vpn

What Is Split Tunneling? Choosing What Goes Through the VPN, and What It Costs You

secure-os· Updated September 4, 2026· 5 min read #vpn#privacy#network#threat-model

A gravel path in a park splitting into two branches around a patch of grass, with a white fingerpost signpost standing in the fork and two people beside a bench under dark trees

By default, a VPN takes everything. Every application, every request, every background process on the device goes through the tunnel.

Split tunneling breaks that rule on purpose. You choose what goes through the VPN and what uses the ordinary connection, and the two run side by side.

It exists because taking everything is often impractical. Your bank blocks the VPN address. Your printer sits on the local network and becomes unreachable. A video call gets worse when it detours through another country. Split tunneling is the answer to all three, and each one costs you something.

The two ways it is configured

By application. You list which programs use the tunnel, or which ones skip it. The browser goes through, the game does not. This is the common desktop and Android case.

By destination. You route by address or domain: this range through the tunnel, everything else direct. This is what business setups usually mean by the term, and it is more precise and more work.

Some clients call the second kind an exclusion list, a bypass list or a route rule. The name changes, the mechanism does not.

Aerial view straight down over a snow covered field where two dark muddy tracks come down from the top and merge into a single track heading right, with vehicle marks pressed into the white surface — Two muddy tracks across snow, seen from directly above, merging into one. From this height it is obvious which traffic took which route. On your own device it is not: nothing on screen tells you whether a given request went through the tunnel or beside it, which is the whole difficulty with split tunneling.

What it is genuinely good for

Local network access. Printers, network drives and smart home devices live on your own network, and a full tunnel usually cuts you off from them. Excluding the local range is the single most common and most reasonable use.

Services that refuse VPN addresses. Banks, some government portals and streaming platforms block known VPN ranges. Routing those directly is often the only way they work at all.

Latency sensitive traffic. Calls and games suffer from the extra hop. Sending them direct is a real quality gain.

The three ways it leaks

⚠️ This is the part the feature list does not mention.

One: DNS. The tunnel may carry your traffic while your name lookups go out on the ordinary connection, which hands your provider the list of sites you visit even though the pages loaded through the VPN. Our page on secure DNS covers how that happens. Check whether your client routes DNS with the application or globally, because the two behave very differently under split tunneling.

Two: the application you forgot. An exclusion list is a list, and lists go stale. Update an application, and it may run under a new process name that is no longer matched. Install a second browser, and it is outside the tunnel by default.

Three: the same site over two paths. If one application reaches a service through the tunnel and another reaches the same service directly, that service sees both addresses and can join them. The protection is not partial in that case, it is gone, because the link between your real address and the tunnelled one is exactly what the VPN was hiding.

The question that decides

Is the VPN there for convenience, or for a threat?

For convenience, say to reach a service from another country or to keep an untrusted network from seeing your traffic, split tunneling is a sensible tool. Exclude the local range, exclude the bank, keep the rest inside.

For a threat, where it matters that a specific party cannot connect your activity to you, split tunneling undermines the point. Partial coverage against an adversary who can observe both paths is not a compromise, it is a failure with extra steps. The honest answer there is a full tunnel, and living with the friction.

How it interacts with the kill switch

This catches people out. A kill switch protects the tunnel, not the traffic you deliberately routed around it. If the tunnel drops, the switch blocks the applications that were inside; the excluded ones keep working exactly as configured, because that is what you asked for.

So the two settings do not add up to full protection. A kill switch closes an accident. Split tunneling opens a hole on purpose. Turning both on does not cancel the hole.

Practical settings, if you use it

Exclude the local network range, not individual devices. Addresses on a home network change.
List what goes THROUGH the tunnel, not what stays out, if your client offers both. A default of exclusion means new applications start protected.
Re-check the list after updates, and after installing anything that browses the web.
Test it. Load a page in an included application and an excluded one, and confirm they show different addresses. If they show the same one, your rules are not doing what you think.

The short version

Split tunneling routes some traffic through the VPN and some around it, by application or by destination.
It is right for local devices, VPN-blocking services and latency sensitive traffic.
It leaks through DNS, forgotten applications, and the same service reached over both paths.
A kill switch does not cover the excluded traffic, and was never meant to.
Convenience: use it. Real threat: a partial tunnel is not a smaller tunnel, it is an open one.