Android VPN split tunneling lets you choose which apps send traffic through a VPN and which use the device’s regular network connection. It can be useful when a work app needs a VPN route but a local service should connect directly, or when you want to troubleshoot one app without changing the route for everything else. The exact controls depend on the VPN client: some offer per-app inclusion or exclusion lists, while others do not support app-based routing at all.
Understand app-based routing
On Android, a VPN client can request permission to create a system VPN connection and define which apps use it. When the client supports split tunneling, it may let you choose either the apps that should use the VPN or the apps that should bypass it. These are two ways of expressing a routing rule, but the available choices and their labels vary by client.
With an inclusion list, the selected apps use the VPN and other apps normally use the device’s regular connection. With an exclusion list, most apps use the VPN while the selected apps connect outside it. Check which mode the client is using before you add rules: choosing an app in an exclusion list has the opposite effect from choosing the same app in an inclusion list.
“Direct” or “bypass” usually means that the app does not use that VPN tunnel. It does not mean that the app is encrypted by the VPN, nor does it promise that the app connects to a particular server. Its traffic follows the network and routing settings available on the device, which can include mobile data, Wi-Fi, and other Android-level controls.
Split tunneling is not a guarantee that every request made by an app follows the same route. Some apps use companion services, browser components, or system processes. Other apps may change how they connect after an update. A rule can select an Android app package, but it cannot always account for every related process or every destination an app contacts.
Check client support and Android settings
Before changing any rules, confirm that the Android client itself offers per-app routing. Look in the client’s connection settings for wording such as “split tunneling,” “per-app VPN,” “include apps,” or “exclude apps.” A route list or a connected status indicator does not prove that the client supports these controls. If the option is absent, do not assume that an Android system setting with a similar name is available for a regular consumer VPN app.
Android versions and manufacturer interfaces differ, so menu names and locations can change. The system’s VPN page may show which app currently owns the VPN connection, while the app-selection list is often inside the VPN client. Follow the instructions for the client and Android version you actually use rather than relying on a screenshot from a different device.
Review Android’s “Always-on VPN” and “Block connections without VPN” settings if they are enabled. These controls affect the consequences of losing the VPN connection. In particular, a lockdown setting intended to block traffic outside the VPN can prevent bypassed apps from connecting directly, or make the behavior differ from what you expect. Do not turn off a protection setting without understanding the privacy and availability trade-off. If a managed work profile or device administrator controls VPN settings, those policies may also limit app selection.
Make a note of the current mode and selected apps before editing the list. If you use a work profile, a cloned app, or a second copy of an app, check whether Android presents each copy separately. The VPN client may identify these as distinct installed applications, and adding one may not automatically apply the same rule to another.
- ✅ Confirm that the Android client has a per-app routing option.
- ✅ Identify whether the rule list includes selected apps in the VPN or excludes selected apps from it.
- ✅ Check whether Always-on VPN or lockdown settings could block direct connections.
- ✅ Note existing selections so you can restore them if the change causes a problem.
Set app rules and test them step by step
Change one rule at a time. Testing a small, reversible change makes it easier to distinguish a routing issue from an account, app, or network problem. Menu labels may differ, but the sequence below applies to clients that provide app-based split tunneling.
- Connect the VPN first. Confirm that the client reports an active connection and that a known VPN-routed app can load a page or service. If the tunnel is not connected, a split-tunneling test cannot tell you which route an app would use.
- Open the app-routing control. Find the include or exclude mode and read its description. If the wording is unclear, do not infer the behavior from a checked box alone; consult the client’s help text or documentation.
- Select one test app. Choose an app whose connection behavior you can check safely. Avoid changing a long list at once, and do not use a sensitive account or a task that could be interrupted as your first test.
- Apply the change and reconnect if requested. Some clients apply rules immediately; others require you to save settings, disconnect, and reconnect. Follow the prompt shown by your client. Don’t repeatedly toggle Android permissions or network settings when the client only needs a reconnect.
- Check the app’s behavior. Close and reopen the app, then test the feature you expect to work. If the client provides per-app status or diagnostic information, use it as one indication of the selected route, not as proof that every request from the app follows it.
- Compare with the unchanged state. Temporarily restore the original rule, reconnect if needed, and check whether the result changes. This comparison helps establish whether the new app rule is relevant.
When checking a route, use an appropriate IP or network diagnostic in the app or browser that you are testing, if available. Compare the VPN-connected state with the intended bypass state, and account for the fact that different apps can use different connection methods. A browser test only describes that browser’s traffic; it does not confirm the route used by a separate app.
For example, if you are setting up VPNGV alongside an Android client, first confirm the client’s own per-app controls and subscription compatibility rather than assuming that a particular routing option is provided by the service. The same check applies to any provider: app routing is a client and operating-system behavior, and the client’s documentation is the right place to confirm its available controls.
Keep a short record of the app, rule mode, and observed result. This is especially useful when a client updates or you change devices, because an update may alter menu wording or how an application appears in the list. Avoid treating one successful test as a guarantee for all networks or future app versions.
Do not test a bypass rule by turning off the VPN and assuming the result is equivalent. Disconnecting the VPN changes the route for all apps that use it; a split-tunneling rule is meant to change the route for selected apps only.
Troubleshoot failures without losing track of the cause
If a bypassed app cannot connect, first confirm that the client is still connected and that the app is actually in the exclusion list rather than an inclusion list. Recheck the saved settings, then reconnect the VPN if the client requires it. If Android’s lockdown setting blocks traffic outside the VPN, a bypassed app may be unable to use the regular connection even when the app rule is configured correctly.
If an app expected to use the VPN appears to connect directly, check whether it is selected in the active rule mode and whether you selected the correct copy of the app. Work-profile and personal-profile versions can be separate entries. Also check whether the app delegates a request to another app, such as a browser or a system component; the rule for the original app may not govern the component that performs that request.
When only one app fails, test it with the original rule restored before changing DNS, proxy, or system network settings. If it works again, the app rule or an interaction with Android’s VPN controls may be involved. If it still fails, investigate the app’s own sign-in status, permissions, content restrictions, and current network connection separately.
For a broader connection failure, simplify the setup temporarily: remove the recently added rule, reconnect, and test a single app through the VPN. Pause other VPN or proxy clients during this check, since two tools attempting to control Android routing can interfere with one another. Do not change several settings at the same time; otherwise, a successful result will not reveal which change mattered.
Some apps restrict access based on network, location, or account conditions. A routing rule cannot override those requirements, and a working VPN connection does not ensure that a third-party app will accept the resulting connection. Use the app’s official guidance when access depends on its own terms or regional availability.
Undo or refine the configuration
To reverse a change, remove the app from the include or exclude list, restore the mode you recorded, and save the settings. If the client indicates that a reconnect is necessary, disconnect and reconnect through the client. Then test the app again. If you are unsure which selection caused the issue, return the list to its previous state rather than trying several new combinations.
If the VPN stops connecting after a rule change, disable split tunneling temporarily or restore the last known working app list. Check that Android still grants the VPN permission to the intended client. If a system VPN prompt appears, verify the app name before approving it. Do not approve an unexpected request from an unrelated app.
Use the smallest rule set that meets your needs. Every bypassed app uses a route outside that VPN tunnel, so avoid excluding apps simply because the option exists. Conversely, routing an app through a VPN does not make the app itself trustworthy or remove the need to review its permissions and privacy practices.
After an Android system update, VPN client update, or app reinstall, recheck the list and run the same basic comparison again. A removed app may no longer appear, a profile copy may have a different entry, and the client’s controls may have moved. Keep the distinction clear: Android and the VPN client determine how the rule is applied, while each app and its service determine whether the resulting connection works.