Split tunneling exclusions are settings that tell a VPN client which traffic should bypass the encrypted tunnel and travel directly over your regular internet connection. For most people, this is a convenience feature that lets a local printer, a banking app, or a video call work the way it normally does.
Used carefully, exclusions give you control over the trade-off between privacy and everyday convenience. Used carelessly, they can quietly leave sensitive activity outside the protection you thought you had. This guide explains what exclusions are, how they differ from related settings, and how to decide what belongs on the list.
What Happens When You Leave Traffic Outside the Tunnel
A VPN, or virtual private network, creates an encrypted path between your device and a server run by the VPN provider. Normally all of your traffic travels through that path, which hides its contents from your local network and your internet service provider. An exclusion is a rule that removes certain traffic from that path.
Consider a simple example. You are working from a coffee shop and have a VPN turned on. You open a streaming service that blocks VPN connections, so you add it to your exclusion list.
Its traffic now goes straight out through the café’s network, which means the café’s operator and your internet provider can see that you connected to that service.
This is the central idea to keep in mind: an exclusion does not make traffic private. It simply moves that traffic onto a different route, one where your normal network exposure applies. Some traffic, such as a website you already access over HTTPS, remains encrypted by the site itself. Other traffic may reveal far more about your location and activity.
Exclusions, Inclusions and Other Routing Terms
Split tunneling is the broader idea of sending some traffic through the VPN and some traffic elsewhere. Within that idea, exclusions and inclusions describe two opposite ways of writing the rules. An exclusion list says everything goes through the VPN except what is named. An inclusion list says nothing goes through the VPN except what is named.
Both approaches produce split traffic, but they fail in different ways. With an exclusion list, a new app you install is protected by default, which is safer if you forget to update the list. With an inclusion list, a new app is left unprotected by default, so you must remember to add it.
Exclusions also differ from a full tunnel, where all traffic is routed through the VPN with no exceptions. A full tunnel is the simplest model to reason about. Exclusions add flexibility but also add a second set of routes you must understand and audit over time.
Common Kinds of Traffic People Exclude
Most exclusion lists fall into a few predictable categories. Knowing them helps you judge whether a given entry is reasonable or deserves a second look.
- Local network devices such as printers, network storage, smart speakers, and file shares that must be reachable on your home or office network.
- Applications that refuse to work through a VPN, including some banking, government, and streaming services that block known VPN address ranges.
- Video conferencing or voice tools that perform better over a direct route and may need consistent low latency.
- Software updates or large downloads you want to run at full speed without the overhead of encryption and a distant server.
- Work resources that are reached through a separate corporate VPN, where routing both tunnels at once would cause conflicts.
Each category has a legitimate purpose, but each also changes what a network observer can learn. A printer on your home network exposes almost nothing to the outside world. A banking app excluded from the tunnel exposes that you bank and from where you connect, so the decision deserves thought before you make it.
Risks Hidden Inside an Exclusion List
The most common mistake is forgetting that exclusions persist. You may add a service temporarily to fix a connection problem, then leave it on the list for months. Over time the list grows, and traffic you once chose to protect may be travelling unprotected without any visible sign.
A second risk involves DNS, the system that translates website names into numeric addresses. If a domain is excluded but its name lookups still go through the tunnel, or the reverse, you can end up with a mixed pattern that is harder to predict. Checking how your client handles name lookups alongside exclusions is worthwhile.
A third risk comes from applications that open connections on their own, such as background updaters, telemetry, or helper services.
An entry for the main program may not cover these companion processes, so their traffic may take a different route than you expected. Reviewing the full list of processes that touch the network is the only reliable way to be sure.
Ways to Define an Exclusion Rule
VPN clients usually let you exclude traffic in more than one way. The method you choose determines how precisely the rule matches and how easily it can be misapplied. Understanding each option helps you write rules that do what you intend.
Excluding by Application
Application-based exclusions send everything a specific program produces outside the tunnel. This is intuitive because you think in terms of apps rather than network addresses. The main limitation is that a single app may open many connections to many places, so you may exclude more than you meant.
When you use this method, confirm which executable or package the client actually matches. Some clients match on file path, so an update that changes the path can silently break the rule. Re-checking after major updates prevents surprises that could expose traffic you intended to keep private.
Excluding by Address or Network Range
Address-based exclusions target specific IP addresses or ranges, such as a local subnet like the typical home network blocks used by routers. This approach is precise for local devices and is widely used for printers and file shares. It works regardless of which app initiates the connection.
The downside is that services hosted on shared infrastructure can change addresses over time. An address that belonged to one service may later serve another, and a range that once covered a single company may grow. Addresses that are excluded by number should be reviewed periodically.
Excluding by Domain Name
Domain-based exclusions match traffic by website or service name. They are often the most readable option, because you can see at a glance which services bypass the tunnel. Many services rely on several domains, including content delivery hosts, so a single name may not capture everything the service uses.
Domain rules also depend on DNS resolution working correctly. If the name is resolved through a different path than the one you expected, the rule may not match as planned. Test a domain exclusion by confirming, with a public IP check tool, that the service sees the address you intend it to see.
Choosing What Belongs on Your List
A useful starting point is to ask what you would be comfortable with a local network observer or your internet provider knowing about a given connection. For a printer, the answer is usually that it does not matter.
For an account that holds your money or medical information, the answer may be that you prefer it to stay inside the tunnel even if it causes some inconvenience.
Next, consider whether the exclusion is truly necessary. Some applications block VPN traffic only in certain modes, and switching server locations or protocols may resolve the issue without leaving the tunnel. Trying a few alternatives before adding an exclusion keeps your protected traffic as broad as possible.
Decide on a review habit. Write down why each entry exists, and recheck the list whenever you change networks, update the VPN client, or stop using a service. An exclusion with a recorded reason is far easier to justify, or remove, than one whose origin no one remembers.
Testing and Auditing Your Exclusions
Setting an exclusion is only half the job. Verifying that it behaves as expected is what turns a guess into a dependable configuration. The following checks can be done with ordinary tools and take only a few minutes.
- Confirm your public IP address with and without the VPN active, and note which services report the address you expect in each case.
- Check for DNS leaks by visiting a reputable DNS test page while the VPN is on, and make sure lookups resolve through the intended path.
- Review the list of active network connections on your computer to see which processes are actually communicating, and whether any unexpected ones are excluded.
- Test the excluded app while the tunnel is up and down to confirm it still works, and note any differences in behavior that might signal a misrouted connection.
- Repeat these checks after updating the VPN client, changing networks, or installing a new application that touches the internet.
Keep a short written record of the results. If an exclusion stops working after an update, or a service begins reporting an unexpected address, you will have a baseline to compare against. Regular checks catch most problems before they affect anything you care about.
Building a Practical Routine for Exclusions
Begin with the smallest possible list. Start from a full tunnel and add an exclusion only when a specific need appears, such as a local printer or an application that cannot connect otherwise. This keeps your default posture strong and makes every exception deliberate.
Adopt a simple labeling system. For each entry, note the reason, the method used, and the date added. When you revisit the list, you can quickly decide whether each item still earns its place. Removing stale entries is one of the most effective ways to reduce hidden exposure.
Looking ahead, exclusion settings will likely become more granular as clients add better app identification and clearer reporting. Until then, a disciplined review habit remains the best safeguard. Treat your exclusion list as a living document, and revisit it whenever your devices, networks, or online routines change.