[TOC]
VPN split tunneling Android is one of those features that sounds intimidating right up until the moment it clicks — and once it does, you’ll wonder how you put up with full-tunnel frustrations for so long. Instead of pushing every byte through your VPN, VPN split tunneling on Android lets you pick which apps get encrypted and which ones hit the internet directly. That one capability quietly fixes a surprising number of daily headaches.
I’ve spent years configuring VPN split tunneling on Android devices — Firesticks, Android TV boxes, budget phones, and flagships alike. The questions I get aren’t usually “what is split tunneling?” — they’re “which apps do I actually exclude?” and “how do I know it’s working?” This VPN split tunneling Android guide answers both, and covers pitfalls that most tutorials skip entirely. One thing first, though: make sure your VPN came from a legitimate source. Trojanized VPN installers are a real and growing problem, and a compromised VPN app defeats the entire purpose of tunneling your traffic anywhere.
What VPN Split Tunneling Actually Does
Full tunnel vs. split tunnel — the real difference
A full tunnel VPN does exactly what the name suggests. Every network request your phone makes — your banking app, a background weather refresh, your IPTV stream — gets encrypted and routed through the VPN server. Your real IP stays hidden across the board. The tradeoff is that the VPN server becomes a bottleneck for literally everything.
VPN split tunneling Android breaks that all-or-nothing rule — and it does so cleanly. You define a subset of apps (or sometimes IP ranges, depending on the provider) that bypass the tunnel and connect directly through your ISP. Everything else stays encrypted. The result of a well-configured VPN split tunneling Android setup: your streaming apps stay protected while your local printer, banking software, or navigation app works without interference. No hacks, no workarounds — this is a deliberate, standards-supported feature built into the VPN protocol layer. Implementation quality varies by provider, but the concept is solid.
How Android handles per-app VPN routing
Android has exposed per-app VPN routing natively since Android 5.0 Lollipop via the VpnService API. When a VPN app implements split tunneling, it’s using this API to tell the OS which apps should have their traffic intercepted and which should be left alone. You’re not editing routing tables by hand — the VPN app shows you a list of installed apps and you check boxes.
Two modes show up depending on the app: include mode (only listed apps go through the VPN) and exclude mode (listed apps bypass the VPN, everything else tunnels). For most streaming-focused VPN split tunneling Android setups, exclude mode is more practical. You start with full coverage and carve out exceptions, rather than manually whitelisting hundreds of apps.
Android’s built-in Always-on VPN setting — buried under Settings → Network & internet → VPN — also has an option to “Allow apps to bypass the VPN.” That option operates independently of whatever the VPN app itself offers, and the two systems can interact in unexpected ways (more on that in the pitfalls section below).
Which Apps Should You Exclude From the VPN Split Tunneling Android Setup
This is where things get genuinely useful. Knowing the categories of apps that reliably break under a VPN — and understanding why they break — saves hours of troubleshooting. Getting your VPN split tunneling Android exclusion list right the first time means far fewer “why is my app broken?” moments later.
Apps that actively block or flag VPN connections
Some apps detect VPN usage and either refuse to work or intentionally degrade performance. This is most common with apps that have geo-licensing restrictions or fraud-prevention systems built in. Certain OTT streaming services will throw an error the moment they detect your exit IP sitting in a known VPN server range. If you use those services legitimately at home, excluding them makes sense — keeping them in the tunnel just breaks them without adding any real privacy benefit when you’re already on your home network.
Mobile payment apps — Google Pay, Samsung Pay — can also trip over VPN connections. Fraud detection logic in these apps sometimes flags VPN exit IPs as suspicious, especially when your phone’s location data and your VPN exit location are pointing at different cities.
Carrier and banking apps that break under VPN
Banking apps are the most common pain point, full stop. USAA, Chase, and several credit unions run backend systems that compare your GPS location against your IP geolocation. When those don’t match, you get locked out or dragged through extra verification steps. Excluding your banking apps is one of the smartest VPN split tunneling Android moves you can make — it eliminates the problem entirely — and your financial data stays just as secure, because banking apps use their own TLS encryption regardless of whether a VPN is active.
Carrier apps from T-Mobile, Verizon, and AT&T have similar issues, particularly when verifying your account against your phone’s SIM and network identity. Billing functions and data-usage trackers are especially prone to breaking when the carrier can’t see your real IP.
Navigation and location-dependent apps
Google Maps and Waze don’t technically break under a VPN — maps load, routes calculate fine. The issue is location accuracy. When these apps supplement GPS with network-based positioning (faster to acquire, works indoors), your IP address is part of that calculation. A VPN exit in a different city throws it off, placing you in the wrong location until GPS corrects things.
For casual use, a two-second correction is annoying but livable. For turn-by-turn navigation while driving, it can be genuinely dangerous. Exclude your navigation apps. No debate needed there.
Android Auto and other vehicle-integration apps
Android Auto causes a disproportionate amount of confusion among people setting up VPN split tunneling on Android for the first time. The app itself doesn’t load content in a way that needs a VPN, but when it does hit the network — syncing contacts, loading maps, streaming audio — it behaves like a navigation app and runs into the same location-mismatch problems. Add it to your exclude list alongside Google Maps and you’ll save yourself a frustrating troubleshooting session on the road.
How to Configure VPN Split Tunneling on Android
The exact steps differ by VPN provider, but the overall flow is nearly identical across the major apps. I’ll walk through the general process and call out where specific providers diverge.
Step-by-step: setting up split tunneling in ExpressVPN, NordVPN, and Surfshark
For ExpressVPN on Android:
- Open the ExpressVPN app and tap the hamburger menu (three lines, top left).
- Go to Settings → Split Tunneling.
- Choose between “All apps use VPN except those I select” (exclude mode) or “Only the apps I select use VPN” (include mode).
- Search for or scroll to each app you want to configure, then tap to toggle it.
- Reconnect the VPN for changes to take effect.
For NordVPN on Android, the path is Settings → Split Tunneling, and it defaults to exclude mode. You add apps to a bypass list rather than choosing a mode first. One quirk: NordVPN’s split tunneling is disabled when Threat Protection Lite is running — you’ll see a warning in the app if that’s the case.
For Surfshark on Android, the feature is called “Bypasser” (Surfshark’s branding for split tunneling). You’ll find it under Settings → VPN Settings → Bypasser. It supports both app-based and website-based bypass rules, which is more flexible than most competitors offer on mobile.
Using Android’s native “Allow bypass” setting
If your VPN provider doesn’t offer built-in split tunneling — or if you’re using a self-hosted WireGuard setup — Android’s native bypass option is your fallback. Go to Settings → Network & internet → VPN, tap the gear icon next to your VPN profile, and enable “Allow apps to bypass the VPN.” This is a broad permission, not per-app, so it’s less precise than what VPN apps offer. Use it only if you have no other option.
VPN Split Tunneling Android: Common Pitfalls and How to Avoid Them
Most guides stop at configuration and call it done. The real problems show up after setup, usually in ways that aren’t obvious until something breaks at the worst moment.
The “Always-on VPN” conflict
Android’s Always-on VPN feature is designed to make sure your traffic never travels without VPN protection — great in theory. But when you enable it alongside an app-level split tunneling configuration, behavior can get unpredictable. Some Android builds treat Always-on as an override that ignores the VPN app’s own routing rules. Test your excluded apps after enabling Always-on to confirm they’re actually bypassing the tunnel and not just silently failing to connect.
System apps and hidden traffic
Android system processes — Google Play Services, the OS update service, and several manufacturer background services — generate network traffic that doesn’t always show up in your VPN app’s app list. On Samsung and Xiaomi devices especially, I’ve seen proprietary system services route traffic in ways that conflict with split tunnel rules. If you’re seeing unexpected behavior, check whether your device manufacturer has a dedicated network management layer sitting between the OS and your VPN.
IPv6 leaks on split tunneled connections
This one bites people constantly. When you exclude an app from the VPN tunnel, it connects directly through your ISP — including over IPv6 if your ISP and device support it. If your VPN was masking an IPv6 leak from other apps, that leak is now fully exposed for your excluded apps. Run a leak test at ipleak.net on a non-tunneled app to confirm what your ISP actually sees. For most home users this isn’t a critical issue, but for privacy-sensitive use cases it matters.
VPN kill switch interactions
If your VPN has a kill switch enabled, it will block internet access entirely when the VPN connection drops — including for apps you’ve put in the bypass list on some providers. The behavior here varies significantly between ExpressVPN, NordVPN, and Surfshark. Check your specific provider’s documentation to understand whether their kill switch applies only to tunneled apps or to all network traffic system-wide.
VPN Split Tunneling for IPTV and Streaming Apps
This is the use case that brings most of our readers here. If you’re running an IPTV service alongside a VPN, split tunneling is almost always the right call — but the configuration depends heavily on which IPTV app you’re using and what your VPN is actually protecting against.
For context on why VPN usage with IPTV matters in the first place, check out our guide on the best VPNs for IPTV — it covers provider-specific performance on streaming workloads in detail.
The typical setup I use on my own Android TV box:
- Inside the tunnel: IPTV player app, Kodi, any media players pulling content from outside the country.
- Outside the tunnel: Google Play Store, YouTube, banking apps, smart home apps, Android Auto.
This gives the IPTV traffic VPN protection without tanking the performance of apps that don’t need it. On a 200Mbps home connection, I see roughly 15–20% better throughput on my IPTV streams when the Play Store and other heavy background apps are excluded from the tunnel rather than competing for VPN server bandwidth.
If you’re using Stremio with real-debrid or a similar setup, keep the Stremio app inside the tunnel. Stremio pulls from a wide range of CDN endpoints, and some of those respond differently depending on the exit IP — VPN coverage keeps that behavior consistent. We’ve covered this in more depth in our Stremio VPN setup guide.
Checking That Your Split Tunnel Is Actually Working
Configuration without verification is just guessing. Here’s how to confirm your VPN split tunneling Android setup is doing what you think it’s doing.
The IP check method
The fastest test: open a browser that’s inside the VPN tunnel and visit a site like whatismyip.com. Note the IP. Then open a browser you’ve excluded from the tunnel and visit the same site. You should see two different IPs — the VPN exit IP for the tunneled browser and your real ISP IP for the excluded one. If both show the same IP, your split tunneling isn’t working correctly.
Speed testing inside vs. outside the tunnel
Run a speed test using an app inside the tunnel (Speedtest.net app, for example) and compare it against a test run with the same app temporarily excluded. The difference tells you exactly how much overhead your VPN server is adding. On a fast home connection, the VPN overhead for a single stream is usually negligible. On a mobile connection with a distant VPN server, you might see 30–40% speed reduction inside the tunnel — which makes the case for careful split tunnel configuration even stronger.
Comparison: VPN Apps With the Best Android Split Tunneling
| VPN App | Split Tunneling Feature Name | Include Mode | Exclude Mode | Website-Based Rules |
|---|---|---|---|---|
| ExpressVPN | Split Tunneling | Yes | Yes | No |
| NordVPN | Split Tunneling | No | Yes | No |
| Surfshark | Bypasser | Yes | Yes | Yes |
| Private Internet Access | Split Tunnel | Yes | Yes | No |
| Mullvad | Split Tunneling | No | Yes | No |
ExpressVPN and Surfshark are the most flexible on Android, offering both include and exclude modes. If you need website-level rules rather than just per-app rules, Surfshark’s Bypasser is the only major option that supports it natively on Android as of 2026.
⚖️ Legal Disclaimer: IPTV Wire does not own or operate any streaming service, application, or website mentioned in this article. We do not verify whether third-party services carry proper licensing. Users are responsible for ensuring they comply with copyright laws in their jurisdiction.
Frequently Asked Questions
Does VPN split tunneling on Android reduce security?
Only for the apps you choose to exclude from the tunnel. Those apps connect directly through your ISP without VPN encryption. If those apps use their own encryption (TLS/HTTPS) — as banking apps do — the practical security impact is minimal. The key is being intentional about what you exclude and why.
Can I use split tunneling on Android TV boxes?
Yes. Android TV runs the same VpnService API as mobile Android, so VPN apps that support split tunneling on phones typically support it on Android TV boxes too. The interface is slightly different — designed for remote navigation — but the underlying configuration works the same way. I use it daily on my own Onn 4K Pro box.
Why does my banking app still fail even after I excluded it from the VPN?
A few possibilities: the VPN app needs to be reconnected after you change split tunnel settings, the Always-on VPN system setting may be overriding your exclusion, or the banking app is detecting the VPN app’s presence on the device (not just the traffic) and flagging it. Try force-stopping and restarting the banking app after making changes.
Does split tunneling work with WireGuard on Android?
The official WireGuard app for Android supports per-app split tunneling through Android’s native allowed/excluded apps interface in the tunnel configuration. You can specify which apps should or shouldn’t use the WireGuard tunnel. It’s less polished than the GUI-driven implementations in commercial VPN apps, but it works reliably once configured.
Will split tunneling affect my VPN’s kill switch?
It depends on the provider. Some VPNs apply the kill switch only to tunneled traffic, leaving excluded apps unaffected when the VPN drops. Others apply the kill switch system-wide, blocking all traffic — including from excluded apps — when the VPN connection fails. Check your specific VPN provider’s documentation before relying on either behavior.
Leave a Comment