Split tunneling sends selected traffic through a VPN while other traffic connects directly. To set it up, use the controls available in your VPN client and operating system: NordVPN documents app-based rules for Windows 10 and 11 and Android, but its Linux Allowlist targets ports and subnets instead. Traffic that bypasses the VPN does not use that tunnel’s protection.
What split tunneling changes
A VPN normally sends traffic through an encrypted tunnel to the VPN server. Split tunneling lets you choose which traffic uses that route and which takes a direct route. The rule may target apps, websites or network destinations, depending on the client and setup.
That choice has a practical consequence: an app excluded from the tunnel connects without that VPN tunnel’s protection. Check the rule’s mode before adding anything. An include rule sends selected apps through the VPN; an exclude rule sends selected apps directly.
Set up NordVPN’s rules by platform
NordVPN’s setup steps vary by operating system. Its support guide to split tunneling covers these client-specific controls.
| Platform | Rule target | What the setting does |
| Windows 10 and 11 | Apps | Lists currently open apps to add, with Browse apps as another way to find an installed app. |
| Android | Apps | Lets you select apps that should not be affected by the VPN. |
| Linux | Ports, port ranges or subnets | Matching incoming and outgoing traffic bypasses the VPN and is not blocked by the kill switch. |
Windows 10 and 11
- Open Settings in the NordVPN app. This takes you to the client’s configuration options.
- Select Split tunneling and turn it on. This enables the traffic-selection controls.
- Add the apps you want to route. Choose an open app from the list, or use Browse apps to find an installed one.
Android
- Open Profile > Settings > VPN connection > Split tunneling in the NordVPN app.
- Enable split tunneling, then select the apps to exclude from the VPN.
These steps apply to NordVPN’s documented Android controls. The selected apps connect outside the VPN tunnel.
Linux
NordVPN’s Linux Allowlist does not select individual apps. Add a port, port range or subnet instead. Matching traffic in both directions bypasses the VPN, and the kill switch does not block it. That makes Linux’s rule a different kind of control from the app lists in NordVPN’s Windows and Android instructions.
If an excluded app still has connection problems
NordVPN describes a possible DNS/IP mismatch: an excluded app may see your internet provider’s IP address while its DNS requests still go to NordVPN’s DNS servers. That mismatch can interfere with some services’ location checks.
NordVPN lists restarting or reinstalling the app, restarting the device, disabling other VPN services and resetting network settings as troubleshooting options. A network reset removes saved Wi-Fi networks and passwords, VPN settings and APN settings, so try the less disruptive steps first. Its troubleshooting guide describes the reset and other options.
When routing belongs to an administrator
Consumer app rules select traffic by app. Enterprise routing can instead apply policies by group or destination. OpenVPN Access Server documents group-specific full- and split-tunnel configurations, with administrators checking group settings and client logs or routing tables.
Microsoft’s Microsoft 365 guidance describes routing selected Optimize endpoint IP prefixes directly rather than through a forced VPN tunnel. Microsoft estimates that those endpoints account for about 70–80% of Microsoft 365 service traffic volume. That figure concerns Microsoft 365 traffic, not all network traffic.
For a home network, OpenWrt’s Policy Based Routing (PBR) offers a router-level approach for assigning traffic to a VPN or the regular internet connection. It requires configuring policies in the router, rather than adding an app to a VPN client.
