Split tunneling means dividing your traffic: some apps use the VPN, others connect normally. On Windows it's a checkbox in most VPN apps. On the Mac it's nearly extinct — and searching for it leads to years-old forum threads and support pages that quietly say "Windows and Android only". This guide covers the whole landscape: what split tunneling is, which providers support it on macOS, why the platform is different, and how to get true per-app routing with whatever VPN you already pay for.
What split tunneling actually does
A VPN normally claims your Mac's default route: every connection from every app enters the tunnel. Split tunneling breaks that monopoly. You decide per app (or per destination) what goes through the tunnel and what goes around it. A third option — blocking an app outright — turns the same machinery into a per-app firewall.
- Privacy where it counts — tunnel the browser and torrent client, leave video calls on the fast path.
- Speed where it matters — big downloads, game clients and backups skip the VPN detour.
- Fewer VPN headaches — banking apps and streaming services that block VPN IPs can go direct while everything else stays covered.
- Local devices keep working — printers, NAS and AirPlay don't vanish when the tunnel comes up (details).
Which VPNs support split tunneling on macOS in 2026?
The short version: almost none. Here's the provider-by-provider state of play, each with a full guide:
- NordVPN — Windows and Android only; no split tunneling in the macOS app.
- ExpressVPN — Mac split tunneling only on macOS 10.15 and earlier; unavailable on modern macOS.
- Surfshark — Bypasser exists on Windows and Android; not in the macOS app.
- Proton VPN — Windows and Android only.
- Mullvad — Windows, Linux and Android; deliberately not on macOS.
- Private Internet Access — limited/unavailable on modern macOS.
- CyberGhost — Windows and Android only.
- Windscribe — Windows and Android only.
Why is split tunneling so rare on the Mac?
Blame architecture, not neglect. Implementing per-app routing on macOS means building a Network Extension — a sandboxed system extension that macOS hands connections to as a transparent proxy. It's a different codebase from a Windows filter driver, with its own approval flow, entitlements and edge cases. Most VPN vendors, selling to a mostly-Windows market, never make the investment — so their Mac apps stay all-or-nothing. The full technical story: How per-app VPN routing works on macOS.
How to get split tunneling on your Mac today
You don't need to switch VPN providers. AppLanes is a dedicated split-tunneling utility for macOS 13+: it works alongside any VPN and gives every app one of three lanes — VPN, Direct, or Block — with a live activity monitor showing each connection's route and per-app leak protection when the tunnel drops.
- Install AppLanes from the Mac App Store — the 3-day free trial unlocks every feature, no account needed.
- Approve the network extension once (macOS prompts you; onboarding walks through it).
- Connect your usual VPN and pick a default route — everything-VPN or everything-Direct.
- Add per-app exceptions and watch them take effect live in the Activity view.
Popular setups
- Exclude one app from the VPN — everything protected except the apps that hate tunnels.
- Only the browser through the VPN — private browsing, full speed everywhere else.
- Block an app from the internet entirely — a per-app firewall for updaters and telemetry.
- Keep printers and NAS reachable — LAN bypass for local devices.
Frequently asked questions
Is split tunneling safe?
Split tunneling is a trade-off you control: apps routed outside the VPN use your real IP, by your explicit choice, while tunneled apps stay protected. Per-app leak protection can hold VPN-routed apps' traffic if the tunnel drops, so protected apps never silently leak.
Does macOS have built-in split tunneling?
No. macOS offers per-app VPN scoping only in device-management (MDM) contexts for enterprises. For a personal Mac there is no built-in per-app VPN control — it requires a Network Extension–based utility like AppLanes.
Do I need a specific VPN protocol for split tunneling to work?
No — AppLanes works with any VPN that creates a standard tunnel on macOS: WireGuard, OpenVPN, IKEv2/IPsec, and the apps from major providers.
What does AppLanes cost?
AppLanes has a 3-day free trial with everything unlocked — unlimited rules, app blocking, leak protection, full activity feed. After that it's $2.99/month or $19.99/year, billed through the Mac App Store.
Get per-app VPN routing on your Mac
Every feature unlocked for 3 days, free — no account, works with any VPN, macOS 13+.