VPNInfobaseSplit tunneling lets some apps or addresses bypass the VPN while the rest use it. The risk is simple: whatever you exclude uses your own connection and shows your own IP address, as Mullvad’s help page puts it, “Your own IP address will be exposed.” Platform support differs by vendor. Of the four we could read, all list Windows, macOS, Linux and Android in some form, Windscribe and Mullvad say iOS has none, and ExpressVPN lists a limited form on iOS. The table below is from each vendor’s own pages, read on 2 October 2026.
Who supports it where
| Attribute | Windows | macOS | Linux | Android | iOS | Notes from the vendor’s own page |
|---|---|---|---|---|---|---|
| Mullvad | Yes | Yes | Yes | Yes | None (iOS and iPadOS lack split tunneling) | macOS cannot exclude Safari or WebKit-based apps; Windows Store apps cannot be excluded; some anti-cheat games and Java apps do not work |
| Proton VPN | Yes | Yes, “experimental” | Yes, GUI app on Ubuntu, Fedora and Arch builds | Yes | Not listed | Paid plans only; macOS works with WireGuard and Stealth, not IKEv2; does not work with WebKit apps such as Safari; browser extensions use domain rules; on most platforms not compatible with the kill switch (Windows can use it) |
| Windscribe | Yes | Yes | Yes | Yes | None | Exclusive mode (listed apps bypass) and inclusive mode (only listed apps use the VPN); iOS lacks it because Apple allows it only in a managed (MDM) setup, which Windscribe says it will not use |
| ExpressVPN | Windows 10 and 11, apps and websites | macOS 11 and later | 64-bit Linux | Android 7.0 and later | “Available” by excluding single IPv4 addresses | Options differ by device: app rules, website rules or both; routers and smart TVs listed as supported |
NordVPN, Surfshark, IVPN and PIA are missing: NordVPN’s help pages are blocked to our reader, our Surfshark and IVPN fetches returned the wrong or no page, and PIA’s help page was blocked. A blank is not a “no”.
What actually changes, and the risks
- Your IP address. Excluded apps use your normal connection. A banking app or a game that blocks VPN traffic will see your real IP; so will anything you exclude by mistake.
- DNS may still go through the VPN. Mullvad says an excluded app “will still use the DNS server on the Mullvad server that you are connected to”, and its 2021 post notes requests are sent inside the tunnel even for excluded apps, which can send a game to a distant server. ExpressVPN says DNS queries “should go through ExpressVPN’s servers, no matter how you configure your split-tunneling settings”. The behaviour is the vendor’s description, not our test.
- Kill switch interplay. Proton states split tunneling is not compatible with its kill switch on most platforms, with Windows an exception. Check this before relying on both.
- Software conflicts. Mullvad’s 2021 post says split tunneling can stop working on Windows when several network drivers, such as firewalls or proxies, compete, and that excluded Linux connections depend on the tunnel’s lifetime.
- Excluding by IP is unreliable for big sites. ExpressVPN says excluding specific addresses “will not work reliably for large websites” because they use many changing addresses, and warns that listing public IPs can be a privacy risk.
Choosing
Use split tunneling when one app needs your local IP, such as a banking or work app that rejects VPN addresses, and keep everything else in the tunnel. Do not use it as a speed fix without checking what the excluded app exposes: see does a VPN slow down your internet. On a router, the whole network shares one tunnel; see best VPN for routers. Provider-level facts (audits, owners, refunds) are in the audit tracker and refund policies compared; basics are in how does a VPN work.
Method
Researched from vendor help pages for Mullvad, Proton VPN, Windscribe and ExpressVPN, read on 2 October 2026, and Mullvad’s 2021 blog post. Statements are the vendors’ descriptions of their own apps; we did not test any app, and apps and operating systems change, so confirm in the app before relying on a setting. We make no claim about speed. Reviewed every 90 days. NordVPN is the one provider we earn commission on (disclosure).