Split tunnelling: one machine, two countries, at once
Split tunnelling lets you send some applications through the VPN while others keep your normal connection — useful when your bank blocks foreign IPs, or when a local service breaks under a VPN. It is also the feature that is easiest to claim and hardest to prove, so here is what it looks like when it works.
Two browsers, side by side
Both windows are on the same IP-checking page, on the same machine, at the same moment. Microsoft Edge is routed through the tunnel and reports Paris, Île-de-France, France on a Scaleway address. Google Chrome is excluded and keeps the real Ukrainian connection. The Windows notification in the corner confirms what the client connected to: FR – Paris 2 over IKEv2.
How ZoogVPN splits, per platform
Windows and Android split traffic by application — you choose which programs go through the tunnel. The iOS and macOS clients split by service, domain or IP address instead, with a preset picker for common services and a manual list for anything else. Same feature name, genuinely different mechanics, and worth knowing before you assume your rules transfer between your laptop and your phone.
The catch nobody mentions
On Windows, split tunnelling and the kill switch are mutually exclusive — turning one on disables the other, with a warning dialog. That is the caveat we would most want a reader to leave with, because the person who most wants split tunnelling is often the person who assumes the kill switch is still quietly protecting everything else. It is not.
The excluded application keeps your real address. That is the feature working correctly and it is also exactly how someone leaks themselves — by putting the wrong application on the wrong side of the rule.
Scope of this test
- Windows only. We have no recording of split tunnelling on macOS, iOS or Android.
- Browsers only. Rules for non-browser applications were not exercised.
- Protocol note. This ran under IKEv2. ZoogVPN's iOS and macOS clients state that split tunnelling there requires the Shadow protocol — a platform difference to check before assuming either behaviour is universal.