VPN Split Tunneling: What It Is, Why You Need It, and How to Set It Up

What is split tunneling in simple terms

Imagine a tunnel under a river connecting your neighborhood to another city. Without split tunneling, your GPS sends every car into the tunnel, even the one going to the grocery store across the street—it dives under the river, turns around on the other side, and comes all the way back. With split tunneling, the GPS looks at the destination and routes local traffic through normal streets, only sending cars into the tunnel if they actually need to cross the river.

VPNs work exactly the same way. The tunnel is an encrypted connection to a server in another country. Your VPN client can send every connection your device makes through this tunnel, route it directly through your ISP, or block it entirely. This is called split tunneling. In app interfaces, you might also see it labeled as routing, exclusions, or per-app proxy.

When the feature is off, everything goes through the VPN. This is the simplest and most private mode: your ISP only sees your connection to the VPN server. When you turn it on, a portion of your traffic accesses the internet using your real IP address, exactly as it would without a VPN.

Why you need it for Russian services

A Russian service doesn't see you; it sees the VPN server's IP address. If the server is abroad, your login looks like it's coming from another country. What happens next depends on the service's rules.

• Banks treat logins from unusual countries as a fraud risk. They might ask for extra verification, limit your operations, or block access entirely.
• Gosuslugi and other government websites sometimes block access from foreign IP addresses altogether.
• Marketplaces, taxi apps, and delivery services determine your city by your IP address, showing you the wrong region.
• Due to licensing agreements, streaming services only show certain content to viewers in Russia.

There is also a simpler reason. When you access a Russian website through a foreign server, the data takes an unnecessary detour. Bypassing the VPN usually makes it load faster. A video call with a colleague in the next office doesn't need to route through another country either.

We explored why banks and Gosuslugi react differently to VPNs—and what to do when nothing works but turning the VPN off—in our article Banks and Gosuslugi Don't Work with VPNs.

Two methods: by app or by address

You can split your traffic based on who is sending it or where it is going. These methods work differently and are available on different platforms.

App exclusions

You select specific apps, and their traffic either bypasses the VPN or is the only traffic that uses it. On Android, this is built into the operating system. When you connect, the VPN app hands Android a list, and the system treats excluded apps as if the VPN is off. This list is either inclusive ('only these apps via VPN') or exclusive ('all apps except these'). You cannot use both at the same time. The list is set when you connect, so if you make changes, you have to reconnect.

The 'all except selected' mode is great for banking and government apps. You pick three or four apps, and anything you install later automatically goes through the VPN. The 'only selected apps' mode works well if you only need a VPN for one or two apps. However, the risk is reversed: new apps will run without the VPN by default, which is easy to forget.

On Windows and macOS, the client handles exclusions by checking which process opened the connection. Not all clients support this, and usually only when the VPN is intercepting all system traffic. On iPhone and iPad, a standard VPN app cannot exclude specific programs. Apple only allows per-app VPN routing on devices managed by an organization via MDM (corporate devices).

Rules for sites and IP addresses

The client looks at the destination address of every connection—a domain like bank.ru or an IP address. If the address matches your 'direct' list, it bypasses the tunnel; everything else goes through the VPN. This is how routing works in Xray and sing-box clients, and it is available on all platforms, including iPhone.

Rules do not care which app opened the connection. Your browser will load gosuslugi.ru directly, while routing a foreign site in the next tab through the VPN. The downside is that you have to manage address lists. They are never perfect, and sometimes you have to add addresses manually.

In practice, it is best to combine both methods. On Android, you can exclude your banking apps entirely while using routing rules for Russian websites in your browser.

What 'Split tunneling disabled' means

This message appears on the main screen of Amnezia VPN, which is why people search for it so often. It simply means all your device's traffic is going through the VPN. This is the default behavior before you set any exclusions, and your connection is working perfectly. Once you configure exclusions, the message changes to 'Split tunneling enabled'.

Amnezia has two separate settings. 'Split tunneling for sites' uses addresses and offers two modes: 'Addresses from the list must not be opened via VPN' and 'Only addresses from the list must be opened via VPN'. 'Split tunneling for apps' is program-based, though on Windows, it only supports the exclude mode. You can only change these settings when the VPN is disconnected; otherwise, the app will show a warning.

If Amnezia says 'The default server does not support split tunneling', the issue is your server configuration. Based on the app's source code, this message appears when your WireGuard or AmneziaWG config already has a restricted address list (the AllowedIPs parameter is not 0.0.0.0/0). In this case, split tunneling is hardcoded into the config itself, so the app disables its own settings.

This exact mechanism applies to any WireGuard client. Splitting is defined by the AllowedIPs string: 0.0.0.0/0, ::/0 sends all traffic through the tunnel, while a list of subnets only routes those specific subnets. WireGuard does not understand domains, so routing 'Russian sites directly' requires massive lists of IP addresses that quickly become outdated. In the official WireGuard app for Android, you can also select specific apps in the tunnel settings.

Incy, Happ, Hiddify, and v2RayTun do not display this message. Split tunneling is enabled via the routing section or the app list. If you haven't configured anything and your provider didn't include a routing profile with your subscription, all traffic goes through the VPN by default.

How rules work: geosite, geoip, and checking order

No one wants to manually list thousands of Russian domains, so Xray-based clients (Incy, Happ, v2RayTun, v2rayNG) use geofiles: geosite.dat containing categorized domain lists and geoip.dat containing IP ranges by country. By default, Happ and Incy pull these from the Loyalsoldier/v2ray-rules-dat GitHub project. Domains are sourced from the open v2fly/domain-list-community, and IP addresses come from the MaxMind GeoLite2 database.

• geosite:category-ru — Russian domains: everything in the .ru, .su, and .рф zones, plus Russian company sites on other domains. For example, it includes yastatic.net, which Yandex uses to host images and scripts.
• geosite:category-gov-ru and geosite:category-bank-ru — narrower lists of government sites and banks. Useful if you don't want to bypass the VPN for everything Russian.
• geoip:ru — IP addresses belonging to Russia according to the database. This catches services hosted on Russian servers but using foreign domains, as well as apps connecting directly to an IP.
• geoip:private — local network addresses: your router, printer, or smart TV. These are almost always routed directly, otherwise your local devices would become unreachable.

Besides categories, you can add specific addresses to a rule. The entry domain:example.ru catches the domain and all subdomains, full:example.ru catches only the exact domain, and IP addresses are written as is or as a subnet, like 192.168.0.0/16.

Rule order and DNS

Rules are checked from top to bottom, and the first match triggers. If nothing matches, the connection takes the default outbound route, usually the VPN. That is why narrow rules are placed above broad ones. Let's say you want one specific .ru site to go through the VPN: its rule must appear before the geosite:category-ru direct rule. In Happ's profile builder, this is the default order: blocks first, then proxy, then direct.

For IP rules, the client needs the server's IP address, but apps usually request domain names. How the client handles this is determined by the domainStrategy parameter. AsIs means the client only checks domains and resolves nothing. IPIfNonMatch checks domain rules first; if none match, it resolves the IP via DNS and runs through the rules again. IPOnDemand resolves the domain as soon as it hits an IP rule. IPIfNonMatch is usually the best choice when combining geosite and geoip.

Clients also split DNS requests. The client asks your direct DNS server for 'direct' site addresses, while everything else goes to the DNS server inside the tunnel. In Happ and Incy profiles, these are managed by the Domestic DNS and Remote DNS fields.

Xray configuration example

If your client lets you edit the configuration manually, rules for Russian sites look something like this. The direct tag must match a direct outbound connection (freedom protocol). Anything that doesn't match a rule goes to the first outbound connection in the list, which is the VPN.

"routing": {
  "domainStrategy": "IPIfNonMatch",
  "rules": [
    { "type": "field", "ip": ["geoip:private"], "outboundTag": "direct" },
    { "type": "field", "domain": ["geosite:category-ru"], "outboundTag": "direct" },
    { "type": "field", "ip": ["geoip:ru"], "outboundTag": "direct" }
  ]
}

Hiddify runs on the sing-box core, where rules work differently: instead of geosite and geoip, it uses rule-sets. For Russia, these can be enabled with a single menu toggle, which we cover in the next section.

Where to configure split tunneling in Incy, Happ, Hiddify, and v2RayTun

Menu names change from version to version, so here is what each client supports and where to find the settings. This information is current as of October 2026. If you use Byte VPN, our dashboard recommends Incy for iPhone and Android, Happ for macOS and Android TV, and Hiddify for Windows.

Incy

Incy supports both methods. Routing profiles with domain and IP rules, plus split DNS, are available on all platforms under 'Routing' in the settings. App selection is available on Android under 'Per-App Proxy'. You can add a profile via a link ('+ Add' → 'Paste'), QR code, or deeplink, and it activates once the geofiles finish downloading. Since October 27, 2026, Incy is no longer in the Russian App Store; see our iPhone guide for details. Based on their documentation, Incy uses the same profile format as Happ. The desktop version is currently in pre-alpha, and the developers warn it might be rough around the edges.

Happ

In Happ, routing rules are tied to your subscription, with each having its own set of profiles. You can easily build a profile in the routing.happ.su builder: it features DirectSites and DirectIp for direct addresses, ProxySites and ProxyIp for the tunnel, and BlockSites and BlockIp for blocking. Changes only take effect after you reconnect. The app list (Per App Proxy) is available on Android, including Android TV, as well as Windows, macOS, and Linux. We cover the rest of the client's features in our Happ review.

Hiddify

Hiddify has a ready-made option for Russia: 'Settings' → 'Routing' → 'Region' → 'Russia (ru)'. Based on the source code, this routes all .ru domains directly, along with addresses from the geoip-ru and geosite-ru rule-sets, which the client downloads and updates automatically. 'Per-app proxy' with 'All', 'Proxy', and 'Bypass' modes is only available on Android in the stable 4.1.1 release. The developers are working on a custom rule editor that includes program names, but it hasn't reached the stable version yet. Other settings are covered in our Hiddify guide.

v2RayTun

In v2RayTun, you edit routing rules directly in the app using the Xray format: domains, IP addresses, and direct, proxy, or block outbounds. The developer documentation includes a Direct Russia example that bypasses .ru domains, geosite:category-ru, and geoip:ru. The location of these settings varies because the Android, iOS, and desktop apps are developed separately.

When split tunneling won't work

The app checks if a VPN is running

An exclusion removes the app's traffic from the tunnel, but the VPN remains active on a system level, and the app can detect this—for example, by checking the device's network connections. If a service refuses to work for this reason, rules won't help. You will have to turn off the VPN while using it.

Exclusions do not make the VPN invisible in other ways, either. In April 2026, a Habr post detailed a flaw in many Xray and sing-box clients: they run a local proxy on the phone without a password, and any app—even those excluded from the VPN—can query it to find your server's IP. The author noted that v2RayTun and Happ developers promised a fix. Incy's settings include a dedicated toggle to protect the local proxy from port-scanning apps. Don't put off updating your clients.

The service uses Russian and foreign IPs simultaneously

Geosite and geoip lists are compiled by people and databases, meaning they can lag behind reality. A Russian service might load images or scripts from a foreign Content Delivery Network (CDN), or a foreign site might use Russian servers. When this happens, a page might only partially load—text appears but images don't—or you can log in, but payments fail.

A manual rule for the specific domain fixes this. The easiest way to find that domain is in the client's connection log; Happ, Incy, and Hiddify all have logs. Open the service, see which addresses went through the proxy, and add the missing ones to your 'direct' list.

Block connections without VPN is enabled

Android has a system setting that blocks all non-VPN traffic. It doesn't make exceptions for apps you've excluded from the tunnel. Mullvad's documentation explicitly states that excluded apps will not work if this is enabled. We explain where to find this setting and how to check it in our Android guide.

Which method should you choose?

Start with rules for Russian sites. They work on any device and cover most scenarios. Add app exclusions only when the rules aren't enough.

Step-by-step guides are split by device. For Android: exclusions in Incy, Happ, and Hiddify and how to verify them. For iPhone and iPad: routing profiles with examples for Russian services. For Windows: the 'Russia' region in Hiddify, TUN mode, system proxy mode, and browsers.