SMART DIGITAL TOOLS / PERSONAL VPN DECISIONS
NordVPN Split Tunneling: When to Allow an App Outside the VPN
Split tunneling is an exception to your VPN route, not an extra layer of protection. For personal use, leave it off unless you can name a specific app that needs a direct connection—and explain what you are comfortable sending that way.
By Smart Digital Tools · Sources checked 26 October 2026, Australia/Melbourne.
Research-based guidance, not a hands-on security or performance test. We have not tested the app combinations described below.
Affiliate disclosure: The NordVPN button below is an affiliate link. Smart Digital Tools may earn a commission if you purchase through it. This does not determine our routing advice. Read our affiliate disclosure.
The short decision: a specific exception, or no exception
Our recommendation is to start with the narrowest problem, not the longest exclusion list. Consider an exception only when one identified personal app has a compatibility problem and a direct connection is acceptable for that app. If the requirement is that no app should deliberately use a route outside the VPN, exclusions do not fit that requirement.
Before changing anything, write one sentence: I want this particular app to connect directly because… If you cannot finish it without saying “maybe it will be faster” or “a tutorial said to,” first investigate the actual problem. We have no speed measurements supporting that change.
Still deciding between a device app and a browser extension? Start with our NordVPN app versus browser extension guide; their coverage is a separate decision.
What goes outside the VPN?
NordVPN describes app exclusions as sending selected traffic through the ordinary internet connection rather than its VPN tunnel. That traffic uses the direct connection’s IP address instead of the VPN server’s address. Browser-extension website exclusions are a different scope from excluding an entire app. See the official split-tunneling overview.
Outside the VPN does not automatically mean every byte is readable: an app or website may still use HTTPS. Conversely, a VPN is not a replacement for HTTPS or a promise of complete anonymity. NordVPN’s personal VPN explanation distinguishes these limits.
The useful question is therefore not “Is this app trusted?” It is “Do I intentionally want this app’s connection outside the VPN?” Trusting an app and choosing its network route are different decisions.
Check the platform before following a tutorial
- Windows 10/11, Android and Android TV: NordVPN documents app exclusions. Use the current instructions for your client, not screenshots from another operating system.
- Linux: its documented Allowlist uses ports, port ranges or subnets rather than the same app picker. Matching traffic bypasses both the VPN and Kill Switch, in both directions. Do not translate an app-exclusion tutorial into a broad Linux rule.
These distinctions come from NordVPN’s split-tunneling support guide.
macOS and iOS: NordVPN’s current local-device connection guidance says app split tunneling is not available on these platforms. A casting or local-network discovery problem is not proof that you need an app exclusion.
Use a one-exception worksheet
This is our planning checklist, not a NordVPN feature or a tested configuration. Complete it before adding an exception:
- Exact app: record its name and the executable or package you intend to select. Do not guess between similarly named helper processes.
- Observed problem: describe what fails and what success would look like. “One app cannot connect” is more actionable than “the internet feels wrong.”
- Acceptable exposure: decide whether a direct connection for that app’s activity is acceptable. If you cannot tell what it sends, stop and investigate.
- Scope: ask whether the proposed exception is broader than the problem. Excluding a whole browser to address one website deserves particular caution.
- Exit condition: choose when to remove the exception—for example, when the compatibility issue is resolved or the app is no longer used.
Hypothetical example: a personal game launcher has a connection problem. A useful note would identify the launcher, describe the failing action and record why its direct connection is acceptable. It would not automatically exclude your browser, messaging app or every other game. This example is not a report that NordVPN causes or fixes a particular launcher problem.
Two reasons an exclusion may not behave as expected
DNS and connection checks can disagree
NordVPN’s support guide notes that an excluded app can see the ISP connection’s IP while the computer still uses NordVPN DNS. Some apps can encounter location or connection problems as a result. An exclusion is therefore not a guaranteed compatibility fix.
Kill Switch interactions need platform-specific checking
NordVPN separately documents possible Internet Kill Switch conflicts with excluded apps, including lost connectivity. Its Linux Allowlist documentation explicitly describes bypassing Kill Switch. Do not treat either description as a universal behaviour matrix for every client and version.
Our conservative recommendation is not to disable a protection merely to make an exception work. Remove the exception and consult current guidance for your exact client if the interaction is unclear. We have not independently tested these combinations.
Check the change without mistaking it for a security audit
If you decide to proceed, record the original setting so that you can restore it. Change one exception at a time, then check the specific failing action in that app. Separately check an app you intend to keep within the VPN route. Avoid entering sensitive information just to demonstrate that a connection works.
A public IP-check page in one browser shows evidence about that browser’s request—not proof of how every other app, helper process or DNS request is routed. A successful login or video playback is likewise a compatibility observation, not a leak test.
Review the exception after reconnecting, changing networks or updating the client. If you cannot establish that the result matches your intention, restore the original setting rather than expanding the exclusion list. These are our cautious review steps, not a claim that we verified your device’s traffic.
Before buying for this feature
This guide concerns personal use. Nord’s General Terms, dated 10 August 2026 when checked, describe individual-consumer, personal and non-commercial use and require prior written consent for commercial use of the software. The NordVPN Additional Terms also apply. Do not treat this article as permission for a business deployment.
We quote no price or discount because we have not verified your checkout. Check the currency, total for the full billing period, applicable tax and renewal terms before paying. Do not buy solely for a feature that your operating system does not support.
Bottom line: the best exception list may be an empty one. Consider NordVPN only if its supported platform, routing options and current terms fit your personal needs—not because exclusions promise more speed or complete protection.
How this guide was prepared
We reviewed the official feature, support and terms pages linked above. Product statements are separated from our decision checklist and hypothetical example. No device traffic capture, DNS-leak test, speed benchmark or paid subscription test was performed for this article. Features and terms can change; recheck the linked instructions before altering your setup.
For more context on research-led recommendations, see our evaluation methodology. The affiliate relationship does not turn an untested configuration into a verified result.