Android VPN split tunneling lets you decide which apps send traffic through a VPN and which connect directly to the internet. It can be useful when a work app needs a secure route but a local device or region-sensitive app works better without one. The exact controls depend on your VPN client: Android’s built-in VPN settings do not provide a universal app-routing switch for every third-party subscription or proxy configuration. Before changing settings, confirm that the client you use supports per-app routing and learn whether its list means “include these apps” or “exclude these apps.”
Understand what split tunneling changes
Without app-based rules, a VPN client typically sends network traffic from the apps covered by its system tunnel through the selected VPN route. Split tunneling adds an app-selection policy. Depending on the client, you may choose only certain apps to use the VPN, or choose certain apps to bypass it while the remaining covered apps use the VPN. These are opposite ways to describe the same kind of routing decision, so check the wording carefully before saving a list.
An app excluded from the VPN usually connects using the device’s ordinary network path. That does not necessarily mean it uses a particular Wi-Fi connection: if the phone moves to mobile data, direct traffic may use mobile data instead. An included app normally sends covered traffic through the VPN, but the rule does not guarantee that every request made by every component of the app follows the same path. Apps can rely on browser components, system services, or companion apps, and client implementations differ in how they apply rules to that traffic.
Split tunneling changes routing; it does not create a second internet connection or guarantee that a service will accept the resulting traffic. A VPN can change the network path and the apparent exit location for traffic that traverses it. It cannot fix a broken local connection, change an app’s account region, or ensure that an app permits a particular location or connection method.
Choose an app-routing policy before editing settings
Start with the task you need to complete rather than selecting apps at random. If the priority is to protect a particular browser or messaging app with the VPN, an include-only policy may be easier to review. If most apps should use the VPN but a local-control app or a service that must use the regular connection should not, an exclusion policy may be more practical. Neither approach is inherently safer in every situation; the important point is knowing which apps are covered.
- ✅ Use an include-only list when you want a small, clearly identified set of apps to use the VPN.
- ✅ Use exclusions when the VPN should cover most apps and you have a specific reason to bypass it for a few.
- ✅ Keep banking, work, and personal apps in mind when deciding whether their traffic should use the VPN; follow any rules set by your organization or service provider.
- ❌ Don’t assume that an app is excluded merely because it is not visible in a collapsed list or a different profile.
- ❌ Don’t use split tunneling as a substitute for checking which account, network, or region an app requires.
Consider the consequences of the direct route. An excluded app does not benefit from the VPN path, so its network requests use the connection provided by the current Wi-Fi or mobile network. If you are using an untrusted network, excluding an app may expose its traffic to that network’s normal conditions. Modern apps often encrypt their own connections, but the VPN setting itself is not a replacement for app-level encryption or sound account security.
Also consider whether the app depends on local devices. A printer, casting target, smart-home device, or service available only on the local network may behave differently when the phone’s traffic is routed through a VPN. Some clients offer a separate local-network option; others handle local destinations differently. Check the client’s documentation rather than assuming that excluding an app is the only way to reach a device on your Wi-Fi.
Configure split tunneling on Android
The menu names below are functional descriptions, not fixed instructions for every Android device. VPN clients, Android versions, and manufacturer interfaces may place per-app controls in different locations. Keep the VPN disconnected while you inspect the policy if the client recommends that, and avoid changing unrelated Android network settings to match a menu path from another device.
- Confirm the client is connected to the intended configuration. Open the VPN client and check that the subscription or profile you mean to use is selected. If you use a compatible client such as Clash Verge, sing-box, or Shadowrocket on another platform, do not assume that its Android controls or subscription behavior are identical. On Android, use a client that supports the configuration format and per-app routing options you need.
- Find the per-app routing control. Look for a setting named “Split tunneling,” “Per-app VPN,” “App routing,” “Include apps,” or “Bypass selected apps.” It may appear in the connection profile, VPN settings, or an advanced section. If you cannot find an app list, check the client’s own help materials before assuming Android has a universal setting for it.
- Read the policy description before selecting anything. Determine whether the list contains apps that use the VPN or apps that bypass it. Some clients present a mode selector separately from the app picker. Set the mode first, then review the list so that a saved selection is not interpreted in the opposite way from what you intended.
- Select apps by their displayed identity. Check the app name and, where available, its icon or package information. Some apps have separate companion apps or work-profile copies. If the app you need is missing, verify that it is installed in the profile where you are configuring the VPN and refresh the list if the client provides that option.
- Save the change and reconnect if required. Some clients apply routing changes immediately; others need the VPN connection to be restarted. Follow the client’s prompt, then confirm that Android shows the expected VPN connection. If Android displays a request to allow the VPN connection, review it before accepting.
- Test one included app and one bypassed app. Use a harmless, repeatable check for each. Confirm that the VPN-covered app reaches the expected service, and that the bypassed app can still perform the task for which you excluded it. Do not use a single status icon as proof that every app follows the intended path.
If you are comparing client options or reviewing setup guidance, VPNHand provides the service’s starting point; check the instructions for the specific Android client you plan to use before importing a configuration. Subscription links and client profiles are not interchangeable with Android’s generic “Add VPN” form, and a client must support both the configuration format and the routing control you want.
Keep a note of the initial policy before experimenting. If the results become confusing, restore the previous mode and list, reconnect, and test again. This is easier to diagnose than changing the app list, DNS options, battery controls, and network settings all at once.
Verify which route each app uses
Verification should test the behavior you care about, not just whether the VPN icon is visible. A system VPN indicator generally tells you that a VPN connection is active; it does not identify which individual app is using the tunnel. Start with a simple test on a stable network and record which app is included or excluded. Then test the actual service or device that prompted you to configure split tunneling.
- For an app meant to use the VPN: Open the app and check a service-provided connection or region indicator if it has one. If you use an IP-check page, open it from that app’s own browser or web view only when this accurately represents the traffic you are testing. A separate browser may have a different routing rule.
- For an app meant to bypass the VPN: Confirm that it can reach the required local device or service while the VPN remains connected. If it still fails, check whether the service requires local-network access, whether the app is using the expected Wi-Fi, and whether Android permissions allow the required device discovery.
- For background activity: Test with the app open and, if relevant, after returning to the home screen. An app may use separate components for notifications, downloads, or account synchronization. The client’s per-app rule may apply differently depending on its implementation.
- After a network change: Repeat the check after moving between Wi-Fi and mobile data. The direct route for bypassed apps changes with the underlying network, and a previous result does not establish what happens on the new connection.
DNS behavior deserves a separate check if an app reaches a service but resolves a name unexpectedly. The client may handle DNS through the VPN, apply its own DNS settings, or follow platform-specific behavior. An app that bypasses the VPN may not use the same resolver path as an included app. Avoid installing an unfamiliar “DNS test” app just to inspect this; use a trusted diagnostic method and change one setting at a time.
Some Android devices have a work profile or another user profile. Apps installed in different profiles can appear as separate entries, and an organization may control VPN behavior for managed apps. If a work app is missing or its route cannot be changed, check the profile and any administrator policy. Do not try to defeat a managed-device restriction; ask the administrator which network path is permitted.
Troubleshoot common split tunneling problems
The app list is missing or incomplete. First check whether the VPN client supports per-app routing on the Android version and configuration you use. Then confirm that the app is installed in the current Android profile and that the client has refreshed its app list. If a required app is a browser-based service, identify the actual browser app that opens it; selecting a different browser will not necessarily change the route.
The selected app still appears to use the wrong route. Recheck whether the client uses an include list or an exclusion list, and verify the mode as well as the selected entries. Confirm that the intended profile is active, then disconnect and reconnect if the client requires it. A companion process, web view, or system component may handle some requests separately, so test the exact operation that matters instead of inferring behavior from the app’s main screen.
An excluded app cannot reach a local device. Check that the phone and device are on the appropriate local network, that discovery permissions are enabled, and that the client does not have a separate setting affecting local-network access. If the client offers a local-network bypass, test it according to its documentation. Avoid disabling the VPN globally as a permanent workaround if only one local service is affected.
The VPN connects but an included app cannot load content. Check the app’s own connection state and sign-in requirements, then test the same app without split-tunneling changes to determine whether the routing rule is involved. If it works without the rule, simplify the app policy and reintroduce entries gradually. If it fails in both cases, look at the selected profile, network availability, and the app’s service requirements before changing unrelated Android settings.
Android drops the VPN in the background. Review the client’s battery and background-activity guidance and the device maker’s app-management controls. These settings can affect whether the client remains available, but they are separate from the app-selection policy. Change only the controls recommended for that client, and recheck both the VPN connection and the routing list afterward.
Always-on VPN or lockdown changes the outcome. Android may offer system-level VPN options such as always-on behavior or blocking connections without a VPN. Their availability and exact effect depend on the device and Android configuration. Lockdown can prevent direct traffic from apps that would otherwise bypass the tunnel, which may conflict with the purpose of an exclusion list. Before enabling or changing these options, understand how the device will behave if the VPN disconnects and follow any work or administrator policy.
For a reliable setup, keep the routing policy small, make one change at a time, and repeat the same checks after client updates or profile changes. If a client does not expose a per-app control, do not assume that importing a different subscription will add it: app routing is generally a client or platform capability, while the subscription supplies connection configuration. Choose a compatible client and verify its behavior on your device before relying on a split-tunnel rule.