How to Set Up Split Tunneling on Android Using NetGuard (No Root)

Many Android users run a VPN to protect their traffic, but a full‑device VPN can slow down local services, break certain apps, or consume extra data on limited plans. Split tunneling lets you decide which apps go through the VPN and which use the regular network. This tutorial shows how to achieve reliable split tunneling on any Android phone without rooting, using the open‑source firewall NetGuard.

Why Split Tunneling?

When a VPN encrypts all traffic, it adds latency and can interfere with services that need a local network connection (e.g., Chromecast, local file servers, or certain banking apps). Split tunneling solves two common problems:

• Performance: Bandwidth‑heavy apps like streaming or gaming stay on the fast Wi‑Fi or cellular link.
• Compatibility: Apps that block VPN traffic can run normally while the rest of your device stays protected.

Android does not ship a built‑in split‑tunneling UI for most VPN protocols, so a third‑party solution is needed. NetGuard provides a user‑friendly way to create per‑app firewall rules and works together with any VPN that uses Android’s VPNService API.

Before You Start

• Charge your device to at least 50 % (the process may take several minutes).
• Connect to a stable Wi‑Fi network; you’ll need internet access to download NetGuard.
• Enable Developer options (Settings > About phone > Tap Build number seven times) – you won’t need ADB, but having the option handy helps with troubleshooting.
• Back up any critical data. The steps modify network routing but do not erase files; however, mis‑configured firewall rules can temporarily block app updates.

Step 1 – Install NetGuard

When you toggle NetGuard on for the first time, Android will ask for permission to set up a VPN connection. This is normal – NetGuard creates a local VPN that only forwards traffic according to the rules you define.

Step 2 – Connect Your Regular VPN

At this point, all traffic on the device is routed through the VPN. We will now use NetGuard to carve out exceptions.

Step 3 – Enable NetGuard’s "Allow VPN" Option

NetGuard can be set to either block all traffic (default) or allow traffic only for selected apps. To make split tunneling work, we need to let the VPN run but prevent it from handling traffic from apps we want to keep on the regular network.

Now you have two VPN layers: the outer layer (your actual VPN) and the inner layer (NetGuard). NetGuard decides which packets are allowed to pass to the outer VPN.

Step 4 – Define Apps That Should Bypass the VPN

Each app in NetGuard has two toggle columns: Wi‑Fi and Cellular. With the Allow VPN option enabled, the toggles act as exceptions – turning them ON lets the app use the regular network, turning them OFF forces the app’s traffic through the VPN.

Tip: If you’re unsure which apps need VPN protection, start with a minimal set (e.g., banking, email) and expand as needed.

Step 5 – Verify the Split‑Tunneling Behaviour

Testing is essential to confirm that traffic is flowing as intended.

Alternative Approaches

NetGuard works on Android 5.0+ and does not require root. However, newer Android versions (13 and above) include a native per‑app VPN setting for some VPN protocols.

• Built‑in per‑app VPN (Android 13+): Open Settings > Network & internet > VPN, tap the gear icon next to your VPN profile, and toggle Allow app to use VPN for each app. This method is limited to VPNs that expose the option.
• Other firewall apps: Apps like AFWall+ or iptables‑manager require root, offering more granular control but at the cost of device warranty and complexity.

If NetGuard’s UI feels cramped on a small screen, you can also manage rules via the adb shell command settings put global netguard_enabled 1, but this is rarely needed for typical users.

Troubleshooting

1. VPN disconnects after enabling NetGuard

NetGuard creates its own VPN interface; some VPN apps do not support being wrapped inside another VPN. If you see the VPN icon disappear:

• Disable NetGuard, reconnect the original VPN, then re‑enable NetGuard.
• Check the VPN app’s logs (often found under Settings > Advanced) for messages about "VPN service conflict".
• If the conflict persists, consider switching to a VPN that uses the WireGuard protocol, which is known to coexist well with NetGuard.

2. Some apps still route through the VPN despite being marked as bypass

• Ensure the app is not using a VPN‑based proxy (e.g., some browsers have built‑in proxy settings). Disable any proxy configuration inside the app.
• Restart the app after changing NetGuard toggles – Android caches the routing decision on launch.
• Check for background services. Some apps spawn a separate process that may have its own NetGuard entry. Toggle the service entry as well.

3. Battery drain increases dramatically

Running two VPN services adds overhead. If you notice a noticeable battery hit:

• Limit the number of apps forced through the VPN – each additional rule adds processing.
• Switch the VPN protocol to a lightweight one (WireGuard is typically more efficient than OpenVPN).
• Enable NetGuard’s Power saving option in Settings > Advanced (this reduces the frequency of wake‑locks for the firewall).

4. No internet connection after toggling NetGuard

This usually means every app is blocked.

1. Open NetGuard’s main screen and tap the Toggle all button (the icon with four squares). This quickly enables Wi‑Fi and Cellular for all apps.
2. If you need a stricter rule set, re‑apply the selective toggles one by one.

Safety and Privacy Considerations

• Data leakage: Bypassed apps send traffic unencrypted unless they use HTTPS. Avoid routing sensitive apps (banking, password managers) through the bypass.
• Legal compliance: Some corporate VPN policies forbid split tunneling because it can expose internal resources. Respect your organization’s rules.
• App updates: When an app updates, its package name stays the same, but its internal network behaviour may change. Re‑verify the split‑tunneling settings after major updates.

Wrap‑Up

By combining a regular VPN with NetGuard’s per‑app firewall, you gain full control over which traffic is encrypted and which stays on the native network. The steps above work on any Android device without rooting, and they can be adapted to different VPN providers or to the newer built‑in per‑app VPN feature on Android 13+. Remember to test each app after configuration, keep an eye on battery impact, and always keep sensitive apps inside the VPN tunnel.

With split tunneling in place, you’ll enjoy faster local streaming, smoother gaming, and the peace of mind that your private data remains protected when it matters most.