Guide
What is split tunneling, and when should you use it?
A VPN normally captures everything. Every app, every request, every background sync gets wrapped up and sent through the tunnel. That is usually what you want, but not always. Split tunneling lets you draw a line: these things go through the VPN, everything else takes the ordinary route.
How it works
When your VPN connects, it installs a route that says "send all traffic here". Split tunneling replaces that blanket rule with a more selective one. The decision happens on your device, before packets leave it, so nothing is sent through the tunnel and then pulled back out. There are several ways to draw the line, and most setups use more than one.
-
By app
Route your browser through the VPN and let your banking app connect directly, or the other way around. This needs the operating system to reveal which app a connection belongs to, which not every platform allows.
-
By domain
Name the sites that should go through the tunnel, or the ones that should stay outside it. Some clients can also block a domain outright on that device.
-
By IP address
The same idea one level down, matching addresses and ranges instead of names. It covers services that have no stable domain, and it is where you decide what happens to IPv6.
-
By country
Route traffic bound for one country normally and everything else through the VPN, or the reverse. Useful when you are abroad and local services still need to see you as local.
-
By local network
Printers, TVs, NAS boxes and your router's own page live on the network you are physically connected to. Leaving that range outside the tunnel keeps them reachable while everything else stays protected.
-
By DNS lookup
Name lookups are traffic too. You can keep them inside the tunnel even for destinations you excluded, so the network you are on cannot read which sites you are looking up.
One domain is rarely one domain. A single page usually pulls scripts, fonts, images, video and API calls from a dozen other hosts, often under completely unrelated names, so a rule for the address in your browser bar can leave a site half loaded or still blocked. Build the list from what the site actually requests: a browser's network panel shows every host a page contacts, and for a work or internal service the people who administer it can hand you the full set. The same applies to IP ranges. Guessing from the address bar is the usual reason domain rules do not behave as expected.
When it genuinely helps
Four situations where a full tunnel is the wrong tool and a line in the right place fixes it.
-
Local devices stay reachable
Printers, NAS boxes and smart-home gear live on your local network. A full tunnel can make them unreachable; leaving the local network outside keeps them working.
-
Services that block VPNs
Banks and some streaming platforms refuse connections from VPN addresses. Excluding those apps avoids a lockout without disconnecting entirely.
-
Speed for traffic that does not need it
A large download or a video call carries real weight. Routing it directly frees the tunnel for what actually needs protecting.
-
Reaching home services while abroad
Traffic for your own country goes out normally, so home banking and local streaming keep working, and everything else stays protected.
What it costs you
This is the part that gets glossed over: anything outside the tunnel is not protected. It carries your real IP address and is visible to your network operator and your ISP, exactly as if the VPN were switched off.
-
Excluded apps reveal your location
An excluded app leaks your real address to that service, and to anyone watching the connection between you and it.
-
Exclusions can still identify you
If your tunnelled traffic and your direct traffic start at the same moment from the same line, the two can be correlated even though only one is exposed.
-
A hostile network sees all of it
On a network you do not control, an excluded app is fully exposed to whoever runs that network.
Which default fits you
There is no single right setting, because people use a VPN for two different reasons and the sensible starting point is the opposite in each case. Decide which one you are, then start there and adjust.
-
If you are here for privacy: tunnel everything
Start with the tunnel capturing everything and exclude nothing. Add an exclusion only when something actually breaks, only for that one app or destination, and take it back out when you no longer need it. Every exclusion is a hole in the thing you came for, so the list should be short and deliberate.
-
If you are here for reachability: tunnel only what is blocked
If the VPN exists to reach something your network blocks, the reverse is usually better: send only the blocked apps or destinations through the tunnel and let everything else take the direct route. Local services keep working, speed stays close to normal, and the tunnel carries only what needs it, which draws less attention than routing everything.
One rule holds either way: on a network you do not trust, a hotel, an airport or a café, turn exclusions off and tunnel everything. Whatever you leave outside is readable by whoever runs that network, and convenience is not worth it there.
How VpnHood! does it
Each of the six has its own screen in the app, and its own page here. All of them work on Android, iOS, Windows and Linux, with one exception: splitting by app is Android only, because the other systems do not let a VPN see which app a connection belongs to. The client is open source, so you can read exactly how the routing decision is made instead of taking our word for it.
Split tunneling in VpnHood!
FAQs
Frequently Asked Questions
Let's find the answers to your questions.
