Use split tunnelling when an approved application needs a different network path from the rest of the device. An excluded application's traffic bypasses the VPN, so record the reason for each exception and keep the list narrow.
01 Configure and test an exception
- Confirm that the current app and operating system support the required type of split tunnelling. Do not assume that a feature documented for Windows exists in the same form on macOS or iOS.
- On the supported Windows app, open Settings > Split tunneling, enable it and choose Add apps. Select the intended application, or use the available browsing option to locate it.
- On Android, open the app's settings and its VPN connection or connection-security area, then Split tunneling. Select only the applications intended to bypass the VPN.
- Check the displayed routing mode before saving. The selected list must match the intended excluded or included applications.
- Reconnect and restart the affected application if needed. Test its actual task while separately confirming that a non-excluded application still uses the VPN.
- Review Kill Switch interaction and remove the exception if it no longer serves a required purpose.
Common questions
Why is my application missing from the Windows list?
The documented list can show currently open applications. Open the application or use the supported browsing option, and select the correct executable.
Is Linux Allowlist the same feature?
No. Nord documents port and subnet exceptions rather than the same per-application selection. Those rules can affect matching traffic in both directions and need separate network review.
Why does an excluded app still fail?
DNS behaviour, Kill Switch interaction or the destination service can still affect it. Record the app, platform and test result for support instead of broadly excluding more traffic.