Working remotely
Some work tools and home-office devices expect to find you on your local network. Excluding just those keeps the rest of your traffic in the tunnel.
VPNs for remote workControl
Split tunnelling
Keep most of your traffic in the encrypted tunnel, and let the one or two things that don’t get on with a VPN use your normal connection, without switching protection off completely. Split tunnelling is in every DarkMatter app except the iPhone, iPad and Mac apps.
- Choose what goes through the VPN and what doesn’t
- Helps keep devices such as a printer or NAS within reach
- Everything you don’t exclude stays in the encrypted tunnel
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
What it is
What is split tunnelling?
In short
Split tunnelling is a VPN setting that divides your traffic into two routes. Traffic you keep in the VPN travels through the encrypted tunnel; traffic you exclude uses your normal internet connection. It gives you control over what the VPN covers, so you don’t have to choose between everything and nothing.
How it works
How split tunnelling works
A VPN normally sends everything through the tunnel. Split tunnelling adds rules that pick out some traffic to take a different route.
- Encrypted VPN tunnel
- Normal connection
- Excluded traffic, outside the VPN
Read this diagram as text
Two rows. Row one, traffic you keep in the VPN: your device’s rules send it through the encrypted tunnel to a VPN server, and websites see the server’s IP address. Row two, traffic you exclude: it skips the tunnel and uses your normal Wi-Fi or mobile connection, so it is not protected by the VPN and the local device or service it reaches sees your real IP address. This shows split tunnelling in general; the options available depend on your device.
Two rows. Row one, traffic you keep in the VPN: your device’s rules send it through the encrypted tunnel to a VPN server, and websites see the server’s IP address. Row two, traffic you exclude: it skips the tunnel and uses your normal Wi-Fi or mobile connection, so it is not protected by the VPN and the local device or service it reaches sees your real IP address. This shows split tunnelling in general; the options available depend on your device.
Set your rules
In a DarkMatter app that has split tunnelling (not on iPhone, iPad or Mac), choose what to exclude from the VPN. Depending on your device, rules might apply to apps, to destinations, or both.Traffic is sorted
While the VPN is connected, your device checks outgoing traffic against those rules.Two routes
Traffic you keep in goes through the encrypted tunnel. Excluded traffic uses your normal connection, just as it would with the VPN off.
Think of it as a junction rather than an on-off switch. The VPN stays on for everything you haven’t excluded, which is why split tunnelling is usually a better answer than disconnecting when one app won’t cooperate.
Excluded traffic is treated as if the VPN weren’t running: the VPN doesn’t encrypt it, and whatever it connects to sees your real IP address. That’s the trade-off, and it’s why we suggest excluding as little as possible.
Why it matters
Where it makes a difference
Most people reach for split tunnelling for a handful of specific reasons.
Gaming
If a game or launcher behaves oddly over a VPN, you can try excluding it while your browser and other apps stay protected. Whether a game accepts VPN connections is up to the game.
VPNs and gamingOnline banking
Some banks question sign-ins from VPN addresses. Excluding your banking app or site is one option; your bank’s own encryption still applies.
VPNs and online bankingStudent life
On a shared student network you might keep a local printer or campus service within reach, while everything else stays in the tunnel.
VPNs for students
Side by side
How it compares
| Everything in the VPN | Split tunnelling | VPN off | |
|---|---|---|---|
| Traffic encrypted by the VPN | All of it | Everything you don’t exclude | None |
| Sites see a VPN server’s IP address | Yes | Partly | No |
| Devices on your local network | Depends on your device | Reachable if you exclude them | Reachable |
| Best for | The most coverage | Keeping one or two things outside | Nothing you want kept private |
“Partly” means only traffic you keep in the VPN uses a VPN server’s IP address.
The honest bit: what it can’t do
- Anything you exclude isn’t protected by the VPN. We don’t encrypt it, and it uses your real IP address.
- Split tunnelling doesn’t make a blocked service or website work. It only chooses the route your traffic takes.
- What you can exclude, whether rules apply to apps or destinations, and whether split tunnelling is available at all, depends on your device.
- Rules only help if they’re right. If you’re not sure what an app connects to, keep it in the VPN.
Split Tunnelling
Common questions
What is split tunnelling in a VPN?
It’s a setting that lets some of your traffic bypass the VPN and use your normal connection, while everything else stays in the encrypted tunnel.
Is split tunnelling safe?
It’s as safe as the choices you make. Traffic you keep in the VPN is protected as usual. Traffic you exclude isn’t encrypted by the VPN and uses your real IP address, so only exclude things you’re comfortable sending that way.
Can I choose individual apps or websites?
Split tunnelling isn’t in the iPhone, iPad or Mac apps. In our other apps the options depend on your device: some support rules for apps, others for destinations, and the app shows what’s available.
Why would I exclude anything from the VPN?
Common reasons are reaching a printer or other device on your home network, or using a service that doesn’t work over a VPN. Excluding just that one thing is usually better than disconnecting completely.
Will split tunnelling help a service or website work?
It can’t change what a service allows. It only decides whether traffic goes through the VPN. What a website or app shows you is up to that service.
Does split tunnelling cost extra?
No. It’s included on every plan, in every DarkMatter app except the iPhone, iPad and Mac apps, so there are no add-ons to buy. Compare plans.
Included on every plan
Every plan includes every feature, for up to 5 devices at once. Renewal prices are shown before you pay.
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
- Up to 5 devices at once
- Windows, macOS, iOS, Android and Fire TV
Related features
Last reviewed