What Is Split Tunneling and When Should You Use It

A standard VPN connection is all-or-nothing: every app on your device, every request, routes through the encrypted tunnel and comes out the other end at the VPN server. That's the whole point for most use cases, but it has a real cost — every byte of traffic, including your smart-home app checking in with a server on your own local network, gets encrypted, sent to a VPN server (possibly on another continent), and routed back. Split tunneling is the setting that lets you decide, per app or per destination, which traffic actually needs that treatment and which doesn't.

This guide covers how split tunneling actually works under the hood, the specific situations it's built for, and the one trade-off worth understanding clearly before you turn it on.

How it actually works

Under the hood, split tunneling is a routing decision made per connection: the VPN client maintains a policy — a list of apps, IP ranges, or domains — and routes anything matching that list through the encrypted tunnel's virtual network interface, while everything else goes out through your device's normal network interface exactly as if the VPN weren't running at all. Most consumer apps implement this by app: pick Netflix from a list, and only Netflix's traffic gets tunneled.^[1]

• Split-include (the common consumer version) — only the apps or addresses you specifically select go through the VPN; everything else goes direct
• Split-exclude (the inverse) — everything routes through the VPN by default, except the specific apps or addresses you carve out
• Domain or IP-based rules — some implementations let you split by destination (a specific website or IP range) rather than by app, useful for browser-based cases where app-level rules don't apply

The three situations it actually solves

1. Freeing bandwidth for the one thing you actually need the VPN for

Routing everything through a VPN means every app is competing for the same encrypted tunnel's throughput and adding the same processing overhead, even apps that have nothing to do with why you turned the VPN on. Streaming and torrenting guides on this site routinely recommend split tunneling as a speed fix for exactly this reason: if only Netflix (or your torrent client) is routed through the tunnel, background downloads, browser tabs, and other apps stop competing for that same encrypted bandwidth, and CPU load from encrypting/decrypting everything else drops too.

2. Keeping local network access working

A full-tunnel VPN routes all traffic to the VPN server first, which breaks access to devices on your own local network — a printer, a NAS, a smart-home hub — because those requests get sent out to the internet instead of staying on your LAN where the device actually is. Split tunneling (excluding your local subnet, or the specific app controlling that device) fixes this without requiring you to disconnect the VPN entirely just to print a document.

3. Reducing latency for one latency-sensitive app

The same logic that helps streaming speed helps gaming ping: if only your game client is tunneled (or, just as often, excluded from the tunnel entirely while a browser-based account portal stays protected), you avoid adding VPN overhead to traffic where it matters most, while keeping the VPN active for whatever the actual reason you wanted it on in the first place — usually IP protection in a multiplayer lobby, not blanket encryption of a game that doesn't need it.

The trade-off: split traffic is unprotected traffic

This is also, mechanically, the same category of exposure as a DNS leak: part of your traffic quietly bypassing the encrypted tunnel while the rest looks fully protected. In fact, split-tunnel VPN configurations are one of the specifically documented causes of DNS leaks — if DNS resolution isn't explicitly included in what gets tunneled, it can resolve outside the VPN even while your browsing traffic is correctly routed through it, revealing your real location through the back door.^[2]

When not to use it

If the entire reason you're using a VPN is privacy from your ISP, evading network-level censorship, or protecting every connection on a device equally, split tunneling works against that goal by design — it's meant to reduce coverage, and any excluded traffic gets none of the protection you turned the VPN on for. It's a tool for a specific, known trade-off (speed or local access, in exchange for narrower protection), not a default setting to enable everywhere.