Want your browser to use a VPN while games or video calls keep their normal connection? A split tunneling VPN setup separates traffic: some goes through the encrypted tunnel, while the rest connects directly. Depending on your software, you can choose applications, IP ranges or domain rules.
For a closer look at the configuration, try this guide to VPN split tunneling. It covers WireGuard split tunneling with AllowedIPs and routing modes in v2rayN, useful starting points when a simple app switch is not enough.
1. Start with your VPN app’s settings
Look for “Split tunneling”, “Selected apps” or “Bypass VPN”. Check which way the setting works: an inclusion list sends only chosen apps through the VPN; an exclusion list sends everything through it except the apps you select.
For a VPN for specific apps only, choose inclusion mode if available. Select your browser, reconnect and test. This normally covers the whole browser, rather than individual websites.
2. On Android, check the app list
Split tunneling on Android depends on what your VPN app supports. Choose the apps that need the tunnel and leave others on the direct connection. Reconnect after changing the list.
If excluded apps lose connectivity, check Android’s “Block connections without VPN” setting: it can prevent them from connecting directly. Decide whether allowing that direct access fits your needs before changing it.
3. Use WireGuard AllowedIPs for destinations
WireGuard’s AllowedIPs identifies destination IP ranges associated with a peer. Common clients also use these entries to create routes. For a narrow split, specify the required network ranges instead of default routes such as 0.0.0.0/0 and ::/0, which cover all IPv4 and IPv6 destinations respectively.
AllowedIPs does not select applications or accept website names. A website can use several changing IP addresses, so maintaining website access this way may be awkward.
4. In an Xray client, check rules and traffic capture
In v2rayN, routing rules can direct matching domains or IP ranges to a proxy or a direct connection. Check the selected routing profile and what happens to unmatched traffic.
Rules only affect traffic that reaches the client. System proxy settings may be ignored by some apps; TUN mode can capture traffic more broadly where supported.
Finally, compare the public IP shown in a routed browser with one intended to connect directly. Also check DNS handling: an IP check alone does not confirm how name lookups travel.
Split Tunneling VPN: Choose Which Apps Use Your VPN
Want your browser to use a VPN while games or video calls keep their normal connection? A split tunneling VPN setup separates traffic: some goes through the encrypted tunnel, while the rest connects directly. Depending on your software, you can choose applications, IP ranges or domain rules.
For a closer look at the configuration, try this guide to VPN split tunneling. It covers WireGuard split tunneling with AllowedIPs and routing modes in v2rayN, useful starting points when a simple app switch is not enough.
1. Start with your VPN app’s settings
Look for “Split tunneling”, “Selected apps” or “Bypass VPN”. Check which way the setting works: an inclusion list sends only chosen apps through the VPN; an exclusion list sends everything through it except the apps you select.
For a VPN for specific apps only, choose inclusion mode if available. Select your browser, reconnect and test. This normally covers the whole browser, rather than individual websites.
2. On Android, check the app list
Split tunneling on Android depends on what your VPN app supports. Choose the apps that need the tunnel and leave others on the direct connection. Reconnect after changing the list.
If excluded apps lose connectivity, check Android’s “Block connections without VPN” setting: it can prevent them from connecting directly. Decide whether allowing that direct access fits your needs before changing it.
3. Use WireGuard AllowedIPs for destinations
WireGuard’s AllowedIPs identifies destination IP ranges associated with a peer. Common clients also use these entries to create routes. For a narrow split, specify the required network ranges instead of default routes such as 0.0.0.0/0 and ::/0, which cover all IPv4 and IPv6 destinations respectively.
AllowedIPs does not select applications or accept website names. A website can use several changing IP addresses, so maintaining website access this way may be awkward.
4. In an Xray client, check rules and traffic capture
In v2rayN, routing rules can direct matching domains or IP ranges to a proxy or a direct connection. Check the selected routing profile and what happens to unmatched traffic.
Rules only affect traffic that reaches the client. System proxy settings may be ignored by some apps; TUN mode can capture traffic more broadly where supported.
Finally, compare the public IP shown in a routed browser with one intended to connect directly. Also check DNS handling: an IP check alone does not confirm how name lookups travel.