What Split Tunneling Is
Split tunneling lets you route some traffic through the VPN while the rest goes directly to the internet. By default, a VPN routes all traffic through its encrypted tunnel. Split tunneling breaks that into two paths: traffic you specify goes encrypted through the VPN, everything else connects normally. The motivation is usually performance: video calls, gaming, and local network devices all benefit from not going through a VPN server that may be hundreds of miles away.
App-Based Split Tunneling
The most common form. You pick which applications use the VPN and which bypass it. Example: your browser goes through the VPN for privacy, but Zoom connects directly for lower latency. Or: most apps connect normally, but your torrent client uses the VPN. VPNs with app-based split tunneling on Windows and Mac: ExpressVPN, NordVPN, Surfshark, Private Internet Access. Note: iOS does not support true per-app split tunneling due to Apple platform restrictions.
Inverse Split Tunneling (Exclude List)
Instead of choosing which apps use the VPN, you choose which apps bypass it. Everything else goes through the VPN. Useful when one specific service blocks VPN IPs (banking apps, some streaming services) but you want all other traffic protected. Supported by NordVPN and some others.
URL-Based Split Tunneling
Route specific domains through or around the VPN, regardless of which app makes the request. Less common than app-based. ExpressVPN supports this. More complex to configure since you specify domain names rather than clicking app icons in a list.
When to Use Split Tunneling
Video calls: Zoom, Teams, and Google Meet have lower latency and better quality connecting directly. Local network: printers, NAS, smart home devices on your LAN are often inaccessible when all traffic goes through a VPN. Corporate VPN: if you already run a work VPN for corporate resources, split tunneling prevents conflicts with a personal VPN. Streaming: if your VPN server is congested, let high-bandwidth streaming services connect directly.
When to Avoid It
If your threat model includes your ISP or the local network operator seeing any of your traffic, split tunneling defeats the purpose for those connections. Use full-tunnel mode when on networks you actively distrust. Corporate IT policies often prohibit split tunneling because it creates a potential exfiltration path outside the corporate network perimeter.