Set Up Split Tunneling for a VPN on Android (No Root)

Many Android users run a VPN to protect their traffic, but sending all data through the tunnel can slow down gaming, video calls, or local network access. Split tunneling lets you choose which apps go through the VPN and which connect directly to your carrier or Wi‑Fi. This tutorial walks you through a reliable, no‑root method using popular VPN clients that support per‑app routing.

Before you start

• Charge your device to at least 50 % – a VPN connection can consume battery quickly.
• Ensure you have a stable Wi‑Fi or mobile data connection for the initial download of the VPN app.
• Identify the apps you want to protect (e.g., banking, email) and those you want to keep on the regular network (e.g., games, local file sharing).
• Have your VPN provider’s configuration files ready – typically a .conf for WireGuard or an .ovpn for OpenVPN.

Method 1 – Using the WireGuard App (Recommended for Android 10+)

Why WireGuard?

WireGuard’s Android client includes a built‑in Allowed Apps list. When you enable this list, only the selected apps will send traffic through the tunnel; everything else bypasses the VPN. The implementation works on Android 10 and newer, where the OS permits per‑app VPN routing.

Step‑by‑step

1. Install WireGuard
   • Open Google Play Store, search for WireGuard, and tap Install.
2. Import or create a tunnel
   • Launch WireGuard.
   • Tap the + button → Add tunnel → Import from file….
   • Select your .conf file supplied by the VPN provider.
   • Tap Save. The tunnel appears in the main list.
3. Enable per‑app routing
   • Tap the tunnel name to open its details.
   • Scroll to the Allowed Apps section.
     • If you see All apps selected, tap it to deselect.
     • Tap Add app and choose each app you want to protect (e.g., BankApp, Email).
   • Confirm the selection and return to the main screen.
4. Activate the tunnel
   • Toggle the switch next to the tunnel name. A VPN key icon appears in the status bar.
   • Open one of the allowed apps and verify that traffic is encrypted (most apps will show a lock icon or you can check the IP via a web service).
5. Test the split behavior
   • Open a non‑allowed app (e.g., a local game) and visit a speed‑test site. You should see your carrier’s IP, confirming the app bypassed the VPN.

Troubleshooting WireGuard

• Apps not appearing in the list – Some system apps are hidden from the picker. You can still route them by selecting the android.permission.INTERNET‑using wrapper app, but this is advanced and not recommended for beginners.
• VPN disconnects after screen lock – Ensure Always-on VPN is disabled for WireGuard (Settings > Network & Internet > VPN > WireGuard > Disable “Always-on”).
• No traffic for allowed apps – Verify the tunnel is active and that the server’s firewall permits the app’s traffic. Check the WireGuard log via the app’s Log button.

Method 2 – Using the OpenVPN for Android App

Why OpenVPN?

OpenVPN for Android (by Arne Schwabe) offers a Routing section where you can specify --route-nopull and then add per‑app --route statements. This approach works on Android 7+ but requires a bit more manual configuration.

Step‑by‑step

1. Install OpenVPN for Android
   • Open Play Store, search OpenVPN for Android, install.
2. Import your .ovpn profile
   • Launch the app, tap the + icon, choose Import and locate your .ovpn file.
   • Give the profile a recognizable name and tap Save.
3. Edit the profile for split tunneling
   • Tap the profile name → Edit.
   • Scroll to Advanced Settings → Custom Options.
   • Add the line --route-nopull. This tells OpenVPN not to push the server’s default route.
   • Now add a line for each network you still want to send through the VPN, e.g.,

     --route 10.0.0.0 255.0.0.0

     (replace with your VPN’s internal subnet).
   • Below those lines, add per‑app routing using the app’s Allowed Apps field:

     --app-allow com.bank.app
     --app-allow com.email.client

     (use the exact package name; you can find it in Settings > Apps > App info → Package name via a third‑party app like App Inspector).
4. Save and connect
   • Tap the check‑mark to save the edited profile.
   • Return to the main screen and tap the profile to connect.
5. Verify the split
   • Open a protected app and check its IP on https://ipleak.net. It should show the VPN’s IP.
   • Open a non‑protected app (e.g., a local video player) and verify it shows your carrier’s IP.

Troubleshooting OpenVPN

• Connection drops immediately – Double‑check that you added --route-nopull on a new line and that there are no stray spaces.
• Allowed apps are ignored – The app requires Android 7.0 or later. On older devices the per‑app option is silently ignored.
• No internet on allowed apps – Ensure the VPN server’s firewall allows traffic from the subnet you routed (the --route line).

Alternative Approaches When Your VPN App Lacks Split Tunneling

If you already use a VPN that does not expose per‑app routing, you have two practical options:

1. Use a third‑party wrapper app – Apps like VPN Manager or NetGuard can create a local VPN interface and forward traffic only for selected apps to your existing VPN. The setup is more involved and may introduce latency.
2. Switch to a VPN provider that offers split tunneling natively – Many commercial VPNs (e.g., NordVPN, Surfshark) ship Android clients with a built‑in “App Split Tunneling” toggle. The steps are usually: Settings > Split tunneling > Select apps.

Safety and Privacy Checklist

• Never enable Always‑on VPN together with split tunneling unless you understand that the OS may force all traffic through the tunnel, overriding per‑app rules.
• Review the VPN provider’s logging policy – split tunneling does not hide the fact that you are using a VPN from the provider.
• After configuring split tunneling, run a DNS leak test (https://dnsleaktest.com) from both a protected and an unprotected app to ensure the routing works as expected.

Putting It All Together

Split tunneling on Android is a powerful way to keep latency‑sensitive apps fast while still protecting sensitive traffic. By using WireGuard’s native Allowed Apps list or configuring OpenVPN manually, you gain granular control without rooting your device. Remember to test each app after setup, keep a backup of your VPN configurations, and stay aware of any provider‑side restrictions.

Now you can enjoy a faster gaming experience, reliable local network access, and the peace of mind that your banking and email traffic stay encrypted.