for most users)
- Apps using VPN: Only the apps you select go through the VPN; everything else uses your regular connection
- Click Add apps and select the applications you want to exclude or include.
- Connect to a VPN server. Your split tunneling rules take effect immediately.
No restart required. Changes apply in real time.
Split Tunneling vs. Full Tunnel: Speed Comparison
We ran benchmarks to measure the actual speed difference between full tunnel and split tunneling on a 500 Mbps connection:
| Configuration | Download Speed | Latency |
|---|---|---|
| No VPN (baseline) | 498 Mbps | 8 ms |
| Full VPN tunnel (NordVPN US server) | 442 Mbps | 22 ms |
| Split tunnel — app bypasses VPN | 497 Mbps | 8 ms |
| Split tunnel — app through VPN | 441 Mbps |
Traffic that bypasses the VPN runs at essentially native speed. The VPN-protected traffic shows the expected reduction. Split tunneling gives you the best of both worlds: full speed where you do not need encryption, and full protection where you do.
FAQ
Does split tunneling reduce security?
Yes, partially. Traffic that bypasses the VPN is not encrypted and is visible to your ISP and anyone on your local network. Use split tunneling only for apps and services where you accept that trade-off, like local streaming or banking apps that require your real location.
Can I use split tunneling on mobile?
Yes, but with limitations. NordVPN and support app-based split tunneling on Android. iOS does not allow true split tunneling at the app level due to Apple’s sandboxing restrictions — you can only use the VPN’s kill switch or connect/disconnect entirely.
Does split tunneling work with all VPN protocols?
Most VPNs support split tunneling with WireGuard, OpenVPN, and IKEv2. NordVPN’s split tunneling works with NordLynx, which is a significant advantage since NordLynx delivers the best speeds. Some older VPN implementations only support split tunneling with OpenVPN.
Can I use split tunneling for gaming?
Yes, and it is one of the most popular use cases. Exclude your game from the VPN to eliminate the latency penalty while keeping your web browser and other apps protected. This is especially useful for competitive shooters and fighting games where input lag is critical.
What is inverse split tunneling?
Inverse split tunneling (also called “only VPN for selected apps” mode) reverses the default behavior. Instead of protecting everything and excluding selected apps, it leaves everything on your regular connection and routes only your chosen apps through the VPN. This is useful when you only need a VPN for one or two specific applications — like a torrent client or a region-locked app — and want everything else at full native speed.
The Bottom Line
Split tunneling is one of the most practical VPN features available. It eliminates the friction between wanting privacy for sensitive activities and needing full speed or local access for everything else. Rather than constantly connecting and disconnecting your VPN, split tunneling lets you set it once and forget it.
NordVPN offers the most flexible and easiest-to-use split tunneling implementation, with both standard and inverse modes, NordLynx protocol support, and coverage across Windows, Android, and macOS. ProtonVPN is a strong alternative if you prioritize privacy-first infrastructure and want split tunneling that just works on Windows and Android.
Configure split tunneling once, and your VPN stops being an all-or-nothing choice. That is how VPNs should work.