Software & SaaS · Ranked by price to features
10 Best VPNs with Split Tunneling of 2026
By the Rankozo research desk · Updated November 11, 2026 · Next review December 26, 2026
Proton VPN is the best VPN for split tunneling in 2026 because its Windows, Linux and Android apps can either exclude chosen apps and IP addresses from the VPN or send only chosen ones through it, and VPN Plus costs $3.49 a month on the 2-year plan (prices checked as of November 2026). Private Internet Access is the best budget pick at $2.03 a month on its 3-year plan, with bypass and VPN-only rules on Windows, Mac, Linux and Android and unlimited devices. iPhone users should pick ExpressVPN, the only vendor here that documents split tunneling on iOS.
- Tools ranked
- 10
- With free plan
- 2
- Cheapest paid plan
- PrivadoVPN, $1.11
- per month on the 24-month plan
Comparison table
| Tool | |||||
|---|---|---|---|---|---|
| Proton VPN | 01 | 9.2 | 9.2 | $3.49per month, billed $83.76 for the first 24 months | Yes |
| Private Internet Access | 02 | 9.0 | 9.4 | $2.03per month on the 3-year plan | No |
| ExpressVPN | 03 | 8.6 | 7.6 | Check price | No |
| Surfshark | 04 | 8.5 | 7.9 | Check price | No |
| Windscribe | 05 | 8.5 | 8.4 | $5.75per month, billed $69 a year | Yes |
| IPVanish | 06 | 8.4 | 8.6 | $2.19per month on the 2-year plan | No |
| Mullvad | 07 | 7.9 | 8.0 | $5.54per month | No |
| NordVPN | 08 | 7.9 | 7.4 | Check price | No |
| PrivadoVPN | 09 | 7.9 | 8.7 | $1.11per month on the 24-month plan | No |
| CyberGhost | 10 | 7.8 | 8.3 | $2.19per month on the 2-year plan | No |
Click a column to sort. Prices are the cheapest paid plan quoted from each vendor's US pricing page; "Check price" means the US price check is pending.
How this ranking works
One method for every tool. We compared documented features and published prices; we did not run hands-on tests. Value carries the most weight.
Full methodThis list is for people who want some apps on the VPN and others on their normal connection: a banking app that blocks VPNs, a printer on the home network, a game that needs low latency, or a work tool that must use the VPN while everything else does not. We compared documented features and published prices on each vendor's own site in November 2026, focusing on which direction the split works (exclude chosen apps, or include only chosen apps), whether you can split by app, website or IP address, and which platforms support it. Rankozo weights value at 40%, features at 35% and ease of use at 25%. Starting prices are the cheapest paid personal plan per month in USD. ExpressVPN, Surfshark and NordVPN showed prices only in euros from our location, so their prices are marked pending. The candidate list included State Farm and GEICO, but they sell insurance, not VPNs, so they are not ranked.
The verdict
Proton VPN is the best split tunneling VPN for most people: it supports Exclude and Include modes by app and IP address on Windows, Linux and Android, splits by domain in its browser extension, and costs $3.49 a month on the 2-year plan, though the free plan does not include the feature. Private Internet Access is the value pick at $2.03 a month, with bypass and VPN-only rules, Windows Store app support and unlimited devices. ExpressVPN covers the most platforms, including iOS, and Windscribe is the best choice for routing by hostname. Surfshark and IPVanish suit households and Fire TV owners, while Mullvad, NordVPN, PrivadoVPN and CyberGhost document fewer options.
- 01Top value
Proton VPN
9.2/10VPN whose paid plans offer both exclude and include split tunneling by app and by IP address.
Price
$3.49per month, billed $83.76 for the first 24 months
VPN Plus $3.49 per month on the 2-year plan, billed $83.76 for the first 24 months, then $83.88 every 12 months; free plan without split tunneling
“65% off VPN Plus $9.99 $3.49 /month” Quoted from the pricing page, November 11, 2026.
- Free plan
- Yes
- Value (40%)
- 9.2
- Features (35%)
- 9.5
- Ease of use (25%)
- 8.8
Best forPeople who want both exclude and include modes
Proton VPN ranks first because its split tunneling covers both directions on the most platforms in this list. Proton's support guide shows Exclude mode, which keeps chosen apps and IP addresses off the VPN, and Include mode, which sends only chosen apps and addresses through it, on Windows, the Linux GUI app and Android. On Windows and Android you can also enter IP ranges in CIDR notation, and the browser extension splits traffic by domain. The macOS version is labeled experimental, only excludes apps, needs the WireGuard or Stealth protocol, and does not work with Safari or other WebKit-based apps. Proton says split tunneling is available to everyone with a paid plan, so the free plan does not include it. VPN Plus costs $3.49 a month on the 2-year plan, billed $83.76 for the first 24 months, then $83.88 a year, and covers 10 devices.
- ✓Include mode lets you send only chosen apps through the VPN
- ✓IP ranges can be entered in CIDR notation on Windows and Android
- ✓Split tunneling also works in the Android TV app
- ✕Split tunneling is a paid feature, not part of Proton VPN Free
- ✕macOS split tunneling is experimental and does not work with Safari or other WebKit apps
- ✕Plan renews at $83.88 a year after the first 24 months
- Modes:
- Exclude and Include
- Platforms:
- Windows, macOS (experimental), Linux, Android, Android TV, browser extension
- Split by:
- App, IP address, domain (extension)
- Paid devices:
- 10
Bottom line: Proton VPN is the best choice for most split tunneling users because it offers both Exclude and Include modes by app and IP address on Windows, Linux and Android. VPN Plus costs $3.49 a month on the 2-year plan.
- 02
Private Internet Access
9.0/10VPN with app and IP split tunneling, Windows Store app support and unlimited devices.
Price
$2.03per month on the 3-year plan
$2.03 per month on the 3-year plan with 4 extra months; renews at $81.20 every 3 years
“3 Years + 4 Months EXTRA $ 2.03 /mo Autorenews at $81.20 every 3 years” Quoted from the pricing page, November 11, 2026.
- Free plan
- No
- Value (40%)
- 9.4
- Features (35%)
- 9.1
- Ease of use (25%)
- 8.4
Best forBudget buyers who need per-app rules on many devices
Private Internet Access takes second place on value: at $2.03 a month on the 3-year plan it is the cheapest verified option here, and its split tunneling page lists features others lack. PIA says you can pick apps or IP addresses that bypass the VPN, or do the inverse and choose only the apps that use it, on Windows, Mac, Linux and Android. On Windows it supports Windows Store apps in the .appx format, a common gap in other apps. Linux users can decide whether Docker or VM traffic bypasses the VPN, and Split Tunnel DNS on Windows and Linux sends all DNS requests through PIA with one click. PIA also lists an app-based kill switch. One account covers unlimited simultaneous connections. The trade-offs are the 3-year term behind the lowest price and no listed split tunneling on iOS.
- ✓Lowest verified price in this list at $2.03 a month
- ✓Split Tunnel DNS on Windows and Linux
- ✓No device limit
- ✕No split tunneling listed for iOS
- ✕Cheapest price needs a 3-year commitment
- ✕Android settings sit under Per-App Settings rather than Split Tunneling
- Modes:
- Bypass or VPN-only
- Platforms:
- Windows, Mac, Linux, Android
- Devices:
- Unlimited
- Refunds:
- 30 days for new subscribers
Bottom line: Private Internet Access is the best choice for budget buyers because it offers bypass and VPN-only split tunneling on four platforms for $2.03 a month. It also covers unlimited devices on one account.
- 03
ExpressVPN
8.6/10VPN with app and website split tunneling on Windows, macOS, Linux and Android, plus IP exclusions on iOS.
- Free plan
- No
- Value (40%)
- 7.6
- Features (35%)
- 9.3
- Ease of use (25%)
- 9.2
Best foriPhone users who need split tunneling
ExpressVPN ranks third on features and ease of use, held back only by a price we could not confirm in USD. Its split tunneling page lists the widest platform coverage in this list. The Windows 10 and 11 app splits by app and by website, routes IP addresses or subnets outside the VPN, and offers inverse split tunneling to protect only selected apps. The Mac app supports split tunneling on macOS 11 and later, the Linux app covers supported 64-bit distributions, and Android 7.0 and later gets per-app control. On iOS, ExpressVPN lets you exclude websites by single IPv4 address, which it describes as a feature not usually available on iPhone VPN apps. You turn it on under Profile, then Split Tunneling. Plans cover 10, 12 or 14 simultaneous devices. The pricing page showed euros from our location, so the USD price is pending.
- ✓Only vendor here that documents split tunneling on iPhone
- ✓IP address and subnet rules on Windows, macOS and Linux
- ✓No-logs policy audited by KPMG and PwC, according to ExpressVPN
- ✕USD price could not be confirmed from our location
- ✕iOS splitting is limited to single IPv4 address exclusions
- ✕No free plan
- Modes:
- Exclude and inverse (Windows)
- Platforms:
- Windows, macOS, Linux, Android, iOS
- Devices:
- 10 to 14 by plan
- Refunds:
- 30 days for new users
Bottom line: ExpressVPN is the best choice for iPhone users because it is the only vendor here that documents split tunneling on iOS. Check the USD price on expressvpn.com before you buy.
- 04
Surfshark
8.5/10VPN whose Bypasser and Reverse Bypasser features split traffic by app or website.
- Free plan
- No
- Value (40%)
- 7.9
- Features (35%)
- 8.8
- Ease of use (25%)
- 8.9
Best forHouseholds with many devices
Surfshark calls its split tunneling Bypasser. Its feature page shows Bypasser on Windows, macOS and Android for apps and websites, and on iOS for websites only, set under Settings, VPN Settings, Bypasser. Reverse Bypasser, also called route via VPN, sends only chosen apps and websites through the VPN on Android and only chosen apps on Windows. The Chrome, Firefox and Edge extensions also split by website. Every plan allows unlimited devices, so one subscription can carry the same rules to every phone and laptop in a household. It ranks below Windscribe because the pricing page showed euros from our location, leaving its USD price unconfirmed, and because the include direction is missing on macOS and iOS. Surfshark offers a 30-day money-back guarantee, which gives time to test Bypasser with your own apps.
- ✓Covers iOS for website exclusions
- ✓No device limit
- ✓30-day money-back guarantee
- ✕USD price could not be confirmed from our location
- ✕Reverse Bypasser is limited on Windows and absent on macOS and iOS
- ✕No free plan
- Feature name:
- Bypasser and Reverse Bypasser
- Platforms:
- Windows, macOS, Android, iOS, browser extensions
- Devices:
- Unlimited
- Refunds:
- 30 days
Bottom line: Surfshark is the best choice for families because Bypasser works on four operating systems and every plan covers unlimited devices. Confirm the USD price on surfshark.com.
- 05
Windscribe
8.5/10VPN with exclusive and inclusive split tunneling by app, hostname or IP address.
Price
$5.75per month, billed $69 a year
Free plan; Pro $5.75 per month on the yearly plan, billed $69 every 12 months; $9 month to month
“Yearly Plan Billed $69 USD every 12 months $5.75 per month” Quoted from the pricing page, November 11, 2026.
- Free plan
- Yes
- Value (40%)
- 8.4
- Features (35%)
- 8.9
- Ease of use (25%)
- 8.2
Best forUsers who want to split by hostname
Windscribe is the strongest choice for hostname-based routing. Its split tunneling page describes Exclusive Mode, where selected apps, hostnames and IP addresses skip the VPN and use your ISP-assigned IP, and Inclusive Mode, where only those items go through the VPN. Hostname and IP rules apply regardless of the application calling them, so you can route a site the same way in every app. The feature is listed for Windows, Mac, Linux and Android. Windscribe notes that its DNS resolver, ROBERT, or your custom DNS server, still answers DNS requests for excluded apps, which matters if a service checks location through DNS. Pro costs $5.75 a month on the yearly plan, billed $69 every 12 months, or $9 month to month, and a free plan exists.
- ✓Hostname rules apply regardless of which app makes the request
- ✓Both directions supported on all four platforms
- ✓Flat yearly price of $69
- ✕Excluded apps still use Windscribe's DNS, which can confuse location checks
- ✕No split tunneling listed for iOS
- ✕Yearly plan costs more per month than the cheapest options here
- Modes:
- Exclusive and Inclusive
- Platforms:
- Windows, Mac, Linux, Android
- Split by:
- App, hostname, IP address
- Free plan:
- Yes
Bottom line: Windscribe is the best choice for routing by website because its Exclusive and Inclusive modes accept hostnames as well as apps and IP addresses. Pro costs $69 a year.
- 06
IPVanish
8.4/10VPN with app-based and domain-based split tunneling on desktop, mobile and Fire TV.
Price
$2.19per month on the 2-year plan
Essential $2.19 per month on the 2-year plan, $52.56 for the first 2 years; $14.99 month to month
“Essential Save 85% $2.19 /mo” Quoted from the pricing page, November 11, 2026.
- Free plan
- No
- Value (40%)
- 8.6
- Features (35%)
- 8.2
- Ease of use (25%)
- 8.5
Best forFire TV and Apple device owners
IPVanish offers two kinds of split tunneling: domain-based, which keeps chosen websites on your ISP connection, and app-based, which lets chosen apps bypass the VPN. Its feature page lists Windows, Mac, Android, iOS, Amazon Fire TV and even Apple Vision Pro as compatible, and the setup is the same everywhere: Settings, then Split Tunneling, toggle on, then pick apps or enter URLs. Everything you do not list stays inside the tunnel. Essential costs $2.19 a month on the 2-year plan, $52.56 for the first two years, with unlimited devices and a 30-day money-back guarantee. IPVanish only describes excluding traffic, so people who want to tunnel just one app should look at Proton VPN, PIA or Windscribe. Linux is not on IPVanish's split tunneling platform list.
- ✓Split tunneling on Fire TV and Apple Vision Pro
- ✓Unlimited devices
- ✓Low 2-year price of $2.19 a month
- ✕IPVanish documents exclusion only, not an include-only mode
- ✕Monthly plan costs $14.99
- ✕Linux is not on the split tunneling platform list
- Modes:
- Exclude apps or domains
- Platforms:
- Windows, Mac, Android, iOS, Fire TV, Apple Vision Pro
- Devices:
- Unlimited
- Refunds:
- 30 days
Bottom line: IPVanish is the best choice for Fire TV and Apple device owners because it lists split tunneling on Fire TV, iOS and Apple Vision Pro. Essential costs $2.19 a month on the 2-year plan.
- 07
Mullvad
7.9/10VPN with a flat monthly price and documented app exclusion on four desktop and mobile systems.
Price
$5.54per month
Flat €5 per month, shown as $5.57 on Mullvad's site
“€5 is equivalent to $5.57” Quoted from the pricing page, November 11, 2026.
- Free plan
- No
- Value (40%)
- 8.0
- Features (35%)
- 7.8
- Ease of use (25%)
- 8.0
Best forPrivacy-focused users who exclude a few apps
Mullvad's split tunneling guide, updated October 20, 2026, says you can exclude apps so they use your regular connection and your own IP address on Windows, Linux, macOS and Android. On Linux, the CLI commands mullvad-exclude and mullvad split-tunnel let you script exclusions, including Flatpak apps. The guide is unusually frank about limits: Windows Store apps cannot be excluded, games with anti-cheat and Java apps such as Minecraft: Java Edition may not work, and launching another app from an excluded browser can exclude that app too. Mullvad charges a flat €5 a month, which its site lists as $5.57, whether you pay for one month or longer, and an account covers up to 5 devices. There is no include-only mode, so it suits people who exclude a few apps rather than tunnel one.
- ✓No long-term commitment needed for the lowest price
- ✓Unusually detailed documentation of split tunneling limits
- ✓CLI support for scripting exclusions on Linux
- ✕Exclude mode only, no include-only option
- ✕Windows Store apps cannot be excluded
- ✕Limited to 5 devices
- Modes:
- Exclude apps
- Platforms:
- Windows, Linux, macOS, Android
- Devices:
- 5
- Price:
- €5 a month, about $5.57
Bottom line: Mullvad is the best choice for privacy-focused users who only need to exclude a few apps, because it charges the same $5.57 a month with no long-term plan. Its guide documents which apps split tunneling cannot handle.
- 08
NordVPN
7.9/10VPN with app split tunneling on Windows and Android and a port and subnet Allowlist on Linux.
- Free plan
- No
- Value (40%)
- 7.4
- Features (35%)
- 8.0
- Ease of use (25%)
- 8.6
Best forAndroid TV owners
NordVPN's support article covers app-based split tunneling on Windows 7, 8.1, 10 and 11, Android and Android TV, where you pick apps that do not need VPN protection. On Linux, NordVPN offers an Allowlist instead: you exclude ports, port ranges or subnets rather than apps, the rules apply to incoming and outgoing traffic, and matching traffic is not blocked by the kill switch. The browser extension has a separate Exclude from VPN option. NordVPN also notes a known issue: excluded apps still use NordVPN DNS servers, so some streaming services may misread your location. It ranks eighth because macOS and iOS are not covered in the article, Linux lacks per-app control, and the pricing page showed euros from our location, so the USD price is pending.
- ✓Split tunneling on Android TV
- ✓Linux CLI commands for port and subnet rules
- ✓Windows list shows open apps and lets you browse for others
- ✕USD price could not be confirmed from our location
- ✕Linux has no per-app split tunneling
- ✕NordVPN notes excluded apps still use its DNS, which can break location checks
- Modes:
- Exclude apps; Allowlist on Linux
- Platforms:
- Windows, Android, Android TV, Linux (Allowlist), browser extension
- Linux option:
- Ports and subnets
- Free plan:
- No
Bottom line: NordVPN is the best choice for Android TV owners already on NordVPN because its TV app can move apps out of the tunnel. Linux users only get port and subnet rules.
- 09
PrivadoVPN
7.9/10VPN with app-by-app split tunneling and a low 24-month price.
Price
$1.11per month on the 24-month plan
$1.11 per month on the 24-month plan; $10.99 month to month
“24 Month Unlimited VPN + 3 FREE Save 90 % 1.11 /mo” Quoted from the pricing page, November 11, 2026.
- Free plan
- No
- Value (40%)
- 8.7
- Features (35%)
- 6.8
- Ease of use (25%)
- 8.0
Best forLowest cost per month
PrivadoVPN is the cheapest option here at $1.11 a month on its 24-month plan, and its split tunneling page explains that you can exclude apps from the encrypted tunnel to free bandwidth or use apps that do not work over a VPN. The features page describes split tunneling as app-by-app control, alongside a kill switch, a SOCKS5 proxy for download clients and a choice of OpenVPN, IKEv2 and WireGuard. The documentation is thinner than its rivals: PrivadoVPN does not say which of its apps support split tunneling, and it does not describe an include-only mode or website rules. Treat it as a low-cost way to exclude a few apps, and check the setting in the app during the 30-day money-back window.
- ✓Lowest monthly price in this list on the 24-month plan
- ✓Simple app-by-app control
- ✓30-day money-back guarantee
- ✕PrivadoVPN does not say which platforms support split tunneling
- ✕No documented include-only mode or website rules
- ✕Monthly plan costs $10.99
- Modes:
- Exclude apps
- Platforms:
- Not published for split tunneling
- Protocols:
- OpenVPN, IKEv2, WireGuard
- Refunds:
- 30 days
Bottom line: PrivadoVPN is the best choice for the lowest price because it costs $1.11 a month on the 24-month plan and includes app split tunneling. Confirm your platform supports it during the refund window.
- 10
CyberGhost
7.8/10VPN with app split tunneling in its Windows and Android apps and a 45-day refund window.
Price
$2.19per month on the 2-year plan
$2.19 per month on the 2-year plan plus bonus months, billed $61.32 for the first 2 years; renews at $61.32 a year
“2 Years + 2 Months, $ 2.19 /mo Billed $61.32 for first 2 years, then autorenews at $61.32 annually” Quoted from the pricing page, November 11, 2026.
- Free plan
- No
- Value (40%)
- 8.3
- Features (35%)
- 7.0
- Ease of use (25%)
- 8.2
Best forWindows users who want a long refund window
CyberGhost lists split tunneling on its features page as a way to send apps or sites that do not work well with VPNs outside the tunnel. Its Windows page says you can specify which apps should use the VPN tunnel and that Smart Rules on a PC include split tunneling and Wi-Fi detection, and its Android page lists app split tunneling for Android 7.0 and later. We found no split tunneling documentation for the macOS or iOS apps, and CyberGhost publishes less detail than its rivals about include and exclude modes. The pricing page shows $2.19 a month on the 2-year plan, billed $61.32 for the first two years, then $61.32 a year, with 7 devices and 9,400+ servers. The 45-day money-back guarantee is the longest here.
- ✓45-day money-back guarantee on long plans
- ✓Low 2-year price of $2.19 a month
- ✓Split tunneling sits inside Smart Rules automation on Windows
- ✕No split tunneling documented for macOS or iOS
- ✕Limited to 7 devices
- ✕Little public detail on split tunneling modes
- Modes:
- App-based
- Platforms:
- Windows, Android
- Devices:
- 7
- Refunds:
- 45 days
Bottom line: CyberGhost is the best choice for Windows users who want time to test split tunneling, because its long plans come with a 45-day money-back guarantee. It costs $2.19 a month on the 2-year plan.
What to check before you pay
Decide which direction you need
Most apps exclude: chosen apps skip the VPN and everything else is protected. Some also include: only chosen apps use the VPN. Proton VPN, Private Internet Access, Windscribe and ExpressVPN on Windows document both directions, Surfshark offers Reverse Bypasser on Android and Windows, and Mullvad, IPVanish and NordVPN describe exclusion only.
Split by app, website or IP address
App rules suit games and banking apps. Website and IP rules suit a single site or a home device. Windscribe matches hostnames regardless of the app that calls them, Proton VPN and ExpressVPN accept IP ranges, and IPVanish and Surfshark split by domain.
Check your platform before you pay
Split tunneling support varies by operating system. ExpressVPN documents it on iOS through IPv4 exclusions and Surfshark offers website bypass on iOS, while Proton VPN's macOS version is experimental and NordVPN's Linux app uses a port and subnet Allowlist instead of app rules.
Watch DNS behavior for excluded apps
Windscribe and NordVPN both note that excluded apps still send DNS requests through the VPN provider's resolver. Some streaming services and location checks can fail as a result, so test the apps you plan to exclude during the refund window.
Count devices and refund days
Private Internet Access, Surfshark and IPVanish allow unlimited devices, Proton VPN Plus covers 10, CyberGhost 7 and Mullvad 5. CyberGhost offers 45 days to request a refund on long plans; most others offer 30.
FAQ
Which VPN is best for split tunneling?
Proton VPN is the best VPN for split tunneling in 2026. Its Windows, Linux and Android apps support both Exclude mode and Include mode by app and IP address, and VPN Plus costs $3.49 a month on the 2-year plan, according to protonvpn.com in November 2026.
What is split tunneling in a VPN?
Split tunneling lets some traffic use the VPN while other traffic uses your normal internet connection. Surfshark describes it as dividing traffic between direct internet access and an encrypted VPN tunnel, so apps that need your local IP can bypass the VPN.
Does Proton VPN Free include split tunneling?
No. Proton says split tunneling is a premium feature available to everyone with a paid Proton VPN plan. Windscribe has a free plan and lists split tunneling on its Windows, Mac, Linux and Android apps.
Which VPN has split tunneling on iPhone?
ExpressVPN documents split tunneling on iOS, letting you exclude websites by single IPv4 address. Surfshark's Bypasser also excludes websites on iOS, and IPVanish lists iOS among its split tunneling platforms.
Can I send only one app through the VPN?
Yes, with an include mode. Proton VPN calls it Include mode, Windscribe calls it Inclusive Mode, Surfshark calls it Reverse Bypasser on Android and Windows, and Private Internet Access lets you select only the apps that use the VPN.
What is the cheapest VPN with split tunneling?
PrivadoVPN is the cheapest at $1.11 a month on its 24-month plan, with app-by-app split tunneling. Private Internet Access costs $2.03 a month on its 3-year plan and documents more options, including VPN-only rules and Windows Store app support.
Is split tunneling safe?
Yes, for apps that do not carry sensitive data. Mullvad warns that excluded apps use your own IP address, and PrivadoVPN advises keeping passwords and financial data inside the VPN tunnel.
Questions or corrections: editorial@rankozo.comSee our disclosure. Prices change; confirm on the vendor page before buying.
More rankings