How to route only selected apps through Proton VPN on Windows
If you want the opposite behavior, use inverse split tunneling. This is useful when only one app needs VPN protection and you do not want the rest of your device to use the VPN.
Open Proton VPN on Windows.
Go to Settings and enable Split tunneling.
Select the mode that sends only included apps through the VPN tunnel.
Add the apps that should use Proton VPN.
Connect or reconnect to a Proton VPN server.
A common example is routing a download client, browser profile, or testing tool through Proton VPN while leaving all other desktop traffic outside the tunnel. Be careful with this setup: any app you forget to include will not be protected by the VPN.
How to include or exclude IP addresses
App rules work well when you know the exact program you want to control. IP rules are better when you need to route traffic to a specific server, local device, or network address.
Exclude an IP address from the VPN
Use IP exclusion when you want a specific address to stay reachable outside the VPN tunnel. This is common for local network devices such as routers, printers, media servers, or NAS devices.
Open Proton VPN and go to the split tunneling settings.
Choose the option to exclude IP addresses from the VPN tunnel.
Enter the IP address you want to bypass the VPN.
Save the rule and reconnect the VPN.
Test the service or device to confirm the route works as expected.
Include only selected IP addresses in the VPN on Windows
On Windows, inverse split tunneling can also be used for protonvpn IP addresses. This sends only traffic to selected IP addresses through Proton VPN while other traffic uses your normal connection.
Enable split tunneling in the Proton VPN Windows app.
Select the inverse mode that includes only chosen apps or IP addresses in the VPN tunnel.
Add the IP address that should use Proton VPN.
Reconnect to Proton VPN.
Confirm the destination sees the VPN server IP, not your regular IP.
Be cautious when using IP-based rules for websites. Many websites use multiple IP addresses, content delivery networks, and changing server addresses. If you add only one IP, some parts of the site may still route differently than you expect.
How split tunneling works on Android
On Android, Proton VPN split tunneling is mainly used to exclude apps or IP addresses from the VPN tunnel. This is helpful when an app does not work well with VPNs or when a local device needs to be reached directly.
Open the Proton VPN Android app.
Go to the app settings.
Open the split tunneling option.
Turn split tunneling on.
Select the apps you want to exclude from the VPN.
Add any IP addresses that should bypass the VPN, if needed.
Reconnect the VPN connection.
For example, you could keep your browser protected by Proton VPN while excluding a banking app that blocks VPN traffic. The excluded Android app will use your normal network connection instead of the VPN server.
If you want the opposite behavior, use inverse split tunneling. This is useful when only one app needs VPN protection and you do not want the rest of your device to use the VPN.
Open Proton VPN on Windows.
Go to Settings and enable Split tunneling.
Select the mode that sends only included apps through the VPN tunnel.
Add the apps that should use Proton VPN.
Connect or reconnect to a Proton VPN server.
A common example is routing a download client, browser profile, or testing tool through Proton VPN while leaving all other desktop traffic outside the tunnel. Be careful with this setup: any app you forget to include will not be protected by the VPN.
How to include or exclude IP addresses
App rules work well when you know the exact program you want to control. IP rules are better when you need to route traffic to a specific server, local device, or network address.
Exclude an IP address from the VPN
Use IP exclusion when you want a specific address to stay reachable outside the VPN tunnel. This is common for local network devices such as routers, printers, media servers, or NAS devices.
Open Proton VPN and go to the split tunneling settings.
Choose the option to exclude IP addresses from the VPN tunnel.
Enter the IP address you want to bypass the VPN.
Save the rule and reconnect the VPN.
Test the service or device to confirm the route works as expected.
Include only selected IP addresses in the VPN on Windows
On Windows, inverse split tunneling can also be used for protonvpn IP addresses. This sends only traffic to selected IP addresses through Proton VPN while other traffic uses your normal connection.
Enable split tunneling in the Proton VPN Windows app.
Select the inverse mode that includes only chosen apps or IP addresses in the VPN tunnel.
Add the IP address that should use Proton VPN.
Reconnect to Proton VPN.
Confirm the destination sees the VPN server IP, not your regular IP.
Be cautious when using IP-based rules for websites. Many websites use multiple IP addresses, content delivery networks, and changing server addresses. If you add only one IP, some parts of the site may still route differently than you expect.
How split tunneling works on Android
On Android, Proton VPN split tunneling is mainly used to exclude apps or IP addresses from the VPN tunnel. This is helpful when an app does not work well with VPNs or when a local device needs to be reached directly.
Go to the app settings.
Open the split tunneling option.
Turn split tunneling on.
Select the apps you want to exclude from the VPN.
Add any IP addresses that should bypass the VPN, if needed.
Reconnect the VPN connection.
For example, you could keep your browser protected by Proton VPN while excluding a banking app that blocks VPN traffic. The excluded Android app will use your normal network connection instead of the VPN server.