How VPN Split Tunneling Works
Choose app, website, or IP exclusions deliberately, and check how they interact with the kill switch on your platform.
Split tunneling changes which traffic uses the VPN. It can help a local service or a particular app use the ordinary connection, but an exclusion also changes the protection you receive.
Identify the kind of exclusion
An app exclusion is different from a website or IP-address rule. Some apps offer an include-only mode that routes selected traffic into the VPN; others offer an exclude mode that sends selected traffic outside it.
Check the operating system and version. For example, Surfshark’s iOS bypass options should not be assumed to match its Windows per-app controls.
Start with one defined need
Choose the exact app or destination that needs a different route. A domain can use multiple services or addresses, so a narrow-looking rule may not cover everything a page loads. Avoid adding large ranges just to make an unexplained error disappear.
Check blocking interactions
A persistent kill switch can override an exclusion or behave differently across platforms. Read the current provider instructions for using both features together. Do not assume “excluded” means “can always connect outside the VPN.”
Test both routes
Restart an affected app if the provider requires it. Check a normal included task and the intentionally excluded task, then repeat after reconnection. Use non-sensitive activity while learning the behavior.
Review exclusions after updates and remove ones you no longer need. If the entire browser is excluded, traffic in that browser is outside the intended VPN route even when the VPN app reports connected.