How to Set Up Split Tunneling on Android

Many Android users run a VPN for privacy, streaming, or corporate access, but a full‑device VPN can slow down local services, increase data usage, or block certain apps that don’t need protection. Split tunneling lets you choose which apps go through the VPN while the rest use your normal internet connection.

Before you start

• Make sure your device is charged to at least 50 % or plugged in.
• Connect to a stable Wi‑Fi or mobile network – you’ll need internet access to download VPN profiles.
• Identify the apps you want to protect. Write down their package names (e.g., com.netflix.mediaclient) – you’ll need them later.
• Back up important data. Changing VPN settings rarely corrupts data, but a full device reset may be required if something goes wrong.

Understanding Android’s split‑tunneling options

Android itself does not expose a universal split‑tunneling UI, but three practical paths exist:

1. Per‑app VPN via Work Profile (Android 9+) – the system lets a device‑owner app (often a corporate VPN) decide which apps use the VPN.
2. Third‑party VPN apps with built‑in split tunneling – WireGuard, OpenVPN Connect, and many commercial VPNs include a per‑app selection screen.
3. OEM‑specific features – Some manufacturers (e.g., OnePlus, Xiaomi) add a “App VPN” or “Split tunneling” toggle in their settings.

This tutorial covers the first two methods because they work on any stock Android device.

Method 1 – Using a Work Profile (Android 9 and later)

A Work Profile isolates apps and data from the personal side of the phone. When you set a VPN as the “Work profile VPN,” only apps installed in that profile will route through it. This is the most reliable way to achieve split tunneling without third‑party software.

Method 2 – Using a VPN app that supports per‑app split tunneling

If you prefer not to create a work profile, many modern VPN clients let you pick apps directly. The steps below use WireGuard as an example because it’s open source, lightweight, and offers a clear per‑app UI. The process is similar for OpenVPN Connect or commercial VPNs that expose a “Split tunneling” option.

Alternative: Using a commercial VPN with built‑in split tunneling

Many paid VPN services (e.g., NordVPN, ExpressVPN, Surfshark) add a “Split tunneling” screen in their Android app. The workflow is usually:

1. Install the provider’s app from the Play Store.
2. Log in and connect to a server.
3. Open the app’s Settings → Split tunneling (or App exclusions).
4. Select apps to exclude from the VPN or apps to force through it, depending on the UI.
5. Save and reconnect.

Because the UI varies, consult the provider’s help page for exact wording. The advantage is a single‑click solution and automatic updates.

Troubleshooting common issues

1. Apps still use the regular network

• Check the routing rules – on WireGuard, open the tunnel details and confirm the selected apps appear under Allowed apps.
• Restart the app – some apps cache network routes on launch. Close it from Recents and reopen.
• Verify VPN is active – the system status bar should show the VPN icon. If not, toggle the tunnel off/on.

2. VPN disconnects when the protected app goes to background

Android may stop “always‑on” VPN for battery saving. To prevent this, enable Always‑on VPN in Settings → Network & internet → VPN → [Your VPN] → Always‑on VPN. Note that some VPN apps override this setting; consult the app’s documentation.

3. DNS leaks on non‑protected apps

When only some apps use the VPN, the system DNS resolver may still use the VPN’s DNS for all apps, causing leaks. To avoid this:

• In WireGuard, add DNS = 1.1.1.1, 8.8.8.8 under the [Interface] section – this forces DNS for the tunnel only.
• On devices with Android 10+, go to Settings → Network & internet → Private DNS and set it to off if you rely solely on the VPN’s DNS.

4. Work Profile not available on your device

Some OEMs hide the work profile feature on consumer‑grade devices. In that case, fall back to Method 2 (per‑app VPN apps) or consider installing the open‑source “Island” app, which creates a sandbox similar to a work profile without needing enterprise enrollment.

Safety and privacy considerations

• Data leakage: Split tunneling defeats the purpose of a full‑device VPN for apps you forget to add. Periodically review the allowed‑apps list.
• Legal compliance: Some corporate policies forbid split tunneling because it can expose internal traffic. Ensure you have permission before configuring a work‑profile VPN.
• Battery impact: Running two network stacks simultaneously can increase power draw. Monitor battery usage in Settings → Battery → Battery usage after setup.

Wrap‑up

Split tunneling on Android is achievable through a work profile, a VPN client with per‑app routing, or OEM‑specific settings. By following the steps above you can protect sensitive apps, keep local services fast, and retain control over your data flow. Remember to test each protected app, keep your VPN configuration up to date, and revisit the allowed‑apps list whenever you install new software.