Split tunneling: how to send only the apps you choose through a VPN

Split tunneling is what apps call a “split tunnel” or “exclusions”: not all traffic goes through the VPN, only part of it. Below: how it works, which modes exist, how to turn it on on Android and where the traps are. Everything here is as of 10 October 2026.

What split tunneling is

Normally a VPN takes all of a device's traffic: every app goes online through the server. Split tunneling divides the traffic in two: one part goes through the tunnel, the other goes directly, from your usual address, as if the VPN were off.

Why you would want it:

• Services that refuse foreign addresses. Banks, government services and marketplaces often expect a Russian address; outside the tunnel they see your real one. Why that happens — the article on banks and Gosuslugi.
• Games and calls that do not need the tunnel. An extra hop to the server adds latency: when a VPN helps games and when it hurts.
• The local network. A printer, a TV or a home NAS is sometimes invisible from inside the tunnel.
• The other way round: protect just one thing. For example only the browser, leaving everything else as it is.

By app or by site: two ways to split

By app. You pick programs: these through the tunnel, those outside. The system decides by which app sends the packet. Reliable and clear, but it is the whole app: you cannot split a browser into “this site through the tunnel, that one not”.

By address (what people call “by site”). You set a list of IP addresses or subnets, and traffic to  them goes only through the tunnel or only outside it. The catch: a site is a name, while the rule works on addresses; big services have many addresses and they change. For example, per AmneziaVPN's documentation a site name is turned into an address once and never refreshed, so they advise listing the service's subnets rather than its name.

Both ways have two modes:

• “Only selected” — only the chosen apps or addresses go through the tunnel; everything else goes directly.
• “All except selected” — everything goes through the tunnel and the chosen ones go outside. This mode is safer by default: an app you install tomorrow is protected straight away.

How Android does it

Per-app splitting is built into Android itself, with rules that are the same for every VPN app. Per the Android documentation:

• the VPN app sets either an allowed list or a disallowed list, not both; with no lists, all traffic goes into the tunnel;
• the lists are set before connecting; to change anything you have to connect again;
• only an installed app can be added to a list.

Hence the main practical tip: changed the preset — tap “Disconnect” and “Connect”. Otherwise the change does not take effect, and it looks as if the setting “does not work”.

How to turn on the split tunnel in Mayak

1. Open Settings → Split tunneling. A list of presets appears: the ready “RU Apps” (marked as default) and  yours, if you have any.
2. To make your own, tap “＋ New preset”. To adjust the ready one, select it and tap “Edit”: the default preset is saved as your copy and the original stays untouched.
3. In the editor, pick a mode: “All apps”, “All except selected” or “Only selected”, tick the apps (there is a search and a counter) and save.
4. Select the preset and reconnect: the preset applies on the next connection.

The ready “RU Apps” preset sends Russian banks, Gosuslugi, marketplaces and Russian streaming services outside the tunnel; the list comes from our server and updates itself. If you are in Russia, the app may switch it on by itself on first launch and tell you with a hint. More — in the help centre.

Presets also show on the home screen, above the connect button; if you hid that strip, the “Show presets on the home screen” setting brings it back. Presets are an account setting: on a new phone they arrive from the server after you sign in. Mayak splits by app only, not by site or address.

Split tunneling in Amnezia and Happ

AmneziaVPN. Per the project's documentation, splitting by address is available on every system and by app only on Android (both modes) and Windows (only “outside the VPN”); on iPhone, Mac and Linux — by address only. The same page lists caveats: IPv6 is not supported in the rules, a site name is turned into an address once, and the free Amnezia Free does not offer splitting by address. How to set Amnezia up in general — “Amnezia VPN: how to set it up”.

Happ. In Happ the rules are set by routing inside the app or come from the provider with the subscription. Our subscription link carries no such rules: all Happ gets from us is servers. How per-app splitting works in Happ on  different systems we have not checked.

Traps: when split tunneling “does not work”

• You changed the preset but did not reconnect. Android applies the lists only when connecting.
• “Block connections without VPN” is on. This Android system mode lets no traffic past the tunnel. Per the  Android documentation, with it apps outside the tunnel lose the network — so an excluded bank simply will not open. We have not tested this combination on a phone ourselves. What the mode is — the article on always-on VPN.
• An app goes through another one. If a program opens a link in a built-in browser or through system services, the traffic may follow the rule of whoever actually sends it.
• The service recognises you by more than the address. Outside the tunnel a bank sees a Russian address, but if it also looks at the phone's time zone or language, the split tunnel does not change that.
• An address rule is stale. The service changed its addresses, the list did not.

What we checked

• Android's rules on app lists and on “Block connections without VPN” — from the developer documentation, 10 October 2026.
• Mayak's split tunnel — from the code of version 1.0.0: item names, three modes, the default preset, applying on the next connection, splitting by app only.
• AmneziaVPN — from the project's documentation, 10 October 2026.
• Our subscription link — from the server code: it carries no routing rules.

What we do not know

• The combination with “Block connections without VPN” on a real phone. We go by the Android documentation; brands may behave differently.
• The 1.0.0 screens step by step. Names are checked against the app's code; we did not walk the screens on  a phone this time.
• Splitting in Happ and INCY, including on iPhone.
• How a particular app will behave outside the tunnel on your network.

Short answers

What is a split tunnel? The same as split tunneling: part of the traffic through the VPN, part directly.

How do I use a VPN for just one app? The “Only selected” mode with one app ticked. In Mayak: Settings → Split tunneling → new preset → “Only selected” → reconnect.

How do I turn the VPN off for certain apps? The “All except selected” mode: the ticked apps go outside the tunnel, everything else through it.

How do I set up split tunneling in Amnezia? AmneziaVPN's settings have site (address) splitting and app splitting; app splitting only on Android and Windows. Details are in the project's documentation.

Can I split by site rather than by app? Yes, if your VPN app supports address rules. Mayak splits by app only.

Why does split tunneling not work? Most often the preset was changed without reconnecting, or Android's “Block connections without VPN” is on. Other causes — in the traps section.

Is it safe to let apps go outside the tunnel? For them it is as without a VPN: the ISP sees where they go, and sites see your address. So let outside only what does not need the tunnel.