Ever wanted to watch your local Netflix library without disconnecting from your VPN? Many people face this same VPN dilemma. When you’re fully protected, some apps slow down or stop working. Turn your VPN off, and suddenly you’re fast but exposed. That’s where VPN split tunneling comes in. 

Split tunneling lets you choose which apps or websites use your secure connection through the VPN, and which ones go directly through your regular internet connection. The result is faster internet speed, fewer compatibility issues, and no need to toggle your VPN on and off.

In this guide, you’ll learn what VPN split tunneling is, how it works, when to use it, and how to set it up safely in Windscribe. Let’s break it down. 

Why VPN Split Tunneling Exists

To understand the split tunneling feature, you first need to understand the trade-offs of using a VPN (Virtual Private Network). A VPN connection encrypts all your online traffic and routes it through remote servers, protecting your data from snoops, trackers, and hackers. But that extra security layer comes with side effects.

VPNs Slow Down Your Internet

Every packet of data that goes through your VPN service gets wrapped in encryption, which takes processing power and extra travel time through remote servers. That can reduce internet speed by 10–40%. The result is more lag, slower downloads, and reduced streaming quality. 

Some Apps and Services Block VPN Traffic

Some platforms don’t particularly like VPNs. Banks, payment sites, and streaming services like Netflix or Hulu often block Virtual Private Network traffic to prevent fraud or enforce region rules. Even corporate networks and government portals may reject encrypted connections, forcing you to disconnect.

Local Network Access Issues

When your VPN is active on your home network, your device behaves as if it's on a separate network. This causes printers to disappear, smart home devices to go offline, and file sharing or NAS drives to stop working. It’s a common side effect of routing all traffic through the VPN.

These limitations force people into a constant on-off routine: turning on the VPN for security, turning it off to get something done, then forgetting to turn it back on. It’s inconvenient, risky, and a major productivity killer. This is where split tunneling comes in.

What is Split Tunneling?

Split tunneling is a VPN feature that lets you send some of your internet traffic through an encrypted tunnel while allowing other traffic to access the internet directly.

When you turn on a VPN, normally everything you do online travels through one secure, encrypted route – your secure tunnel. With split tunneling, your connection splits into two paths running at the same time:

• Path 1: The encrypted VPN tunnel, which is secure and private but slightly slower.

• Path 2: Your direct internet connection, which is fast and convenient, but unprotected and visible to your ISP.

You decide which apps or websites use which path. Maybe your browser and email go through the VPN, while your gaming or streaming traffic uses your regular internet connection for better speed. Both routes work simultaneously without interfering with each other.

Think of it like a highway with two lanes. The VPN lane has security checkpoints (encryption) that slow things down a bit, but keep you safe. The express lane has no checkpoints, so it’s faster but less secure. Split tunneling lets you choose which lane each app takes based on your actions.

How Does Split Tunneling Actually Work?

At a basic level, split tunneling turns your VPN app into a smart traffic director. Every time your device sends data online, the VPN inspects the packet and decides where it should go – through the VPN tunnel for security or through your normal internet connection for speed. Once you set the rules, all happens automatically.

You control what goes where. You can:

• Choose which apps use the VPN tunnel

• Decide which websites or domains should go through the VPN

• Specify which IP addresses get encrypted routes

Your VPN uses these rules to create routing logic inside your device. Behind the scenes, your computer has more than one network interface – one for your regular internet, and another virtual interface created by the VPN (known as a tun/tap device). When you turn on split tunneling, the VPN modifies your system’s routing table, adding precise rules that determine which path each packet takes.

For example, your browser traffic to a banking website might be routed through the encrypted VPN tunnel, while your video stream goes straight through your local network for better speed. The operating system checks these routing rules every time a new connection starts, then sends each packet through the correct VPN tunnel.

All of this happens in milliseconds. From your perspective, it feels seamless, but under the hood, your VPN client is constantly routing traffic across two different gateways, keeping your secure traffic encrypted and your non-sensitive traffic fast.

Types of Split Tunneling

Not all split tunneling works the same way. Depending on your VPN provider and device, you might have access to different VPN modes that route your traffic differently. Each type offers a balance between privacy, speed, and convenience. Here are the main types of split tunneling you should know about.

App-Based Split Tunneling

App-based split tunneling lets you choose exactly which applications use your VPN connection. You can select from a list of installed apps and decide which ones go through the encrypted tunnel and which stay on your regular connection. It’s the most common type of split tunneling, available on Windows, Android, and some macOS clients.

URL-Based Split Tunneling

URL-based split tunneling focuses on websites instead of apps. You manually enter specific domains to connect outside the VPN while keeping the rest of your internet traffic encrypted. This setup works well for people who rely on web apps or browser workflows, especially when certain sites block VPN access. It’s common in browser-based VPNs and some desktop clients. Windscribe gives you control over this in the IPs & hostnames feature in the Split Tunneling settings. 

Inverse Split Tunneling (Inclusive Mode)

Inverse split tunneling works in reverse. By default, none of your traffic is routed through the VPN, except for the apps you select. Also called inclusive mode, whitelist mode, or VPN-only mode, it gives you granular control over what’s encrypted. This setup is useful when you only need to secure specific activities rather than your entire connection.

Standard Split Tunneling (Exclusive Mode)

Standard split tunneling, also called exclusive mode, blacklist mode, or bypass mode, is the opposite of inverse tunneling. Here, all your traffic goes through the VPN by default, except for the apps you choose to exclude. It’s the most practical option for users who want maximum security with a few exceptions. 

Policy-Based Split Tunneling 

Policy-based split tunneling is typically used in business or enterprise environments. Instead of users setting rules, IT administrators define network policies that determine what traffic must go through the VPN. A company might, for example, route all traffic to corporate servers through the encrypted tunnel while allowing employees’ personal browsing to go directly to the internet. This ensures compliance and efficiency across large networks, but it isn’t something most individual VPN users will need.

Route-Based Split Tunneling

Route-based split tunneling decides where to send your traffic based on IP addresses or network routes. The VPN dynamically adjusts which connections use the tunnel depending on their destination. For example, all traffic to local network addresses like 192.168.x.x might automatically bypass the VPN, while everything else stays protected. This mode is common in advanced setups or corporate environments and provides fine-tuned control over how data flows between secure and insecure paths.

When Should You Use Split Tunneling?

Split tunneling isn’t for everyone or every situation. But when used right, it can make your VPN experience smoother, faster, and less frustrating without giving up privacy where it counts. Here are the most common scenarios where split tunneling makes sense.

1. Streaming Services & Entertainment

You’re trying to unwind with Netflix, Hulu, or BBC iPlayer, but the moment your VPN is on, your show won’t load. Streaming platforms are notorious for detecting and blocking VPN traffic. The fix is simple: exclude your streaming apps from the VPN tunnel. You’ll get your local content library and smooth playback at full speed, while the rest of your internet activity stays encrypted through your VPN.

2. Online Banking & Financial Apps

Banks and payment platforms often see VPN IPs as suspicious and block access altogether. With split tunneling, you can route your banking app or financial site outside the VPN so it sees your real IP address. Since your banking connection is already encrypted with HTTPS/TLS, excluding it from VPN doesn't compromise security. 

3. Accessing Local Network Devices

Your VPN tunnel isolates your devices from your local network, which means things like file sharing, Chromecast, and AirPlay stop working. When you exclude LAN traffic from the VPN tunnel, your internet traffic stays protected while your home devices remain reachable. 

For example, if you need to print a document but your printer isn’t visible when Windscribe is connected, simply add your printer’s IP address to Windscribe’s split tunneling exclusion list. You can also exclude entire local IP ranges like 192.168.x.x or 10.0.x.x to maintain full access to your home network.

4. Remote Work (Corporate + Personal)

When you’re working remotely, you might need a VPN to access company servers or internal tools, but you don’t want your personal browsing, social media, or streaming slowed down by corporate encryption. With split tunneling, you can route your work apps through the VPN while letting personal sites use your normal internet. Some users even run two VPNs at once – one for work and one for personal use – though that setup is more complex and rarely necessary.

5. Traveling Abroad

Traveling adds a unique challenge: you want access to your home country’s news sites, banking apps, or streaming libraries, but also need local apps like maps, ride shares, or food delivery to work correctly. With split tunneling, you can route your home content and banking through the VPN tunnel (set to your home region) while letting location-based services connect directly using your current IP. 

6. Large Downloads & Torrenting

Big downloads can drag when everything runs through a VPN. With split tunneling, you can keep sensitive or private downloads – like torrents – routed through the VPN for privacy, while sending regular downloads through your standard connection. That means faster speeds where security doesn’t matter, and full privacy where it does. Just make sure any P2P or torrent activity follows local laws and copyright regulations.

The Benefits of Using Split Tunneling

Split tunneling gives you the best of both worlds: security via the VPN tunnel and speed via regular traffic. Here are the main benefits of using VPN split tunneling. 

1. Faster internet speeds: Only VPN-protected traffic experiences a slowdown, while your regular traffic runs at full speed.

2. Better bandwidth management: Split tunneling reduces strain on VPN servers and helps save mobile data or bandwidth on data-capped connections.

3. Access services that block VPNs: You can bypass VPN blocks from banks, streaming services, and websites, providing a seamless experience.

4. Maintain local network access: Keep LAN devices like printers, NAS drives, and smart home devices accessible while using a VPN for online traffic.

5. Flexibility & convenience: Split tunneling gives you custom security for specific needs, automating the process after a one-time setup.

6. Improved application performance: Latency-sensitive apps like video calls and gaming perform better by bypassing the VPN for faster connections.

Is Split Tunneling Safe?

Split tunneling is safe when used correctly with a trusted VPN provider like Windscribe. However, it’s less secure than routing all traffic through your VPN because some of your data will be unprotected. The tradeoff is that you’re deciding which apps or services get the extra layer of security.

What's at Risk?

When you exclude apps or websites from the VPN tunnel, the traffic to those sites or apps is unprotected. Without encryption, your ISP can see the traffic, and websites can detect your real IP address. This makes your data more vulnerable to man-in-the-middle attacks. For example, if you exclude Netflix from your VPN, your ISP can see you’re streaming Netflix and possibly even track what you’re watching.

Specific Security Risks

There are specific security risks you need to be aware of when using VPN split tunneling. Since part of your data won’t be passing through the encrypted VPN tunnel, it’ll remain exposed. 

1. ISP Monitoring

When you exclude traffic from the VPN, your Internet Service Provider can see it. This means they could track your browsing habits and potentially sell that information to advertisers. The best way to mitigate this is to only exclude non-sensitive traffic, like video streaming, where privacy is less of a concern.

2. Reduced Anonymity

By excluding certain apps, your real IP becomes visible, and websites can track your activity based on it. Your location may also be exposed. To mitigate this risk, don’t exclude apps that need your anonymity, such as banking or messaging apps.

3. Risk of Misconfiguration

It’s easy to accidentally exclude sensitive apps or not realize what’s protected versus unprotected. A misconfiguration could lead to privacy leaks. Always test your configuration to make sure only the apps you want excluded are outside the VPN.

Enterprise/Corporate Risks

For business VPN users, split tunneling can pose more significant risks. It allows employees to bypass corporate security policies, which may lead to data exfiltration risks. Sensitive company data might be exposed or leaked if traffic is routed outside the secure VPN tunnel. Additionally, compliance violations can occur if split tunneling circumvents company-mandated security standards.

When NOT to Use Split Tunneling

Avoid using split tunneling if:

• You're on public/untrusted Wi-Fi (route everything through VPN)

• You're handling highly sensitive data

• You're in a high-risk environment

• You're trying to maximize anonymity

• You're required to comply with strict security policies

• You don't fully understand which apps need protection

Use split tunneling when:

• You're on a trusted network (home, office)

• You understand your threat model

• You're balancing specific needs (speed vs. security)

• You're excluding only low-risk traffic

How to Use Split Tunneling Safely

1. Only exclude trusted apps to reduce the risk of exposure.

2. Keep sensitive data like banking, email, and passwords routed through the VPN.

3. Ensure excluded traffic uses HTTPS with SSL/TLS encryption.

4. Minimize exclusions for better overall security.

5. Review your split tunneling rules regularly to stay secure.

6. Avoid public Wi-Fi or route all traffic through the VPN on untrusted networks.

7. Test your setup to ensure everything is routed as intended.

8. Use a strong VPN with robust security features for maximum protection.

Split Tunneling vs. Full Tunnel VPN: What's the Difference?

The key difference between split tunneling and a full tunnel VPN comes down to how traffic is routed. A full tunnel VPN routes all your internet traffic through the VPN, providing maximum security and privacy at the cost of speed and compatibility. A split tunnel VPN, on the other hand, routes only part of your traffic through the VPN, balancing privacy and performance for a more customized experience. 

Full Tunnel VPN:

• All traffic is routed through the VPN

• Provides 100% encryption for maximum privacy and security

• Slower speeds due to encryption overhead

• Some services (like streaming or local networks) may not work properly

• Simple setup: everything is protected

Split Tunnel VPN:

• Only part of the traffic goes through the VPN

• Provides partial encryption for privacy and performance balance

• Faster speeds for apps or services excluded from the VPN

• Better compatibility with services that block VPNs

• More complex: requires you to manage what is protected and what isn’t

Full Tunnel VPN vs. Split Tunneling VPN: Which Should You Use?

Deciding whether you need to use a full tunnel or split tunneling depends on your specific needs at the moment. You can also switch between them. With Windscribe, you can easily toggle split tunneling on/off and switch between Inclusive and Exclusive modes.

Choose full tunnel VPN when:

• You're on a public or unsecured network

• You're handling sensitive information

• You need maximum anonymity

• You don’t want to manage settings

• Security is more important than convenience

Choose split tunneling VPN when:

• You're on trusted networks (home, office)

• You need specific apps to run faster

• Some services block VPNs

• You want to access local devices

• Convenience is a priority

How to enable Split Tunneling

Android

1. Open the Windscribe app and tap the Menu button in the top-left corner
   
   
2. Go to the Connection sub-menu
   
   
3. Select the Split Tunneling option
   
   
4. Toggle the switch to enable Split Tunneling on the device
   
   
5. Choose which mode of split tunneling you'll use: Exclusive or Inclusive
   
   
6. Scroll through the list of apps or use the search bar to find the application you want to use
   
   
7. Finally, return to the main application screen, disconnect from the VPN and reconnect.
   You will see a small icon below the connect button when Split Tunneling is enabled.
   
   

 

---

Windows
Keep in mind that Split Tunneling will only work with traditional software that runs from an executable (.exe) file.
Windows Apps downloaded from the Microsoft Store such as Mail function differently and will not work with Split Tunneling.

Navigating to Split Tunneling feature

1. Open the Windscribe app and tap the Menu button in the top-left corner
   
   
   
   
   
2. Go to the Connection sub-menu
   
   
   
   
   
3. Select the Split Tunneling option
   
   
   
   
   
4. Toggle the switch to enable Split Tunneling on the device
   
   
   
   
   
5. Choose which mode of split tunneling you'll use: Exclusive or Inclusive
   
   
   
   

Adding Applications
There are two ways to select applications for the desktop client's Split Tunneling feature:

• Search function/Recently opened - this is the easier method as it requires fewer steps but is not as extensive
  1. Press on the Apps option to open the list of applications added to the Split Tunneling list
     
     
  2. Click the search icon to open a short list of the recently opened applications.
     Note that this will search only the most recent application list, not all applications on the computer.
     
     
     
     
     Selecting the applications here will add them to the Split Tunnel list. Selected apps will be indicated with a green checkmark.
     
     
     
     
     You can also search for the applications in this list for quicker access.
     
     If you can't find the app you want to add to the list here, continue to the second method below.
     
  3. Once you've selected the applications you want to add to the Split Tunnel list, press the back button in the top-left or the X to the right of the search bar.
     
     
     
     
     You will then see all the apps affected by Split Tunneling
     
     
• Directory path to application file - allows for exact selection of executable application files.
  1. Press on the Apps option to open the list of applications added to the Split Tunneling list
     
     
  2. Click on the plus (+) icon to add an application
     
     
  3. Navigate to the location of the .exe file for the application. Let's use Google Chrome as an example.
     Just about all applications will be stored in either C:\Program Files (x86)\ or C:\Program Files\
     In the explorer window that pops up, enter one of these in the address bar at the top and press Enter.
     
     
     
     
     
  4. Continue navigating through the folders until you reach the .exe file you wish to add to the Split Tunneling list.
     If you aren't sure where to find the file, try a Google search for something like "where is the chrome exe file located in windows 10".
     In our example for Chrome, the application file is called chrome.exe and is located in C:\Program Files (x86)\Google\Chrome\Application\
     Select the .exe file and press Open in the bottom right to add the application to the list.
     
     
  5. You will now see the application added to the main Split Tunneling list
     
     

Adding IPs and Hostnames
The Split Tunneling feature in the desktop app also supports including/excluding specific IPs and hostnames (website) through simple rules.

1. In the Split Tunneling Menu, select the IPs & Hostnames option
   
   
2. Here you can enter either a hostname or an IP address to add to the Split Tunneling list.
   Once you've typed it in, press the plus (+) icon to the right to add it to the list of rules below.
   
   
   
   OR
   
   
   
   
   

After you've added the applications, IPs and/or hostnames, return to the main application screen, disconnect from the VPN and reconnect.
You will see a small icon below the connect button when Split Tunneling is enabled.

Troubleshooting: When Split Tunneling Doesn't Work

Split tunneling is usually straightforward to use, but occasionally you might run into issues. Here are the most common problems and how to fix them.

Problem 1: App Still Using VPN (When It Shouldn't)

An excluded app still shows your VPN’s IP address, even though it should be bypassing the VPN. It may be because:

• You didn’t disconnect and reconnect after making changes.

• You selected the wrong .exe file (Windows).

• The app uses multiple processes, causing split tunneling to miss some of them.

• A WebRTC leak (for browsers) is sending traffic through the VPN.

Try these steps to troubleshoot:

1. Disconnect and reconnect to Windscribe.

2. Restart the application to refresh its connection.

3. Restart your device to ensure settings are fully applied.

4. Double-check that you selected the correct executable file, especially on Windows.

5. For browsers, disable WebRTC or use the Windscribe browser extension to handle the traffic routing.

Problem 2: App Not Working at All

The app won’t connect or crashes when split tunneling is enabled. It may be because:

• The app requires a VPN, but is excluded.

• A firewall conflict is preventing proper routing.

• A network adapter issue is causing connection problems.

Try these steps to troubleshoot:

1. Remove the app from split tunneling exclusions to ensure it’s always protected by the VPN.

2. Check your firewall and antivirus settings for conflicts.

3. Disable and re-enable split tunneling to reset your setup.

4. If the issue persists, contact Windscribe support for further assistance.

Problem 3: Can't Find App in List (Windows)

The app you’re looking for doesn't appear in the recently opened list on Windows. In this case, use the manual method to browse .exe files we shared above. 

Problem 4: Local Network Still Unreachable

You can’t access local devices (e.g., printer, NAS) even when split tunneling is enabled.

Try these steps to troubleshoot:

1. Add specific local IP addresses to split tunneling.

2. Add the entire local subnet.

3. Check if your device is on the same network as your local devices.

4. Temporarily disable Windscribe’s Firewall to test if it's blocking local traffic.

Problem 5: Kill Switch Conflicts

Your internet drops when using split tunneling. It may be because Windscribe’s Firewall (our version of a kill switch) is in conflict with split tunneling, causing your internet to disconnect when a VPN drop occurs. In this case, check the Firewall settings to make sure it’s configured properly. Also, understand that this is expected behavior for security purposes and exactly how a kill switch works. 

Problem 6: Banking App Still Blocks Connection

The bank detects the VPN even though the app is excluded. It may be because the DNS is still routed through VPN, or your bank is detecting VPN on a different device/session. 

Try these steps to troubleshoot: 

1. Clear the app cache to remove any old session data.

2. Reboot your device after configuring split tunneling to ensure all settings take effect.

3. Exclude the bank’s hostnames in addition to the app itself.

4. If the issue persists, contact the bank, as some aggressively block VPNs.

Frequently Asked Questions About Split Tunneling

Q: Does split tunneling slow down my VPN?

No, split tunneling actually improves your overall internet speed because excluded apps bypass the VPN entirely and run at your full ISP speed. Only apps routed through the VPN experience the normal 10-30% speed reduction from encryption. Split tunneling gives you the best of both worlds: security where you need it, speed where you don't.

Q: Can I use split tunneling and kill switch together?

Yes, you can use both features simultaneously with Windscribe. However, understand that if your VPN connection drops, the kill switch will block internet access for apps routed through the VPN, while excluded apps may continue to work (using your unprotected connection). This is expected behavior for security.

Q: Which is better: Inclusive or Exclusive mode?

For most users, Exclusive Mode (protect everything by default, exclude specific apps) is safer because it ensures maximum protection unless you specifically choose otherwise. Use Inclusive Mode (only protect selected apps) only when you have a clear need to protect just a few specific applications while keeping everything else fast.

Q: Will my ISP know I'm using split tunneling?

Your ISP can see that you're connected to a VPN, but they can also see the traffic from apps you've excluded from the VPN tunnel. This is the inherent tradeoff of split tunneling. Excluded traffic is visible to your ISP just as it would be without a VPN. Only route non-sensitive data outside the VPN if this concerns you.

Q: Can I use split tunneling on my iPhone or iPad?

Unfortunately no. Apple's iOS and iPadOS do not allow VPN apps to implement split tunneling due to strict system limitations and security policies. This is an Apple restriction that affects all VPN providers, not just Windscribe. Your options are to use a full VPN or no VPN on iOS devices.

Q: Why does my banking app still detect my VPN with split tunneling?

If you've excluded the banking app, but it still detects the VPN, the issue might be DNS routing or a previous session. Try clearing the app's cache, restarting your device, or also excluding your bank's website hostname (not just the app). Some banks are extremely aggressive at detecting VPNs and may still flag you even with split tunneling.

Q: Does split tunneling work with all VPN protocols?

Split tunneling generally works with all VPN protocols Windscribe offers (IKEv2, OpenVPN, WireGuard). However, the exact implementation may vary slightly by protocol. If you experience issues, try switching protocols in Windscribe's settings to see if that resolves the problem.

Q: What apps should I exclude from my VPN?

Common apps to safely exclude include: streaming services (Netflix, Spotify, YouTube), online gaming clients, video conferencing apps (Zoom, Teams), local network apps, and apps that block VPN access, like some banking apps. Never exclude: password managers, email clients, messaging apps, financial transaction apps, or anything involving sensitive personal data.

Q: Is split tunneling legal?

Yes, split tunneling is completely legal in countries where VPNs are legal. It's simply a configuration option for how your VPN routes traffic. However, using split tunneling to bypass geographic restrictions or access content that violates copyright laws may have legal implications depending on your location and the content in question.

Q: How do I know if split tunneling is actually working?

Test it by visiting an IP address checker (like our What Is My IP tool) from both an excluded app and a protected app. The excluded app should show your real IP address, while the protected app should show your VPN server's IP address. If both show the same IP, something's misconfigured.

Q: Can split tunneling prevent WebRTC leaks?

Split tunneling doesn't directly prevent WebRTC leaks, but you can use it strategically by routing browsers through the VPN while excluding other apps. For complete WebRTC leak protection, disable WebRTC in your browser settings or use Windscribe's browser extension, which includes WebRTC leak protection.

Q: Does split tunneling affect battery life on mobile?

Split tunneling can actually improve battery life on mobile devices because excluded apps don't require VPN encryption/decryption processing. The difference is usually minor (5-10%), but it can add up if you're excluding multiple data-heavy apps like streaming or gaming.

Master Split Tunneling for the Perfect Balance

Split tunneling is like having the best of both worlds: the ability to protect your sensitive data while keeping your internet fast and free. It lets you decide which apps use your VPN for security and which ones run at full speed without the encryption, solving common complaints about VPNs like laggy streaming or gaming. 

Windscribe offers a Split Tunneling feature on Windows, macOS, and Android, giving you the power to choose between Exclusive Mode for maximum protection or Inclusive Mode for specific exclusions. Just remember to test your setup regularly to ensure everything’s working smoothly, so you can enjoy seamless speed and top-notch security at the same time.

Get Windscribe today and protect what matters most.