VPN split tunneling explained: route some apps through the VPN, not all

Most of the time, you want your VPN protecting everything. But not always. Sometimes one app works better on your normal connection, or a device on your home network becomes unreachable the moment the VPN turns on. Split tunneling lets you draw the line yourself — deciding, app by app, what goes through the tunnel and what doesn’t. Here’s how it works and when to reach for it.

What split tunneling actually is

By default, a VPN runs in full-tunnel mode: every packet your device sends — browser, apps, background updates, all of it — travels through the encrypted VPN tunnel. That’s the safest setup, because nothing escapes unprotected.

Split tunneling changes that. It lets you split your traffic into two lanes:

• Through the tunnel — encrypted, with your IP masked by the VPN.
• Direct — over your normal internet connection, at full local speed, with no VPN protection.

You choose which apps or destinations go in each lane.

The analogy: an express lane

Think of your internet traffic as cars leaving a city. A full-tunnel VPN sends every car through one secure, private checkpoint before it hits the highway — safe, but everything queues through the same gate.

Split tunneling adds an express on-ramp. You decide that certain trusted vehicles — your banking app, your local printer, a latency-sensitive game — can skip the checkpoint and take the direct route, while everything privacy-sensitive still goes through the secure gate. You get speed where you want it and protection where you need it.

When split tunneling is genuinely useful

A few common cases where it earns its keep:

• Reaching local devices. With a full tunnel, your printer, smart TV, or network storage (NAS) can become invisible, because your device tries to reach them through the remote VPN server. Excluding local-network traffic keeps them reachable while your internet stays protected.
• Banking and region-locked apps. Some banking or payment apps flag logins coming from a VPN server’s IP as suspicious. Routing just those apps direct avoids the friction — while everything else stays behind the VPN.
• Speed-sensitive traffic. Online gaming, video calls, or large downloads from a trusted source can benefit from skipping the small overhead a tunnel adds. Keep them direct; keep your browsing private.
• Using two “locations” at once. Browse as if you’re abroad (through the VPN) while a local service that needs your real region keeps working (direct).

Standard vs inverse split tunneling

There are two ways to set it up, and the difference matters:

• Standard (exclude list). Everything goes through the VPN except the apps you exclude. Safest default — you have to opt traffic out of protection.
• Inverse (allow list). Everything uses your normal connection except the apps you send through the VPN. Useful when you only need one or two apps protected, but riskier, because anything you forget to add is unprotected by default.

If privacy is your priority, standard mode is the safer choice: protection is the default, and you make deliberate exceptions. Inverse mode inverts that safety margin — a newly installed app, or one you simply forgot to add, sends its traffic straight over your normal connection with no VPN protection and no warning. That’s fine if you’re deliberately protecting only a single browser, but it puts the burden on you to remember every app that should be covered.

The trade-off you must understand

Split tunneling is a control feature, not a free upgrade. The core rule: anything routed outside the tunnel gets none of the VPN’s protection. That traffic uses your real IP, your ISP can see it, and its DNS lookups may fall back to your ISP’s resolver.

That’s perfectly fine for a local printer. It’s not fine if you accidentally exclude your web browser and then visit privacy-sensitive sites. The feature is only as safe as your configuration, so exclude deliberately and review your list.

How it works with the kill switch

There’s an important interaction here. A kill switch blocks traffic if the VPN drops — but if you’re split tunneling, it should still protect the apps you’ve kept inside the tunnel while leaving your excluded apps alone. Veilock’s kill switch is designed to respect your split-tunnel rules: your protected apps lock down on a drop, while your intentionally-excluded traffic keeps behaving as you configured it.

How Veilock handles split tunneling

Veilock offers app-based split tunneling with both modes:

• Exclude specific apps from the tunnel (standard mode) so, for example, your banking app or local media server connects directly while the rest of your device stays encrypted.
• Or route only chosen apps through the VPN (inverse mode) when you want a light-touch setup.
• Local network access can be preserved so your printer, TV and NAS stay reachable without dropping the tunnel for everything else.

Everything that does stay inside the tunnel gets Veilock’s full stack: AES-256-GCM encryption, forced DNS-over-HTTPS resolution, and a strict no-logs policy. To see the whole feature set in context, visit the Veilock VPN overview.

The bottom line

Split tunneling trades a little of the VPN’s all-or-nothing simplicity for real control: privacy where you want it, full local speed and compatibility where you don’t. It’s the answer to “why can’t I reach my printer?” and “why does my bank flag my login?” — but it comes with a rule you can’t ignore: excluded traffic isn’t protected. Use it deliberately, keep sensitive apps inside the tunnel, and pair it with a solid kill switch. Configured with care, it’s one of the most useful controls a VPN can give you.