Split tunnelling on Android: keep some apps outside the VPN

Split tunnelling (often spelled "split tunneling") lets you choose which apps use the VPN and which go straight to the internet as if the VPN were off. On Android it works per app: the VPN app hands the system a list of apps to leave out when it builds the tunnel, and everything else is routed through. There is no system settings page for it; the list lives inside the VPN app, and it takes effect on the next connect.

How it works on Android

When a VPN app connects, it asks Android to create a virtual network interface and route traffic into it. As part of that request it can pass a list of apps, in one of two forms:

• An exclude list. Every app goes through the tunnel except the ones named. Android calls this a disallowed list.
• An allow list. Only the apps named go through the tunnel; everything else uses the ordinary network.

An app must pick one form. Android does not let a VPN combine both in one tunnel. Whichever form is used, the list is fixed for the life of that tunnel, so changing it means tearing the tunnel down and building it again, which is why toggling an app in the VPN's settings causes a short reconnect.

One app can never be on either list: the VPN app itself. Its traffic to its own server has to leave the phone outside the tunnel or the tunnel could not exist, and Android handles that for it. If a VPN app let you exclude it, you would cut off the control connection it uses to set up and monitor the tunnel, and it would look exactly like a dead server.

Exclude list or allow list

The two forms sound symmetrical and are not.

With an exclude list, the default is protected. An app you install next month is inside the tunnel from its first launch, because nobody added it to the list of exceptions. The only apps outside are the ones you chose.

With an allow list, the default is exposed. A new app is outside the tunnel until you remember to add it, and there is no prompt to remind you. Over time the list of apps you actually use drifts away from the list you set, and the drift is always in the direction of less protection.

For a personal phone, where the whole point of the VPN is that traffic stays private by default, the exclude list is the right form. The allow list suits the reverse case, such as a work VPN that should carry one or two corporate apps and nothing else. A VPN aimed at ordinary users should offer the exclude list, and it should be honest that this is what it offers.

What an excluded app actually sees

An excluded app behaves as if there were no VPN at all:

The last row surprises people. Android's kill switch applies to traffic that would have gone through the VPN; an excluded app was never going to, so it is not blocked when the tunnel is down. Every app you exclude is also an app you have exempted from the kill switch. Block connections without VPN covers the rest of that setting.

The DNS row matters too. An excluded app's lookups go to whatever resolver the Wi-Fi or carrier hands out, so the names it looks up are visible to that network. The interaction with Android's Private DNS setting is its own topic; see VPN and Private DNS.

Setting it up

The exact screen differs by app, but the shape is the same:

1. Open the VPN app's settings and find split tunnelling, excluded apps, or a similar label.
2. Choose the apps to leave outside the tunnel. Which apps to exclude has the usual short list.
3. Save. If the VPN is connected, expect it to reconnect within a few seconds.
4. Check the result: open the excluded app and, if it shows your address anywhere, confirm it is your real one; open the browser, which is still inside, and confirm it shows the VPN's exit IP. Does a VPN hide your IP address explains what each address means.

What it cannot do

Android's per-app split is exactly that: per app. You cannot send one website through the VPN and another around it from the same browser, and you cannot exclude a single feature of an app, such as a payment screen. You also cannot exclude system components individually; the carrier's own services, for example, are apps like any other and appear in the picker.

One last trap: a list that includes an app you have since uninstalled. Android refuses to build a tunnel that names a package that no longer exists, so a VPN app has to drop stale entries before connecting or every connect attempt fails with no obvious cause. That is the VPN app's job, not yours, but it is worth knowing if a VPN stopped connecting the day after you removed an app.

Culvert VPN uses an exclude list, so any app you install later is inside the tunnel by default and only the apps you name stay out, and it is on Google Play.