A VPN normally captures everything. Every app, every request, every background sync gets wrapped up and sent through the tunnel. That is usually what you want — but not always.
Split tunneling lets you draw a line: these apps go through the VPN, everything else takes the ordinary route.
How it works
When your VPN connects, it installs a route that says “send all traffic here.” Split tunneling replaces that blanket rule with a more selective one, based on:
- App — route your browser through the VPN, but let your banking app connect directly.
- Destination — send traffic for specific sites or IP ranges through the tunnel and leave the rest alone.
- Country — route traffic destined for one country normally, and everything else through the VPN.
The decision happens on your device, before packets leave it. Nothing is sent through the tunnel and then pulled back out.
When it genuinely helps
Local devices stay reachable. Printers, NAS boxes, and smart-home gear live on your local network. A full tunnel can make them unreachable; split tunneling keeps them working.
Services that block VPNs. Banks and some streaming platforms refuse connections from VPN IP addresses. Excluding those apps avoids a lockout without disconnecting entirely.
Speed for traffic that does not need protecting. A large download or a video call carries real bandwidth. Routing it directly frees the tunnel for what actually needs it.
Reaching services at home while abroad. Traffic for your own country goes out normally, and everything else is protected.
What it costs you
This is the part that gets glossed over: anything outside the tunnel is not protected. It carries your real IP address and is visible to your network operator and your ISP, exactly as if the VPN were switched off.
That matters more than it sounds:
- An excluded app leaks your real location to that service — and to anyone observing the connection.
- Excluding one app can still be identifying. If your VPN traffic and your direct traffic start at the same moment, they can be correlated.
- On a hostile network, an excluded app is fully exposed.
A reasonable default
Start with the tunnel capturing everything. Add exclusions only when something actually breaks, and only for that specific app or destination.
If you are on a network you do not trust — a hotel, an airport, a café — turn exclusions off entirely. The convenience is not worth it there.
VpnHood supports app-based and country-based split tunneling on Android and Windows, and because the client is open source, you can read exactly how the routing decision is made rather than taking our word for it.
