Last updated:

This guide will show you how to use the split tunneling feature on the ExpressVPN apps for Windows, Mac, and Linux.

Note: Split tunneling is also not currently available on the ExpressVPN app for Windows 11 on ARM64.

Jump to…

What is the split tunneling feature?
What happens to my DNS queries when I use split tunneling?
How to use VPN split tunneling on Windows
How to use VPN split tunneling on Mac
How to use VPN split tunneling on Linux

What is the split tunneling feature?

The split tunneling feature allows you to decide which apps use the VPN and which apps don’t when your device is connected to ExpressVPN.

For example, if you want all of your apps except Firefox to use the VPN, you can configure ExpressVPN to “split tunnel” the traffic so that only Firefox won’t go through the encrypted VPN tunnel.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

What happens to my DNS queries when I use split tunneling?

As long as you are connected to ExpressVPN, all of your DNS queries should go through ExpressVPN’s servers, no matter how you configure your split-tunneling settings.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

How to use VPN split tunneling on Windows

Note: If using the WireGuard protocol, you’ll need to disconnect and reconnect to the VPN to apply your split-tunneling settings. When using any other protocol, the changes should apply automatically.

To change your split-tunnel settings:

  1. Click the Profile tab and select Split Tunneling.ExpressVPN Windows app, with a highlighted Profile tab and the "Split-Tunneling" option.
  2. Toggle Split tunneling on.The Split tunneling settings in the ExpressVPN Windows app, with a highlighted toggle showing the featured turned on.

From there, you can select different split-tunneling options, including which apps use or bypass the VPN. You can also configure it so specific websites can get around the VPN tunnel, which is useful for sites that block VPNs (like bank sites). Learn more about each settings option below:

Add apps

  1. Click Add App.The "Add App" option in the Split tunneling settings on the Windows ExpressVPN app.
  2. Click the app you want to set up split tunneling rules for, then click Add.The "Add app to split tunnel" pop-up in the ExpressVPN app on Windows, with a highlighted "Add" button.
  3. Click the dropdown next to the app you just added and choose either:
    • Bypass VPN: These apps won’t use the VPN tunnel.
    • Only VPN: These apps will use the VPN tunnel.The "Bypass VPN" and "Only VPN" split-tunnelling options for apps in the ExpressVPN Windows app highlighted.

Add IP addresses

  1. Click Add IP.The "Add IP" option in Split tunneling settings on the ExpressVPN Windows app.
  2. Enter an IPv4/IPv6 address or a subnet in CIDR notation and click OK.The "Add IP Address" pop-up in the ExpressVPN split-tunneling settings on Windows, highlighting an IP Address or Subnet field.

Note: Excluding an IP address from the VPN will not work reliably for large websites. This is because these services do not use a single fixed IP address. The IP address of the same website can be different every time you look it up, and the same IP address can be shared by multiple unrelated websites. As a result, the split tunneling rule may apply to websites you did not intend to exclude from the VPN.

Warning: Whitelisting public IPs (e.g., social networks) poses a privacy risk, as shared public IP infrastructure can expose your data to unrelated sites. Only whitelist private IPs you trust.

All other apps

This option enables you to decide the split tunneling rules for all the other apps on your device.

To adjust the settings for other apps, click the dropdown menu next to All Other Apps and choose either Bypass VPN or Use VPN.The "All Other Apps" option in the Split tunneling settings in the ExpressVPN app, showing the "Use VPN" and "Bypass VPN" choices.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

How to use VPN split tunneling on Mac

Note: If using the WireGuard protocol, you’ll need to disconnect and reconnect to the VPN to apply your split-tunneling settings. When using any other protocol, the changes should apply automatically.

To change your split-tunnel settings:

  1. Click the Profile tab and click Split Tunneling.The ExpressVPN Profile tab on macOS, with a highlighted "Split Tunneling" option.
  2. Click the toggle next to Split tunneling to enable it.The Split tunneling settings enabled in the ExpressVPN macOS app.

From there, you can specify which apps to use or bypass the VPN and select the websites you want to exclude from the VPN tunnel. Learn more about each settings option below:

Add apps

  1. Click Add App.The "Add App" option in ExpressVPN's split-tunneling settings on macOS.
  2. Find and click on the app you want to add, and click Open.The Application folder pop-up on macOS, showing available apps that can be added to the split-tunneling settings, with a highlighted "Open" button.
  3. Click the dropdown next to the app you just added and choose either Bypass VPN or Only VPN.ExpressVPN's "Bypass VPN" and "Only VPN" split-tunneling options on macOS.

Add IP addresses

  1. Click Add IP.The "Add IP" option in ExpressVPN's split-tunneling settings on macOS.
  2. Enter an IPv4/IPv6 address or a subnet in CIDR notation and click OK.The "Add IP Address" pop-up, with a highlighted "IP Address or Subnet" field.

Note: Excluding an IP address from the VPN will not work reliably for large websites. This is because these services do not use a single fixed IP address. The IP address of the same website can be different every time you look it up, and the same IP address can be shared by multiple unrelated websites. As a result, the split tunneling rule may apply to websites you did not intend to exclude from the VPN.

Warning: Whitelisting public IPs (e.g., social networks) poses a privacy risk, as shared public IP infrastructure can expose your data to unrelated sites. Only whitelist private IPs you trust.

All other apps

This option enables you to decide the split tunneling rules for all the other apps on your device, excluding the ones you manually set split-tunneling settings for.

To adjust the settings for other apps, click the dropdown menu next to All Other Apps and choose either Bypass VPN or Use VPN.The "All Other Apps" split-tunneling feature in the ExpressVPN macOS app, showing the "Bypass VPN" and "Use VPN" choices.

Enable Split Tunneling on your Mac

Your Mac may block the system extension required for split tunneling until you manually allow it. If you see a notification that the extension was blocked, follow the steps below:

  1. Open System Settings.The "System Settings" option on macOS.
  2. Click General, and then click Login Items & Extensions.The "General" settings on macOS, showing the "Login Items & Extensions" option.
  3. Scroll down to Network Extensions, click the info (i) button, and toggle ExpressVPN Split Tunnel on.Mac Network Extensions Settings showing the ExpressVPN Split Tunnel extension
  4. Enter your password or use Touch ID to confirm.The Network Extension options on macOS, showing the popup prompt to use touch ID or enter a password to confirm a System Extension modification.
  5. If prompted, click Allow to enable ExpressVPN to add proxy configurations, then click Done.Mac Network Extension Settings, showing the popup window requesting permission to allow proxy configurations for ExpressVPN Split Tunnel.

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

How to use VPN split tunneling on Linux

To change your split-tunnel settings:

  1. Click Profile, then Split Tunneling.The Profile tab in the ExpressVPN Linux app, highlighting the "Split Tunneling" option.
  2. Toggle Split tunneling on.The Split Tunneling settings in the ExpressVPN Linux app, showing the "Split tunneling" toggle.

From there, you can adjust your split tunneling settings. Expand the list below to learn more about each settings option:

Add apps

  1. Click Add App.The "Add App" option in the Split tunneling settings on the ExpressVPN Linux app.
  2. Click the app you want to set up split tunneling rules for, then click Open.The application pop-up in the ExpressVPN split-tunneling settings on Linux, showing an app selected and the "Open" button highlighted.
  3. Click the dropdown next to the app you just added. Then, choose either Bypass VPN or Only VPN.The "Bypass VPN" and "Only VPN" options for apps in the split tunneling settings on the ExpressVPN app on Linux.

Add IP addresses

  1. Click Add IP.The "Add IP" option in the Split tunneling settings on the ExpressVPN app in Linux.
  2. Enter an IPv4/IPv6 address or a subnet in CIDR notation, and click OK.The "Add IP Address" pop-up in the ExpressVPN split tunneling settings on Linux.

Note: Excluding an IP address from the VPN will not work reliably for large websites. This is because these services do not use a single fixed IP address. The IP address of the same website can be different every time you look it up, and the same IP address can be shared by multiple unrelated websites. As a result, the split tunneling rule may apply to websites you did not intend to exclude from the VPN.

Warning: Whitelisting public IPs (e.g., social networks) poses a privacy risk, as shared public IP infrastructure can expose your data to unrelated sites. Only whitelist private IPs you trust.

All other apps

This option enables you to decide the split tunneling rules for all the other apps on your device.

To adjust the settings for other apps, click the dropdown menu next to All Other Apps, and choose either Bypass VPN or Use VPN.The "All Other Apps" feature in the split tunneling settings on the ExpressVPN app on Linux, showing the "Bypass VPN" and "Use VPN" options.

The CLI app on Linux lets you split tunnel apps only. You can choose which apps use the VPN and which apps bypass it when you are connected to ExpressVPN. 

To enable split tunneling, run the command:

expressvpnctl set splittunnel true

Once enabled, you can decide which apps bypass the VPN and which apps use the VPN.

To get the path of an app, run the command:

which app-name

In the case of Firefox, the command can be “which firefox.” This can result in:

/usr/bin/firefox

To add apps to bypass the VPN

Run the command:

expressvpnctl set split-app bypass:ROUTE/TO/APPLICATION/EXECUTABLE

For example, if you wanted the VPN to bypass Firefox, you would run the command:

expressvpnctl set split-app bypass:/usr/bin/firefox

To add apps to use the VPN

Run the command:

expressvpnctl set split-app vpn:ROUTE/TO/APPLICATION/EXECUTABLE

For example, if you wanted the VPN to use Firefox, you would run the command:

expressvpnctl set split-app vpn:/usr/lib/firefox/firefox

To delete split tunneling rules for an app, run the command:

expressvpnctl set split-app remove:ROUTE/TO/APPLICATION/EXECUTABLE

Need help? Contact the ExpressVPN Support Team for immediate assistance.

Back to top

Was this article helpful?

We're sorry to hear that. Let us know how we can improve.

A member of our Support Team will follow up on your issue.