Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Choose a VPN with split tunneling by deciding first what you need to route selectively—apps, IP addresses or subnets, hostnames, or websites—and then confirming that the provider supports that rule on your exact device and app. A VPN’s general claim that it “has split tunneling” does not tell you which controls are available on Windows, macOS, Android, iOS, or Linux, or whether DNS, protocol, and kill-switch behavior will match your expectations.
Before subscribing or changing your setup, check the provider’s current documentation for your operating system, client version, and intended rule type. The examples below describe features documented by individual providers; they are not universal platform rules or independent performance tests.
As an Amazon Associate I earn from qualifying purchases.
What does split tunneling let you choose?
Split tunneling lets you send selected traffic through a VPN while other traffic uses your ordinary internet connection. The practical result depends on how the VPN app defines a selection: it might be an application, an IP address or subnet, or a hostname or website. A rule can either send the selected traffic through the tunnel or make it bypass the tunnel.
That distinction matters because the same word can describe different controls. If your goal is to route one application differently from the rest, you need app-based rules. If you want connections to a destination handled the same way across several applications, a destination-based rule may fit better. A provider may offer one type on one platform and a different type on another.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
App-based rules
An app rule applies to traffic from an application you select. Depending on the VPN’s implementation, you may be able to include selected apps in the VPN or exclude them so they use the regular connection. This is useful when your decision is about the application itself, rather than a particular server it connects to.
Check what the app calls each mode. “Include” can mean only selected apps use the tunnel; “exclude” can mean selected apps bypass it. Some interfaces describe the same choices as inverse or bypass tunneling. Confirm the direction in the provider’s documentation rather than relying on a label alone.
Free tools Windows power users keep installed
One-click scans. No signup required.
IP, subnet, hostname, and website rules
Destination-based rules match where a connection is going rather than which application initiated it. An IP address or subnet rule can cover traffic to that destination from multiple apps. Hostname or domain rules work at the name level, while a website or URL rule may be narrower—but providers do not necessarily offer all of these controls.
Do not assume that a hostname rule and a full URL rule are interchangeable. The IVPN FAQ, for example, says it does not offer URL-based split tunneling. Windscribe documents app rules as well as IP and hostname rules, with inclusive and exclusive modes. Confirm exactly what the provider matches before choosing it for a website-specific use case.
How should I decide which rule type I need?
Start with the thing you want to route, not the provider’s feature name. The right rule type follows from whether your need is about a program, a network destination, or a website—and whether you want that traffic inside or outside the tunnel.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
- Choose app-based rules if the same application should consistently use or bypass the VPN, regardless of which destination it contacts.
- Choose IP or subnet rules if the destination is known by its network address and traffic from multiple applications should follow the same route.
- Choose hostname rules if you need to match a destination by its name and the provider supports that rule on your platform.
- Look for URL or website rules only if you specifically need them. Do not infer that a provider offers URL-level matching just because it supports split tunneling or hostnames.
Next, decide the direction. An inclusive setup routes the selected item through the VPN; an exclusive setup routes it outside the VPN. Provider terminology varies, so verify the effect of the setting before relying on it. If you need both kinds of routing, check whether the app supports both modes on your exact operating system.
Recommended Free Tools
Which compatibility details should I check before choosing?
Verify the feature for the device and VPN client you will actually use. Compatibility can vary by operating system, device type, client distribution, protocol, and even the kind of split-tunneling rule; a feature listed for one app is not proof that it exists in another.
1. Operating system and client
Look for a support page naming your exact operating system and, where relevant, distribution or device type. Then check whether the instructions apply to the VPN’s desktop, mobile, TV, or Linux client you intend to install. For Linux in particular, a provider may limit a graphical feature to named official distributions. Proton’s documentation describes such limits for its Linux GUI feature, so a broad “Linux support” statement is not enough to establish that split tunneling will be available on every distribution.
Also check whether the documented feature belongs to the current app version and client distribution you plan to use. If the provider maintains separate apps or installation methods, confirm that the instructions match yours instead of assuming that all clients expose the same controls.
2. Rule type and direction
Confirm whether the platform supports app selection, IP or subnet selection, hostname rules, or URL rules, and whether it supports inclusion, exclusion, or both. A provider may offer an app selector on one operating system but only destination-based routing on another. These are implementation differences, not general rules about what an operating system can do.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
3. Protocol constraints
Check whether the feature works with the VPN protocol you intend to use. Proton’s documentation says its macOS split-tunneling feature works with WireGuard and Stealth, not IKEv2. That is a Proton-specific constraint, not a general statement about those protocols or other VPN providers.
4. DNS behavior
Ask where DNS requests go when a rule sends an app or destination outside the tunnel. The route for an app’s ordinary traffic does not, by itself, tell you how DNS is handled. Windscribe says that ROBERT or its configured custom DNS service is used system-wide while connected, including for apps excluded from its VPN tunnel. ExpressVPN’s desktop support page says its DNS queries should go through ExpressVPN servers regardless of split-tunneling settings. These examples illustrate why DNS needs its own check; they should not be generalized to other providers.
5. Kill-switch compatibility
Check whether the kill switch can remain enabled alongside split tunneling on your target platform, and how the provider describes the interaction. Proton documents different kill-switch compatibility by platform. Do not assume that a kill switch will treat included and excluded traffic the same way across providers or operating systems.
How do documented provider features compare?
The following comparison summarizes specific details stated in the providers’ documentation. It is a feature comparison, not a ranking: the documentation does not establish independent performance results or prove that one provider is best overall. Confirm the current support page for your operating system and app version before relying on any feature.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →| Provider | Documented split-tunneling details | Important qualification |
|---|---|---|
| Proton VPN | Include and exclude modes on Windows and Android. Its macOS feature is described as experimental and limited to excluding apps. The Linux GUI feature is limited to listed official distributions. | On macOS, the documentation notes WebKit-related behavior and says the feature works with WireGuard and Stealth, not IKEv2. Linux instructions require restarting selected apps after connecting. Kill-switch compatibility varies by platform. |
| AmneziaVPN | Its table lists app and IP/subnet routing on Android and Windows. Its listed iOS, macOS, and Linux clients support IP-based rather than app-based split tunneling. | Its IP/subnet implementation supports IPv4, not IPv6. These are details of Amnezia’s implementation, not universal operating-system limitations. |
| Windscribe | Documents app rules and IP/hostname rules, with inclusive and exclusive modes. | ROBERT or the configured custom DNS service is used system-wide while connected, including for apps excluded from the tunnel. |
| IVPN | Its FAQ lists Windows, Linux, and Android support and describes inverse app-based tunneling on Windows and Linux. | The FAQ says URL-based split tunneling is not offered. A general feature claim should not be read as URL-level control. |
| ExpressVPN | Its desktop support page describes app-based selection on Windows, Mac, and Linux. | The page says DNS queries should go through ExpressVPN servers regardless of split-tunneling settings. Check the current page for the exact operating system and app version. |
Use the comparison to identify what to verify, not to assume that a feature listed for one provider’s platform transfers to another. For example, Amnezia’s listed IP-only support on certain clients does not show that iOS, macOS, or Linux universally lack app-based split tunneling. It describes those Amnezia clients.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How can I verify a VPN’s split tunneling before relying on it?
Use a short compatibility check before making the feature part of your everyday setup. The goal is to confirm the documented capability and the actual routing behavior you need, without treating a provider’s broad feature label as proof.
- Write down your exact setup. Record the operating system, device type, VPN client or distribution, and the protocol you plan to use. Include the specific application or destination you want to route.
- Define the rule and its direction. Decide whether you need an app, IP address or subnet, hostname, or URL rule, then state whether that traffic should enter or bypass the VPN.
- Find the provider’s platform-specific instructions. Check the provider’s current support page for the operating system and client you recorded. Verify that it explicitly covers your rule type and direction.
- Check protocol, DNS, and kill-switch notes separately. Look for compatibility limits, named app exceptions, DNS handling, and whether the kill switch can remain enabled with the selected mode.
- Follow the provider’s setup instructions and verify the result. Use its exact app settings and any required restart or reconnection steps. Test the intended app or destination with the VPN connected, then check that traffic meant to bypass the tunnel behaves as expected.
- Recheck after changing a key part of the setup. A change of operating system, client, protocol, or rule type can invalidate an earlier compatibility check. Consult the matching provider documentation again rather than carrying over assumptions.
For Proton’s Linux instructions, selected applications need to be restarted after the VPN connects. That detail can matter when the selection appears configured but the app has not yet followed the new routing state. Other providers may have different setup or refresh behavior; use their own instructions.
What are the common selection mistakes?
Most avoidable problems come from assuming that one split-tunneling implementation behaves like another. Check the specific rule and platform instead of relying on a feature name or a general compatibility claim.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Choosing a VPN based only on “supports split tunneling.” That phrase does not say whether the provider offers app, IP, subnet, hostname, or URL rules on your device.
- Confusing include and exclude modes. Verify whether selected traffic is supposed to use the VPN or bypass it; terminology can differ between apps.
- Assuming support carries across operating systems. Provider features may differ across desktop, mobile, Linux distributions, and other clients.
- Assuming an app rule is a website rule. Selecting a browser as an app does not establish that the VPN can route only one site or URL differently. Check for a specific destination-based control.
- Ignoring DNS. DNS may follow provider-specific behavior rather than the traffic route you inferred from the app rule. Read the provider’s DNS explanation.
- Overlooking protocol or kill-switch constraints. A feature that works with one protocol or platform configuration may not work with another.
- Treating a provider example as an industry-wide rule. The documented IPv4 limitation in Amnezia’s implementation, for example, should not be taken as evidence that all VPN split tunneling excludes IPv6.
What evidence can a provider comparison actually establish?
Official feature documentation is useful for checking what a provider says its app supports on named platforms. It can establish stated rule types, documented limitations, and instructions. It does not, by itself, establish comparative speed, privacy outcomes, reliability, or which service is best for every reader.
The provider documentation reviewed for this topic does not give a relevant, named statistic about split-tunneling use, performance, or compatibility. No performance percentage or universal compatibility rate can be inferred from it. Treat feature claims as product-specific, and verify the support page for your actual device and client before depending on them.
Frequently Asked Questions
Does split tunneling make a VPN faster?
It can change which traffic uses the VPN, but the documentation cited here does not establish a speed improvement or quantify one. Results would depend on the traffic and setup, so choose split tunneling for the routing control you need rather than an assumed performance gain.
Can split tunneling route one browser tab outside the VPN?
An app-based rule applies to the selected application, not a single tab. A destination-based rule may let a VPN handle a hostname or other destination differently, but whether it can target a particular URL depends on the provider’s implementation.
Why does a selected app still seem to use its old route after I connect?
Some implementations require an app to be restarted before its traffic follows the new VPN routing rule. Proton’s Linux split-tunneling instructions specifically require restarting selected apps after connecting; check the relevant provider’s instructions for other clients.
Does split tunneling always send DNS requests through the same route as app traffic?
No general rule is established by the feature name alone. Providers document different DNS handling; check the specific VPN’s DNS behavior rather than inferring it from whether an app is included in or excluded from the tunnel.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
