How Split Tunneling Works On VPNs And Practical Use Cases

If you have used a modern VPN, you may have spotted an option called split tunneling. Many users ignore it, unsure what it does or whether they need it. Split tunneling lets you choose which apps or websites send traffic through the encrypted VPN tunnel, while the rest connect normally over your regular internet connection. It is a powerful feature, but it also introduces privacy tradeoffs you need to understand before turning it on.

Disclaimer: Split tunneling changes your protection scope. Traffic excluded from the VPN will bypass encryption and your VPN’s IP masking. Follow local regulations for VPN usage.

What split tunneling is

By default, when you connect a VPN, all traffic on your device goes through the VPN server. Every browser tab, game, messaging app, and download is routed inside the encrypted tunnel.

Split tunneling breaks that rule. There are two common modes:

  1. Exclude list (most common): Everything goes through the VPN, except selected apps/sites that use your normal ISP connection.
  2. Include list: Only the apps or websites you select use the VPN. All other traffic stays outside the tunnel.

The VPN client filters traffic locally on your device. It decides which packets get sent down the VPN tunnel and which go straight to your ISP.

The main benefits

  • Faster speeds for local services: Home NAS, smart devices, printers, local game servers do not get routed to a remote VPN server.
  • Reduce latency: Games or video calls that do not need VPN protection avoid the extra network hop.
  • Save VPN bandwidth: Good if your VPN provider enforces bandwidth caps.
  • Avoid location conflicts: You can stream local domestic content while using the VPN for international browsing.
  • Fix broken services: Some banking sites, work portals, and IoT platforms block VPN IPs; split tunneling lets them bypass the tunnel.

Important risks and downsides

This is the part most tutorials skip. Any traffic outside the VPN tunnel:

  • Uses your real public IP address.
  • Is visible to your ISP.
  • Is not covered by your VPN kill switch. If the VPN disconnects, the excluded traffic was never protected in the first place.

If you add a browser to the excluded list thinking “it’s just for quick searches,” every search and website visit in that browser leaks your real IP. Split tunneling is a convenience feature, not something to enable blindly.

Practical real-world use cases

1. Gaming + browsing privacy

Scenario: You want to browse the web with a VPN, but your online game gets higher ping when routed through the VPN server. Setup: Put the game executable on the exclude list. Game traffic uses your normal connection; browsers and torrent clients go through the VPN. Best for: Casual games where you only need VPN for web privacy, not for protecting the game connection itself.

2. Home media and NAS access

Scenario: You connect to a VPN, and suddenly you cannot reach your local NAS, Plex server, or network printer. Setup: Add your local IP range (192.168.1.0/24) to the bypass list. This keeps local LAN traffic off the VPN while external internet traffic stays protected.

3. Separate streaming needs

Scenario: You want to watch an overseas streaming library via VPN, but also watch your country’s domestic streaming service that blocks foreign VPN IPs. Setup: Put the overseas streaming app inside the VPN tunnel, exclude the domestic streaming app.

4. Work app isolation

Scenario: Your company portal only works on your native ISP connection, but you still want privacy for everything else. Setup: Add the work application to the exclude list. All other traffic routes through VPN.

5. Torrenting only

Scenario: You only need VPN protection for your torrent client, and you want low latency for everything else. Setup: Include-list mode: only your torrent app uses the VPN tunnel. This is one of the most popular use cases. ⚠️ Critical note: Enable app-level kill switch for the torrent client, so if the VPN drops, the torrent app loses internet access automatically.

6. Messaging and voice calls

Scenario: VoIP apps or video calls suffer jitter and delay over distant VPN servers. Setup: Exclude your calling app from the VPN tunnel. Your call uses your normal connection while other browsing stays protected.

Common mistakes to avoid

  • Accidentally adding your main browser to the bypass list, leaking all your web traffic.
  • Forgetting that split tunneling is device-specific; settings do not carry over between PC, phone, and router.
  • Using split tunneling on public Wi‑Fi: if you exclude sensitive apps, they are exposed on the untrusted network.
  • Confusing app-based split tunneling with site-based split tunneling. Many mobile VPNs only support app-level rules, not individual websites.

When you should NOT use split tunneling

Avoid split tunneling if:

  • You are on public café, airport, or hotel Wi‑Fi. You want all traffic encrypted.
  • You handle sensitive accounts, banking, private messages that you want fully protected.
  • You use the VPN primarily to hide your identity or location for high-risk privacy use cases.

Final takeaway

Split tunneling is a flexible tool for balancing speed and privacy. It is perfect when you have specific apps that break or lag behind a VPN. But it trades full protection for convenience.

The simple rule: anything on the bypass list is exposed. Only split-tunnel traffic you are comfortable sending over your regular ISP connection.