How to Set Up Split Tunneling on Android with OpenVPN (No Root)

Many Android users rely on a VPN for privacy, but sending *all* traffic through the tunnel can slow down streaming, gaming, or local network services. Split tunneling lets you choose which apps use the VPN while the rest connect directly. Android does not provide a universal, built‑in split‑tunneling UI (except on a few OEM skins), so we need to combine a VPN client that supports per‑app routing with a lightweight firewall that can enforce the routing.

What You’ll Achieve

• Only the apps you select will send their data through an OpenVPN tunnel.
• All other apps continue to use your normal Wi‑Fi or mobile data, preserving speed and local network access.
• The solution works on Android 8.0 (Oreo) and newer, without rooting the device.

Why Split Tunneling Isn’t Built‑In

Android’s VPN framework treats a VPN connection as a system‑wide tunnel. When a VPN is active, the OS routes 0.0.0.0/0 (all traffic) through it. Some manufacturers (e.g., Samsung, Xiaomi) add proprietary split‑tunneling switches, but the stock Android AOSP implementation does not expose such controls. That’s why we rely on third‑party apps that either:

1. Offer per‑app routing inside the VPN client itself, or
2. Act as a local firewall that can forward selected apps to the VPN while blocking others.

Solution Overview

We will use two free, open‑source tools that work together:

• OpenVPN for Android (by Arne Schwabe) – a full‑featured OpenVPN client that supports App routing (per‑app VPN).
• NetGuard – a no‑root firewall that creates a local VPN interface. It can be configured to route chosen apps through the real OpenVPN tunnel while keeping the rest on the normal network.

Both apps are available on F‑Droid or the Google Play Store. Using them together gives you fine‑grained control without any system modifications.

Before You Start

• Charge your phone to at least 50 % (the process may take a few minutes).
• Connect to a stable Wi‑Fi network – you’ll be downloading two apps and importing a VPN profile.
• Enable Developer options → USB debugging if you ever need to pull logs, but it’s not required for the tutorial itself.

Step 1 – Install the Required Apps

1. Open the Google Play Store (or F‑Droid) and search for OpenVPN for Android.
   • Package name: de.blinkt.openvpn
2. Tap Install and wait for the app to finish.
3. Repeat the process for NetGuard – no‑root firewall.
   • Package name: eu.faircode.netguard

Step 2 – Import Your OpenVPN Profile

1. Launch OpenVPN for Android.

   The first screen shows a list of VPN profiles. Tap the + (plus) icon in the upper‑right corner.

2. Select Import → From .ovpn file.

   Navigate to the folder where you saved your .ovpn file (e.g., Download/) and tap it.

3. Give the profile a recognizable name, e.g., MyVPN – Split, and press Save.
4. Open the newly created profile, scroll down to the App routing section, and enable App routing (per‑app VPN).

   When this option is active, a list of installed apps appears. Tick the checkboxes for every app you want to force through the VPN (e.g., Telegram, Signal, Browser).

5. Tap Save again to store the routing preferences.

Step 3 – Set Up NetGuard as a Local Firewall

NetGuard creates a local VPN interface that can block or allow traffic on a per‑app basis. We will use it to keep non‑VPN apps out of the OpenVPN tunnel.

1. Open NetGuard. The first screen lists all installed apps with a toggle switch.
2. Tap the three‑dot menu (⋮) → Settings → VPN mode and choose VPN (no root).

   This tells NetGuard to operate as a local VPN rather than a system‑wide firewall.

3. Return to the main screen. For each app you did NOT select in OpenVPN’s App routing, turn the toggle ON (green). This blocks those apps from using any network.

   Then tap the app name to open its detailed screen and enable the Wi‑Fi and Cellular icons – this tells NetGuard to allow the app to use the regular network, bypassing the OpenVPN tunnel.

4. For the apps you did select in OpenVPN, leave their toggles OFF in NetGuard. That way NetGuard will not interfere, and those apps will be forced through the OpenVPN tunnel by the per‑app routing rule.
5. Scroll to the bottom of NetGuard’s main screen and enable the global VPN toggle. NetGuard will ask for permission to create a VPN connection – grant it.

Step 4 – Start the VPN Connection

1. Switch back to OpenVPN for Android.
2. Tap the connect icon (green triangle) next to the profile you created.

   The OS will display a standard VPN permission dialog – tap Allow.

3. After a few seconds you should see a key icon in the status bar, indicating the VPN is active.
4. Open any of the apps you marked for VPN routing (e.g., Telegram) and browse to a site that shows your IP address, such as ifconfig.me. The displayed IP should belong to your VPN server.
5. Now open an app you left out of the VPN (e.g., YouTube) and repeat the IP check – it should show your real ISP IP.

Alternative Method – NetGuard‑Only Split Tunneling

If your device’s firmware blocks per‑app routing, you can achieve split tunneling using NetGuard alone. This method does not use the OpenVPN client’s routing feature; instead, NetGuard forwards selected apps to the VPN while the rest use the regular network.

1. In NetGuard, enable the global VPN toggle as before.
2. For the apps you want to protect, tap the app name → enable VPN (the lock icon). This forces NetGuard to route that app’s traffic through the active VPN tunnel.
3. For all other apps, keep the VPN toggle OFF but enable Wi‑Fi/Cellular as normal.
4. Start the OpenVPN connection as described in Step 4. NetGuard will now act as a bridge, sending only the selected apps’ traffic through the tunnel.

This approach works on any Android version that supports NetGuard’s local VPN (Android 5.0+).

Step 5 – Verify DNS Leak Protection

Even with split tunneling, a mis‑configured DNS can expose your true location. Follow these checks:

1. While the VPN is active, open a browser on a VPN‑routed app and visit dnsleaktest.com.

   If the DNS servers listed belong to your VPN provider, the tunnel is handling DNS correctly.

2. Repeat the test on a non‑VPN app. You should see your ISP’s DNS servers.
3. If you notice the same DNS servers on both tests, go to OpenVPN for Android → Advanced → Use custom DNS and specify the VPN’s DNS (often 10.8.0.1 or the provider’s address).

Step 6 – Fine‑Tuning and Battery Considerations

• Battery impact: Running two VPN‑like services (OpenVPN + NetGuard) consumes extra CPU. If you notice rapid drain, try disabling NetGuard’s Log option in Settings → Log traffic (turn it off).
• App updates: When an app updates, its package name stays the same, but Android may reset its network permissions. Re‑check NetGuard’s toggles after major updates.
• Data usage monitoring: Both apps show traffic counters. Use them to ensure the VPN‑routed apps are not accidentally sending large amounts of data when you’re on a metered connection.

Troubleshooting Common Issues

Safety and Privacy Checklist

• Always download OpenVPN for Android and NetGuard from trusted sources (Google Play or F‑Droid).
• Back up your .ovpn file to a secure location before editing.
• After configuring split tunneling, run an IP and DNS leak test on each app category.
• If you plan to use this setup on public Wi‑Fi, enable the VPN’s Kill switch (OpenVPN for Android → Settings → “Block connections without VPN”).

Wrapping Up

By combining OpenVPN for Android’s per‑app routing with NetGuard’s firewall capabilities, you obtain a robust split‑tunneling solution that works on most Android devices without requiring root access. The workflow is repeatable: import the VPN profile, define the apps, configure NetGuard, and verify both IP and DNS. Should any step fail, the troubleshooting table offers quick fixes, and the safety checklist helps you keep your privacy intact.

Enjoy the best of both worlds – the privacy of a VPN for sensitive apps and the speed of your local network for everything else.