Split Tunneling (Per-App)

Per-app split tunneling allows you to decide which applications use the VPN and which bypass it. This is particularly useful on Windows and Android, where you might want your browser and messaging apps protected while leaving local services, gaming launchers, or banking apps outside the VPN for compatibility. The biggest risk is mistaken assumptions - users forget an app is excluded and then do sensitive activity outside the tunnel. To mitigate, use include-only mode for privacy-critical workflows (only a small set of apps uses the VPN), or use exclude-mode with very limited exceptions. Also remember that system services can generate traffic outside app boundaries (telemetry, DNS, updates), so leak protection and kill switch behavior must still be correct. Some VPNs also offer split tunneling by domain rather than app, which can be safer for certain use cases. In DVPN clients, split tunneling might interact with node selection and payment; ensure excluded traffic doesn’t “leak” DNS or route data outside your intended privacy posture. A good rule: if you’re using split tunneling, periodically review the app list and run leak tests for both tunneled and non-tunneled apps so you know exactly what’s protected.

Related DVPN Resources

Related resources