Split tunneling explained: what it is and when to use it

Most of the time a VPN is all-or-nothing: turn it on and every app on your device goes through the encrypted tunnel. Split tunneling breaks that rule. It lets you pick which apps or sites use the VPN and which connect directly, over your normal connection.

That sounds niche, and for a lot of people it is. But there are a few situations where it genuinely solves a problem, and a few where turning it on quietly undermines the reason you’re using a VPN in the first place.

When it’s genuinely useful

The classic case is a device or service that refuses to work through a VPN. Some banking apps and government sites block VPN IPs outright. Rather than toggling the whole VPN off every time you check your balance, you route just that one app around the tunnel and leave everything else protected.

It’s also handy for local devices. If you’re connected to a VPN but want to reach your home printer or a network drive, those local connections often break — split tunneling lets that local traffic skip the tunnel while your browsing stays protected. And it can save bandwidth: you might route a big, non-sensitive download directly while keeping your browser on the VPN.

When it quietly works against you

Here’s the catch. Every app you route around the VPN is an app whose traffic and real IP are exposed exactly as if you had no VPN at all. If privacy is your reason for using one, split tunneling is a hole you’re punching in your own protection, and it’s easy to forget which apps are on which side.

The common mistake is excluding a browser “just for one site” and then doing everything else in that same browser. If you’re in doubt, the safer default is to leave split tunneling off and let everything go through the tunnel.

A sensible rule of thumb

Use split tunneling surgically: exclude the one app that won’t cooperate, and nothing else. Keep anything to do with browsing, messaging or accounts inside the tunnel. Review your exclusion list now and then, because an app you excluded for one reason a year ago is still leaking today.

If your whole reason for a VPN is to stop a particular service from working properly without it, you probably don’t want split tunneling at all — you want the VPN on everything.