Everyday Privacy
VPN Split Tunneling Explained
Split tunneling lets you choose which traffic goes through the VPN and which goes straight to the internet. It is handy, but it works against privacy if you set it up carelessly.
Last updated October 18, 2026 · By Harbor Privacy
What It Is
Normally a VPN sends everything through the tunnel. With split tunneling, you pick exceptions: some apps or destinations bypass the VPN, or only certain ones use it.
Good Reasons to Use It
- A banking or work app that blocks VPN addresses.
- Reaching local devices such as a printer or smart TV while connected.
- Keeping a game or video call outside the VPN for speed.
- Saving bandwidth on a capped VPN by sending only sensitive apps through it.
The Privacy Tradeoff
Anything outside the tunnel is visible to your ISP and the local network, and it shows your real IP. Keep the list of exceptions short, and never exclude apps you rely on the VPN to protect.
How to Set It Up
01
AndroidIn the WireGuard app, edit the tunnel and use Excluded applications to choose which apps bypass it.
02
Windows, Mac, and LinuxUse per-app settings in your VPN client, or edit the tunnel's AllowedIPs to route only specific addresses.
03
iPhoneiOS apps cannot exclude individual apps. Use AllowedIPs to limit which addresses go through the tunnel.
04
Test itCheck your IP in the excluded and included apps to confirm each goes where you expect.
Related guides: Why is my VPN slow, VPN kill switch, Which VPN protocol to use.
Common Questions
Is split tunneling safe?
It is safe if you keep exceptions few and understand that excluded traffic is not protected.
Does split tunneling help speed?
Yes, for the traffic outside the tunnel, since it skips the VPN detour.
What are AllowedIPs?
A WireGuard setting that lists which addresses go through the tunnel. Setting it to all addresses routes everything.
Can I split by website?
Some clients can, but the usual unit is the app or an IP range.
Does Harbor VPN support split tunneling?
Harbor's WireGuard configs work with the WireGuard app's per-app exclusion on Android and AllowedIPs editing on other platforms.
TRY HARBOR VPN
Standard WireGuard configs you control, with one key per device. See Harbor VPN.