Split tunneling is an option that allows you to have a specific part of your internet connection rerouted outside of the VPN. It may be helpful when a VPN connection is unnecessary, such as when dealing with a trusted application.
On Windows 7 & 8.1
- Open the settings menu by pressing the cog icon on the bottom-left side:
- Head to the Split Tunneling section, turn it ON, and press add apps:
On Windows 10 & 11
- Click on a gear icon in the bottom left corner to access settings:
- Choose Split Tunneling button:
- Turn the feature ON and choose to add apps:
- Select your wanted application and click on the add selected option:
NOTE: The Split Tunneling selection list will show only the currently opened applications on your device.
- Alternatively, press the browse apps button to search for your preferred application on your device:
On Android
- Tap on the profile icon and open the settings menu by tapping on settings:
- Head over to the VPN connection settings and choose the split tunneling option:
- Toggle the switch to the ON position:
- Select the apps you wish not to be affected by the VPN connection:
On Android TV
- After you open the NordVPN app, go to settings by pressing the cog icon on the lower left side:
- Scroll down until you see split tunneling and click on it:
- After clicking it, a new menu will pop up asking which apps do not need to be under the VPN protection. After clicking on the application, it will move to the safe apps section and no longer show the VPN IP address. Similarly, clicking on an app already excluded from the VPN will move it to the Tunneled through VPN section.
On Linux
On the NordVPN Linux application, instead of split tunneling, we offer the Allowlist option. The Allowlist works differently from application-based split tunneling on Windows, Android, and other devices. Instead of selecting apps, Linux allows you to exclude ports or subnets from VPN protection.
What the Allowlist does:
- Allows plaintext (VPN-bypassed) traffic for selected ports, port ranges, or subnets.
- Applies the rule to all connections and all traffic that matches the rule.
- Traffic that matches an Allowlist rule bypasses the VPN tunnel and is not blocked by the kill switch.
- Allowlist rules apply to both incoming and outgoing traffic, matching the rule. There is no way to allow only outbound traffic while keeping inbound traffic protected.
Use this feature only when necessary and with an understanding of what traffic will be excluded.
Here's how to configure the Allowlist on the NordVPN Linux app:
- Open the NordVPN app, and go to settings.
- Click on security and privacy.
- Select allowlist.
- Here you can turn the feature on and configure it to your liking.
Here's how to configure the Allowlist using Linux CLI:
Open the terminal on your Linux device, and depending on your needs, follow the commands below.
To add a port to the allowlist, use the following command:
nordvpn allowlist add port <port> [protocol <protocol>]Examples:
With protocol:
nordvpn allowlist add port 22 protocol TCPWithout protocol:
nordvpn allowlist add port 22To add a port range to the allowlist, use the following command:
nordvpn allowlist add ports <port_from> <port_to> [protocol <protocol>]Examples:
nordvpn allowlist add ports 3000 8000nordvpn allowlist add ports 3000 8000 protocol UDPTo add a subnet to the allowlist, use the following command:
nordvpn allowlist add subnet <address>Examples:
nordvpn allowlist add subnet 192.168.1.1/24To remove a port from the allowlist, use the following command:
nordvpn allowlist remove port <port> [protocol <protocol>]Example:
nordvpn allowlist remove port 22To remove a port range:
nordvpn allowlist remove ports <port_from> <port_to> [protocol <protocol>]Example:
nordvpn allowlist remove ports 3000 8000To remove a subnet:
nordvpn allowlist remove subnet <address>Example:
Example: nordvpn allowlist remove subnet 192.168.1.1/24To remove all entries from your allowlist, use the following command:
Command: nordvpn allowlist remove all
Experiencing issues?
We are aware of an issue where some applications or services might not function as expected when excluded from the VPN using the split tunneling feature.
While the excluded application might see your internet service provider's IP address, the computer still uses the NordVPN DNS servers to route the internet. This situation causes a conflict for the application, as it sees DNS requests using one IP address, but the endpoint has a different one.
As a result, some streaming services or applications may be unable to accurately determine your location and fail to connect. We appreciate your patience and apologize for any inconvenience.
