Android VPN Split Tunneling: Route Apps With This Setup Guide

What Android Split Tunneling Actually Does

Android split tunneling lets a compatible VPN client decide which apps send traffic through its VPN connection and which apps connect through the regular network. It is an app-routing choice, not a second internet connection and not a way to change Android’s VPN settings globally. For example, you might route a browser through the VPN while letting a local banking app use the device’s ordinary connection.

The feature is usually controlled inside the VPN client, because Android apps commonly create VPN connections through the Android VPN service interface. Menu names differ: look for terms such as “split tunneling,” “per-app routing,” “included apps,” “excluded apps,” or “bypass VPN.” Android’s system settings may show that a VPN is connected, but they do not necessarily provide the per-app controls you need. The client must implement those controls and request the relevant Android permissions.

There are two common selection patterns. In an include-list mode, only the apps you select use the VPN; other apps use the regular connection. In an exclude-list mode, apps you select bypass the VPN; the remaining apps use it. The same list of selected apps therefore has opposite results in the two modes. Read the mode description carefully before saving, especially if the interface uses a short label such as “bypass.”

Split tunneling is also different from setting a proxy inside an individual app. An app-level proxy usually applies only to traffic that the app sends through that proxy, and it may need its own server details. A VPN client’s per-app routing uses Android’s VPN connection to direct app traffic. A feature described as “per-app proxy” may work differently, so check whether the client is asking you to select apps for its VPN tunnel or configure a proxy inside each app.

App routing does not change account eligibility, a website’s terms, or the actual location of the device. It only changes which network path selected traffic uses. Before relying on the setting, confirm that the client you installed supports per-app routing on Android; the feature is not guaranteed across all clients or subscription formats.

Choose an Include List or an Exclude List

Start with the outcome you want, then choose the mode that expresses it most clearly. If a small number of apps should use the VPN and most apps should remain direct, an include list can be easier to review. If most apps should use the VPN and only a few trusted apps should bypass it, an exclude list may require less maintenance. Neither mode is universally safer or more convenient; the right choice depends on which apps you want to route.

• ✅ Use an include list when you want to name the apps that should use the VPN and leave other apps on the ordinary connection.
• ✅ Use an exclude list when the default should be VPN routing and you have a clearly defined set of apps that should bypass it.
• ✅ Check whether the client’s wording describes apps that use the tunnel or apps that bypass it; those are different lists.
• ✅ Review the selection after installing, updating, or cloning an app, since Android may treat a work-profile or cloned copy separately.
• ❌ Don’t assume that a browser’s traffic is covered just because another app on the device uses the VPN.

Consider the practical consequences for each app. A local service may need direct access to a nearby network, while a browser or a work tool may need the VPN route. Some apps communicate with background services, open links in another app, or use separate components. Selecting one app does not guarantee that every related process or destination will follow the route you expect.

Also consider what “direct” means for your setup. A bypassed app generally avoids the VPN tunnel, but its connection can still be affected by Android’s Private DNS setting, the mobile carrier, Wi-Fi restrictions, or settings inside the app itself. A split-tunnel rule does not promise a particular DNS path or override every network policy. If DNS behavior matters, check the VPN client’s documentation and test the specific app rather than inferring its route from a single setting.

Set Up Per-App Routing on Android

Menu names and screen layouts vary among Android versions, device manufacturers, and VPN clients. The following workflow is intended for clients that provide a per-app routing control. If you cannot find the setting, check the client’s help page for your Android version rather than assuming that a generic Android VPN screen contains it.

1. Confirm that the client supports the feature. Open its settings and look for split tunneling, app routing, or an equivalent control. Check whether it offers an include list, an exclude list, or both. If it has no per-app option, the current client may not support this setup.
2. Connect the client and approve Android’s VPN request. When Android asks to allow a VPN connection, review the prompt and approve it only for the client you intend to use. Android may display a key or VPN indicator while the connection is active.
3. Open the app-selection screen. Depending on the client, this may be available before connecting or only after a profile is selected. If Android displays an app list, allow it to load fully. On devices with work profiles or cloned apps, check whether the version you use appears as a separate entry.
4. Choose the routing mode and select apps. Read the explanation beside the list before ticking items. In an include mode, select the apps that should use the tunnel. In an exclude mode, select the apps that should bypass it. Save or apply the selection if the client provides a separate confirmation control.
5. Reconnect if the client requires it, then test. Some clients apply rule changes immediately; others need the VPN connection to be restarted. Follow the client’s instructions, then verify the selected and unselected apps separately. Avoid changing several unrelated network settings during the first test.

If you use a subscription-based client, importing a subscription and setting app routing are usually separate tasks: the subscription provides connection configuration, while the Android client controls local app selection. A subscription update may change available connection details without preserving or changing every local preference, depending on the client. Record the routing mode and review it after an update instead of assuming that your previous selection remains unchanged.

For official client and account information, use the relevant instructions for your platform. If you need to check the service’s general features, visit VPNMF; do not share a private subscription link or account credentials while asking for help. If the client provides an export or diagnostic function, review what it contains before sending it, because diagnostic files can include device or connection details.

Verify the Route for Each App

A connected indicator confirms that the client has established a VPN connection; by itself, it does not prove that every app follows the route you intended. Test the configuration at three layers: the client’s selected mode and app list, the Android connection state, and the behavior of the actual apps. Testing both a selected app and an unselected app is more informative than checking only whether the VPN icon appears.

First, return to the client’s app list and confirm the mode and selections. Then open Android’s VPN settings and check which client is connected. The exact route shown in system settings can vary, so treat this as a connection-state check rather than proof of an app’s public egress. Finally, open the apps you selected and the apps you left out. Use an appropriate, reputable network or account check for the service in question, and compare results with the client temporarily disconnected only if doing so is safe for your accounts and network.

Test ordinary activity as well as a basic connection check. A page may load from cached content, an app may keep an existing session, or a background request may use a different component. Close and reopen the app when appropriate, wait for a fresh connection, and check whether the behavior matches the include or exclude mode. Do not treat one successful page load as proof that every destination used the same route.

Repeat the check on each network where you depend on the rule, such as Wi-Fi and mobile data. Network changes can expose DNS, captive-portal, firewall, or carrier restrictions that were not present during the first test. If an app fails only on one network, note that distinction before changing the app list; the issue may be the network environment rather than the split-tunnel selection.

Troubleshoot Rules That Do Not Apply

If an app appears to use the wrong route, start by checking the simplest causes. Confirm that the expected VPN client is connected, that Android has not disconnected it, and that the routing mode is still the one you intended. Reopen the selection screen and check the app’s actual entry; a similarly named work-profile or cloned app may be a different package. Save the list again and reconnect if the client requires a restart for rule changes.

• Everything seems to bypass the VPN: Check whether you selected an include list but left it empty, or whether the client is disconnected. Confirm that the client’s selected profile is active and that its own status indicates a connection.
• Unexpected apps use the VPN: Check whether the client is in exclude mode, where unlisted apps may be routed through the tunnel. Review the full list and remove selections that should not bypass it.
• One app behaves inconsistently: Close and reopen it, check for a duplicate or work-profile copy, and test again after reconnecting. The app may also use a separate browser, login component, or background process.
• The client disconnects or stops applying rules: Review Android battery and background-activity restrictions for the client. Some manufacturers limit background work aggressively. Change such settings only when needed and consult the device maker’s guidance.
• Local devices or services become unreachable: Check the client’s options for local-network access and review the app’s own network requirements. Do not assume that excluding one app also changes routing for every local address or related service.

Android generally expects one active VPN connection for ordinary consumer VPN use. If another VPN app, firewall, filtering tool, or work profile is also trying to manage a VPN connection, the services may conflict or Android may prompt you to replace the active connection. Disconnect other VPN clients before testing, and follow your organization’s instructions if the device is managed. Do not try to work around a workplace policy by changing profile controls.

“Always-on VPN” and “Block connections without VPN” are device-level options that can affect the consequences of bypass rules. Depending on the configuration, an app excluded from the VPN may be unable to connect when traffic outside the tunnel is blocked. If you use either option, read Android’s description and the VPN client’s documentation before enabling split tunneling. Keep a way to restore your previous settings, and change one control at a time so you can identify what caused a connection failure.

Finally, treat app routing as a setting to review, not a permanent guarantee. Client updates, Android updates, profile changes, and app reinstallations can alter what appears in the selection list or how a rule is applied. Recheck the configuration after a significant change, keep the mode and purpose of each rule clear, and contact the client’s official support channel with a redacted description if the behavior remains inconsistent. Never include passwords, full subscription URLs, QR codes, or other account credentials in a public troubleshooting post.