Split tunneling inclusions are settings that tell a VPN which specific apps, addresses, or networks should be sent through the encrypted tunnel, while everything else uses your normal connection. Used carefully, they give you control over privacy and speed.
This guide explains what inclusion rules do, how they differ from exclusion rules, and where they can leave gaps. It also offers a practical checklist so you can decide which traffic deserves protection and confirm that your choices work as intended.
Why Some Traffic Should Go Through the Tunnel and Some Should Not
A virtual private network, often called a VPN, creates an encrypted path between your device and a server run by the VPN provider. Traffic on that path is scrambled, so people on the same network cannot read it easily. By default, many VPN apps send all of your device’s traffic through this path, a setup known as a full tunnel.
Full tunnels are simple, but they are not always ideal. Streaming a local video, printing to a home printer, or playing a game with nearby friends can slow down or fail when every packet has to travel to a distant server first.
Split tunneling solves this by dividing traffic into two groups. One group travels through the VPN tunnel, and the other uses your ordinary internet connection. The rules that define which traffic belongs in the protected group are called inclusions, and the opposite rules are called exclusions.
What Split Tunneling Inclusions Actually Do
An inclusion rule is an instruction that says, in effect, send this traffic through the VPN. When inclusions are active, only the listed traffic enters the tunnel, and everything else bypasses it. This is the reverse of a default full tunnel, where everything enters unless excluded.
Inclusions can be written in several forms. Some VPN apps let you pick applications from a list, so only a browser or a banking app uses the tunnel.
Others accept IP addresses, address ranges written in CIDR notation such as 203.0.113.0/24, or domain names. The VPN app then tells your operating system which routes should point at the virtual network adapter it created.
Because inclusions depend on how the operating system routes packets, their behavior can differ between Windows, macOS, Android, iOS, and Linux. Some platforms handle domain-based rules through the DNS resolver, which means the rule may apply only after a name is looked up. Always read your VPN’s documentation for the specific platform you use.
Common Inclusion Modes and When Each Fits
Most VPN apps that support inclusions offer a few common modes. Knowing the differences helps you pick the one that matches your goals rather than the first option on the screen.
- Application inclusion, where only selected programs send traffic through the tunnel
- Address inclusion, where only specific IP addresses or ranges use the VPN
- Domain inclusion, where traffic to chosen websites or services is tunneled
- Network inclusion, where traffic to particular private or corporate networks is routed through the VPN
- Hybrid rules that combine two or more of the methods above in one profile
Application inclusion is usually the easiest to understand and verify. Address and domain inclusion can be more precise but depend on how names resolve and how services change their addresses. Network inclusion is common in workplace setups. Hybrid rules offer flexibility but add complexity, so test them thoroughly before relying on them.
Risks and Blind Spots in Inclusion Rules
The biggest risk of inclusion rules is assuming that everything you care about is covered. If you include only your web browser, a background program that sends telemetry, a sync client, or a mobile app may still reach the internet directly. Those connections can reveal your real IP address and location even while your browser looks protected.
Domain-based rules have their own weakness. A service may use many servers, content delivery networks, or changing addresses, so a domain you included might be reached through a route you did not expect. Some apps also use hard-coded addresses that bypass name lookups entirely.
Another concern is DNS, the system that turns names like example.com into numeric addresses. If name lookups leave the tunnel while the traffic itself enters it, a third party may still see which sites you are visiting. Check how your VPN handles DNS under inclusion mode and whether DNS leak protection is available.
Setting Up Inclusions Carefully, Step by Step
Setting inclusions is easier when you break the job into small, verifiable steps. The subsections below walk through planning, testing, and maintaining your rules so the protection you expect matches the protection you actually get.
Plan What Must Stay Private
Begin by listing the activities that matter most to you, such as browsing on public Wi-Fi, reading news, or accessing a work system. Be specific about the apps and services involved, because vague goals lead to vague rules. Writing the list on paper or in a notes app helps you see gaps before you configure anything.
Next, separate traffic that needs privacy from traffic that works better without the tunnel, such as a local printer, a smart television, or a nearby game server. Keep in mind that the local traffic also carries information about you, so only exclude it when you understand the trade-off.
Note which accounts and services use sign-in. Some sites may flag or challenge a session when the IP address changes unexpectedly, so decide in advance how you will handle that possibility.
Test Your Rules Before You Rely on Them
After creating inclusion rules, confirm that they behave as intended. Connect the VPN and visit a public IP-checking page from an included application. The address shown should belong to the VPN server, not your home or mobile connection. Then repeat the check from an application you did not include and confirm that it shows your ordinary address.
Test DNS as well. Many VPN providers offer a leak test page that shows which resolvers handle your lookups. If your included sites resolve through your ISP while the traffic goes through the VPN, adjust your DNS settings or choose a different inclusion method.
Repeat these tests after every operating system update, app update, or VPN app update. Routing behavior can change quietly, and a rule that worked last month may not work today.
Maintain and Review Rules Over Time
Inclusion lists age quickly. Services move to new servers, apps add features that contact new domains, and you may stop using a tool you once depended on. Set a reminder every few months to review your profile and remove entries that no longer serve a purpose.
Keep a short record of what each rule is for. A note such as included for banking app, used for account sign-in can help you or a colleague understand the setup later and avoid accidentally deleting a critical entry.
If you manage devices for a household or small team, keep a single written profile that everyone follows. Consistent rules are easier to test and far less likely to leave a forgotten connection unprotected.
How Inclusions Fit Alongside Other VPN Protections
Inclusion rules work best as one layer in a broader set of protections rather than as a standalone shield.
A kill switch, which blocks traffic if the tunnel drops, is especially valuable when inclusions are active, because an included application might otherwise fall back to the open connection without warning. Look for a kill switch that can be scoped to the same applications you included.
Leak protection features also matter. Some VPN apps block IPv6 traffic when the tunnel is not configured for it, since an unprotected IPv6 route can bypass an IPv4-only tunnel. Others offer WebRTC leak mitigation for browsers, which can otherwise reveal addresses through real-time communication features.
Remember that a VPN changes who can see your traffic, not whether your activity is visible to the sites you visit. Logins, cookies, and browser fingerprints still identify you. Inclusion rules narrow which network path your data takes, and they do not replace careful account security or good browsing habits.
A Practical Checklist Before You Save Your Profile
Before you finish configuring inclusions, walk through a short checklist. Each item takes only a minute and catches the most common mistakes people make when first setting up a split tunnel.
- Confirm that every application you care about appears in the inclusion list
- Check that an application you did not include still shows your ordinary address
- Run a DNS leak test while the tunnel is active and review the results
- Verify that a kill switch is enabled and covers the included applications
- Write a brief note explaining why each rule exists for future review
If any check fails, adjust the rule and test again before trusting the profile. Some problems are caused by a single misspelled domain or an app that uses a helper process with a different name. If you cannot resolve a failure, consult your VPN provider’s support documentation or a qualified IT professional, especially if the connection protects work data.
Using Inclusions Wisely in the Months Ahead
Split tunneling inclusions can give you meaningful control over your privacy, speed, and access to local resources. The key is to treat them as deliberate choices rather than set-and-forget defaults. Revisit your profile as your habits and devices change, and keep testing so that the protection on paper matches the protection in practice.
Looking ahead, you may find that a single well-tested profile serves most of your needs. Start with a small set of included applications, confirm that they behave correctly, and expand only when you have a clear reason. This cautious approach reduces surprises and makes troubleshooting far easier.
Stay informed about the VPN features you rely on. Read release notes when your app updates, and pay attention to any changes in how inclusions, DNS, or kill switches behave. Clear understanding, regular testing, and simple rules will keep your traffic going where you intend it to go.