Android VPN split tunneling lets you choose which apps use a VPN connection and which use the device’s regular network. The setting is usually controlled by the VPN app, not by a single universal Android menu, so the labels and available options vary between clients. Before changing anything, decide which apps need the tunnel, which must stay direct, and how you will confirm the rules are working.

Think of split tunneling as an app-routing policy, not as a way to make every app more private or faster. An app excluded from the VPN uses the network connection available to the phone, which may be Wi-Fi or mobile data. Its traffic does not gain the VPN tunnel’s network path. That can be useful for local services or apps that require a direct connection, but it should be a deliberate choice.

Android VPN Split Tunneling: Set App Rules With Ease

Understand the Two App Rule Modes

Most Android VPN clients that offer app-based split tunneling provide two basic approaches: include selected apps in the VPN, or exclude selected apps from it. The wording differs. Look for settings such as “per-app VPN,” “app rules,” “bypass VPN for selected apps,” or “only selected apps use VPN.” Read the description in the client carefully, because a list of checked apps can mean either “send these through the VPN” or “bypass the VPN for these.”

• Include selected apps: Apps on the list use the VPN; other apps use the regular connection. This can be easier to reason about when only a small set of apps needs the tunnel.
• Exclude selected apps: Most app traffic uses the VPN, except the apps on the bypass list. This can be convenient when you want broad VPN coverage but need a few exceptions.

These modes are alternatives, not two independent lists that every client combines. Android’s VPN framework gives an app a way to establish a VPN connection and configure which applications are allowed or disallowed from using it. A client may expose that capability through a simple checklist, but the rule is still applied by the VPN app and Android’s networking system together. Don’t assume that selecting an app in one mode will have the same effect in another.

App rules normally apply to the installed app identity, rather than to a particular website, account, or activity inside the app. If a browser is routed through the VPN, the rule generally covers its network traffic as a whole; it does not usually send one website through the tunnel and another directly. For destination-based choices, a client would need a separate domain or IP routing feature, and that is different from Android’s app list.

Choose Apps by Purpose and Risk

Start with the reason for the exception. Apps for local devices, such as a printer or a device-management tool on your home network, may need a direct route to find services nearby. Some banking, payment, or workplace apps may behave differently when a VPN exit changes the apparent network location. A media app may need a particular route to reach a service. These are possible reasons to test an app rule, not guarantees that bypassing the VPN will fix a problem.

Consider the consequences as well as convenience. An excluded app sends its network traffic outside the VPN tunnel. The network you are connected to can therefore handle that traffic directly, and the app may see the connection’s ordinary public IP address rather than the VPN exit. HTTPS still protects content in transit between the app and the service when correctly implemented, but it does not turn a direct connection into a VPN connection. If privacy from the local network or a consistent VPN exit matters for an app, keep it routed through the tunnel unless you have a clear reason to do otherwise.

Build a short list before opening settings. Note the app, the reason for its route, and a way to test it. Avoid making exceptions for every app simply because one app has a connection issue; a broad bypass list can make the final routing difficult to understand. If a service works only when excluded, record that as a troubleshooting result and check whether the cause is a location restriction, network policy, DNS behavior, or an app-specific compatibility issue.

• ✅ Use an app exception when you can explain why that app needs a different route.
• ✅ Keep apps that handle sensitive traffic on the VPN when tunnel coverage is part of your privacy goal.
• ✅ Test one rule at a time so you can identify which change affected the connection.
• ❌ Don’t assume that an app is protected just because the VPN status says “Connected.”
• ❌ Don’t treat an excluded app as an encrypted VPN connection; it uses the regular network path.

For Android device support, client availability, and account options, start at VPNMG and check the information relevant to your setup. A service subscription and an Android client’s split-tunneling controls are separate parts of the experience: confirm that the particular client you use offers per-app rules rather than assuming every client exposes the same feature.

Set and Test App Rules on Android

The exact screen names depend on the client and Android version, but the following workflow keeps the change controlled. Use the VPN client’s own settings for app rules unless its documentation specifically directs you to Android system settings. Android’s system VPN page may show connection status and always-on options without providing the per-app list you need.

1. Update and connect the client. Open the VPN app, confirm that its configuration is current, and connect using the normal procedure. If the client asks for Android’s VPN permission, review the request and approve it only for the client you intend to use.
2. Find the app-routing setting. Look through settings for split tunneling, app rules, or per-app routing. Note whether the screen is set to include listed apps or exclude listed apps before changing the selection.
3. Select a single test app. Search the installed-app list and choose one app whose behavior you can check. If it does not appear, verify that it is installed in the same Android profile as the VPN client. Work profiles, cloned apps, and manufacturer-specific app copies can appear as separate app instances or may not be visible to every client.
4. Save and reconnect if requested. Some clients apply a rule immediately; others require the VPN connection to be restarted. Follow the client’s prompt, and wait until Android shows that the VPN is connected again before testing.
5. Test the selected app and a control app. Open the app whose route you changed, then check a second app that was not selected. This helps reveal whether the client interprets the list as an allowlist or a bypass list. Use a network test that reports the public exit address when appropriate, and compare it with the route expected for each app.
6. Record the result and add further rules gradually. If the test matches your intention, add the next app and repeat. If it does not, restore the previous selection and check the mode, connection state, and any always-on or lockdown setting before making another change.

Keep the test conditions consistent. A change from Wi-Fi to mobile data, a captive portal, or another active network can affect the result independently of the app rule. Also distinguish a route test from an app’s own status message: an app may continue to show an old session, cached location, or account region even after its network path changes. Close and reopen it when needed, then test again.

Verify What the Rule Actually Does

A reliable check combines the client’s status with an independent network observation. First confirm that the VPN app reports an active connection. Then use a reputable IP-checking method from the app you are testing, if available, and compare the reported public address with the expected VPN or direct route. Finally, open a second app with a different rule status and check that it follows the other path. A single successful page load does not prove that the intended routing policy is active.

Be aware that Android does not make every app easy to test independently. A browser can open multiple tabs, but the VPN rule normally applies to the browser app as a whole. A website opened inside a social app’s built-in browser may use that social app’s route instead of the route used by your standalone browser. When checking an address, make sure you know which app is making the request.

DNS behavior is another part of the result. Depending on the client, Android version, and configuration, DNS requests may follow the app’s route, use a VPN-provided resolver, or be handled differently from the traffic you expected. A direct-routed app may also use the network’s ordinary DNS path. If you are diagnosing a privacy or access issue, do not infer DNS behavior solely from the public IP address shown by a website; consult the VPN client’s documentation and test the relevant configuration.

Android’s “always-on VPN” and “block connections without VPN” options can influence what happens when the tunnel disconnects. They are system-level controls, not substitutes for checking the client’s app rules. In particular, lockdown behavior may prevent some traffic from using a direct route, which can conflict with the bypass behavior you expected. The exact interaction depends on Android and the VPN app. If an excluded app stops connecting after enabling lockdown, review both settings rather than repeatedly changing the app list.

Fix Common Split Tunneling Problems

An app still uses the VPN after you exclude it: verify that the client is in exclude mode, save the list, and reconnect if necessary. Check that you selected the correct app instance; a work-profile copy or cloned app may be a separate entry. If Android lockdown is enabled, temporarily review its effect using the client’s instructions, and restore your intended security settings after the test.

An app loses access after you exclude it: confirm that the phone has a working direct connection on the current Wi-Fi or mobile network. Some services do not accept the network’s ordinary route, while others may require a particular DNS response or may retain a previous session. Reopen the app, test another network if practical, and compare with the VPN route. If it works only through the tunnel, remove the exception unless you have another supported configuration to try.

The VPN says connected, but the test address is unexpected: first check which app opened the test page. Then confirm the rule mode and reconnect. A system browser, embedded browser, and third-party browser are distinct apps for app-based routing. Also consider whether another VPN client or proxy app is active; Android generally permits only one active VPN connection through its standard VPN service at a time, so competing clients can prevent the intended configuration from taking effect.

The app is missing from the selection list: check that it is installed, enabled, and present in the same user or work profile as the VPN client. Some manufacturers provide cloned-app features or multiple user spaces that create separate instances. Client behavior varies, so consult its help material before trying to route a package that the app does not display.

The connection changes after switching networks or restarting: wait for Android to reconnect the VPN, then repeat the route check. A rule can be saved while the tunnel itself is temporarily unavailable. If the behavior remains inconsistent, note the Android version, client version, network type, rule mode, and steps that reproduce it. Those details are more useful for support than a screenshot that exposes account credentials or a subscription URL.

After troubleshooting, remove exceptions that are no longer needed and keep a note of any rule whose purpose is not obvious. Split tunneling is easiest to maintain when the list stays small, each exception has a reason, and you periodically confirm that the client still applies the intended route after updates. The goal is not to maximize the number of rules; it is to make each app’s network path predictable.