Split tunnelling
Sometimes one app works better without the VPN: your bank, a printer, a game. Split tunnelling lets that app skip the VPN while everything else stays on it. Whether you can do it depends on your VPN and your device.
Last updated 8 Oct 2026
The short version
- Split tunnelling sends chosen apps or websites around the VPN, over your normal connection.
- Windows and Android have it with most VPNs. iPhones mostly don't, and Macs vary.
- Anything you exclude isn't protected by the VPN or its kill switch.
When you'd use it
- Banking. Banks watch for logins from unfamiliar places, and a VPN can trigger extra security checks. Westpac, for one, asks customers on a VPN to disconnect and try again (more in our travel guide). Excluding the banking app avoids that without switching the VPN off for everything else.
- Things on your home network. Printers, Chromecasts and network drives can disappear while you're on a VPN. Excluding the app that talks to them, or your local network, brings them back.
- Games and video calls. These suffer most from the extra delay a VPN adds, especially through a server overseas.
- The reverse: only your torrent client or one browser uses the VPN, and everything else stays on your normal connection.
By app, by website, or the other way round
VPNs split traffic in different ways, and the same VPN often does it differently on each device:
- By app: pick apps that skip the VPN. The most common kind, on Windows and Android.
- By website or IP address: pick sites that skip it. This is all you get on iOS from the VPNs that offer anything there: Surfshark (websites) and ExpressVPN (single IP addresses).
- Inverse: only the apps you pick use the VPN. Surfshark's Android app calls this Reverse Bypasser; PIA and ExpressVPN's desktop apps and Proton VPN on Windows and Android have it too.
Which VPNs have it
"In every app" means Windows, macOS, iOS, Android and Linux. The notes list which devices have it and what it's called, in the provider's words.
| VPN | Split tunnelling |
|---|---|
| CyberGhost | In some of its appsAndroid (App Split Tunnel, by app) and Windows (Exceptions in Smart Rules, by website). CyberGhost doesn't list it for macOS, iOS or Linux. |
| ExpressVPN | Yes, in every appCalled Split Tunneling. Per app on Windows, macOS, Linux and Android; per website on Windows, macOS, Linux and iOS, where it is limited to single IPv4 address exclusions (no per-app on iOS). Desktop apps also have inverse split tunnelling. |
| Mullvad | In some of its appsWindows, macOS, Linux and Android, excluding chosen apps. Not on iOS or iPadOS. macOS covers outgoing connections only and Safari cannot be excluded; Windows Store apps cannot be excluded. |
| NordVPN | In some of its appsBy app on Windows, Android and Android TV. Not on iOS or macOS; Linux has an allowlist for ports and subnets instead. The browser extensions can exclude websites. |
| Private Internet Access | In some of its appsCalled Split Tunneling. Windows, Linux, macOS (pre-Monterey only) and Android; iOS is not listed. Modes include app-based, inverse, route-based and domain-based, plus Split Tunnel DNS on Windows and Linux. |
| Proton VPN | In some of its appsCalled Split tunneling, on paid plans. Windows and Android (include or exclude apps and IPs), Linux GUI, and macOS (experimental, exclude apps only, not Safari or other WebKit apps). Not documented for iOS. |
| Surfshark | In some of its appsCalled Bypasser. Windows and macOS (apps and websites), Android (apps and websites, plus Reverse Bypasser to send only chosen apps through the VPN) and iOS (websites only). Not in the Linux app. |
What catches people out
iPhones
iOS doesn't give ordinary VPN apps a way to exclude other apps, so none of these VPNs offers per-app split tunnelling on an iPhone. NordVPN, Mullvad, PIA and Proton VPN don't offer split tunnelling on iOS at all.
Macs and Safari
On macOS, Mullvad and Proton VPN can't exclude Safari or other apps built on Apple's WebKit (Mullvad, Proton VPN). PIA's split tunnelling only works on versions of macOS before Monterey (PIA), and NordVPN's Mac app doesn't have it.
Excluded apps aren't protected
An excluded app shows your real IP address, and the kill switch doesn't cover it. NordVPN notes that excluded apps may still use its DNS servers, which can confuse apps that check where you are.