Most VPN users run in full tunnel mode: all traffic goes through the VPN, all the time. Split tunneling changes this by letting you route specific apps, websites, or IP ranges outside the VPN while everything else stays protected. The main use cases are speed (excluding bandwidth-heavy services like local video streaming) and local network access (printers, NAS drives, home automation).
How Split Tunneling Works
When your VPN is active in full tunnel mode, your device sends all traffic to the VPN server first. The VPN server decrypts, forwards, and returns responses through the encrypted tunnel. Split tunneling creates two paths simultaneously: encrypted traffic through the VPN tunnel and unencrypted traffic through your regular internet connection.
The VPN client on your device manages which path each packet takes. App-based split tunneling routes by application (e.g., Chrome goes through VPN, Netflix does not). IP-based or URL-based split tunneling routes by destination address.
Standard vs Inverse Split Tunneling
Standard split tunneling: Default is no VPN. You add specific apps or sites that should use the VPN. Everything else bypasses it. Use this when you only need VPN for specific activities (work applications, sensitive browsing) and want everything else at full local speed.
Inverse split tunneling: Default is VPN for everything. You add specific apps or sites that should bypass the VPN. Use this when you want broad VPN coverage but need a few local services to work normally. NordVPN calls this "Bypasser" mode; ExpressVPN calls it "Split tunneling - Don't use VPN for specific apps."
When Split Tunneling Is Worth Using
- Local network access: Printers, NAS drives, smart home devices, and network-attached storage often fail when your full traffic goes through a VPN. Adding these local IP ranges to the bypass list solves this without disabling the VPN entirely.
- Bandwidth-heavy streaming: If you are already in the right country for a streaming service and do not need to unblock anything, routing that traffic outside the VPN gives you full local bandwidth speeds without the VPN overhead.
- Work + personal traffic on the same device: Remote workers who use a corporate VPN can use split tunneling to route work applications through the corporate VPN while personal browsing goes through a consumer VPN or directly.
- Banking and financial apps: Some banking apps block connections from known VPN IP ranges. Adding the banking app to the bypass list (or using inverse tunneling to whitelist it) lets it work normally while other traffic stays protected.
Split Tunneling Support by Provider
| Provider | Split tunneling support | Type available | Platforms |
|---|---|---|---|
| NordVPN | Yes (called Bypasser) | App-based + inverse | Windows, Android |
| ExpressVPN | Yes | App-based | Windows, Mac, Android, routers |
| Surfshark | Yes (called Bypasser) | App-based + URL-based | Windows, Android, Mac |
| Private Internet Access | Yes | App-based | Windows, Mac, Android, Linux |
| Mullvad | Limited (DNS-based) | DNS split tunnel only | All platforms |
Note: iOS restricts split tunneling at the OS level for third-party VPN apps. Most providers cannot offer full split tunneling on iOS; the workaround is per-app VPN configurations available only to enterprise users via MDM.
The Privacy Tradeoff
Any traffic you exclude from the VPN is visible to your ISP, network administrator, and anyone performing a man-in-the-middle analysis on your network. If you split-tunnel your browser while keeping torrents or messaging in the VPN, your browsing history is as exposed as if you had no VPN at all. Be intentional about what you route outside the tunnel. If in doubt, use full tunnel mode and accept the speed tradeoff.