Why split tunneling stops working
Split tunneling lets you route some traffic through a VPN while other apps or destinations use your normal internet connection.
When it fails, the cause is usually a settings conflict, a routing issue, or a network policy blocking the expected path.
This guide explains how to fix split tunneling not working across Windows, macOS, Android, and common VPN clients so you can isolate the problem quickly.
Check whether the VPN actually supports split tunneling
Not every VPN service supports split tunneling in the same way.
Some providers offer app-based exclusion, others support only per-app inclusion, and some disable the feature on specific protocols or operating systems.
- Open the VPN app and confirm that split tunneling is included in your subscription or plan.
- Check the provider’s support page for OS limits, such as macOS restrictions or Android-only availability.
- Verify whether the feature works with the selected protocol, such as OpenVPN, WireGuard, or IKEv2.
If your provider recently updated its app, the feature may have moved to a different menu or reset after the update.
Restart the VPN app and refresh the connection
A simple reconnect can fix stale routes, cached DNS entries, and incomplete policy changes.
Split tunneling often depends on the VPN client pushing updated route tables to the operating system, and that process can fail silently.
- Disconnect the VPN.
- Close the VPN app completely.
- Restart the device.
- Reconnect the VPN and test the excluded and included apps again.
If the problem began after an update or network change, a clean restart is especially important.
Verify the split tunneling rules
Most split tunneling issues come from incorrect rules.
The app may be set to route the wrong applications through the tunnel, or the exclusions may be pointing to the wrong executable file.
Common rule mistakes
- Selecting a shortcut instead of the actual app executable.
- Adding a browser profile instead of the browser binary.
- Excluding the app, but not its helper service or background process.
- Using domain-based rules when the VPN client only supports app-based rules.
On Windows, some VPN clients require the exact .exe path.
On macOS, you may need to allow the full application bundle, not just a launcher.
Test DNS behavior
Split tunneling can appear broken when DNS requests still go through the VPN or leak to the local network unexpectedly.
This often causes apps and websites to behave inconsistently, especially with streaming services, internal portals, or region-specific sites.
- Open a DNS leak test site and compare the results with your VPN and without it.
- Check whether the VPN forces its own DNS servers.
- Disable custom DNS temporarily to see if the issue is caused by a conflict.
If apps load slowly or resolve to the wrong region, flush the DNS cache on the device after changing split tunnel settings.
Inspect firewall, antivirus, and endpoint security settings
Security tools often interfere with tunneling rules.
Windows Defender Firewall, third-party antivirus suites, and enterprise endpoint protection can block route changes or prevent the VPN client from attaching per-app policies.
- Temporarily disable firewall rules that block the VPN app.
- Allow the VPN client through antivirus web protection.
- Check whether your company uses a device management profile that overrides local VPN settings.
In managed environments, split tunneling may be restricted by Intune, Jamf, Zscaler, Cisco Secure Client, or another security stack.
Update or reinstall the VPN client
Outdated software is a frequent reason split tunneling not working persists after basic troubleshooting.
Bugs in the client, operating system compatibility problems, or damaged configuration files can all affect routing behavior.
- Install the latest version of the VPN app from the provider.
- Update the operating system, especially after major releases.
- Sign out, uninstall the app, reboot, and reinstall it if settings seem corrupted.
If the VPN app supports diagnostics or logs, review them for route assignment errors, permission failures, or unsupported protocol warnings.
Rebuild the routing and network stack
When split tunneling rules are correct but traffic still goes the wrong way, the device’s network stack may be stuck.
Resetting network components can clear bad routes, corrupted adapters, and lingering virtual interfaces.
Windows checks
- Run the VPN client as an administrator.
- Disable and re-enable the VPN adapter in Network Connections.
- Use netsh winsock reset and reboot if routes seem corrupted.
macOS checks
- Remove and re-add the VPN configuration profile.
- Restart network services by toggling Wi-Fi off and on.
- Confirm that System Settings has granted the VPN app the required permissions.
Android and iPhone checks
- Verify that Always-on VPN or Block connections without VPN is not overriding split tunneling.
- Clear the app cache on Android if the client stores stale rules.
- Recreate the VPN profile if the configuration has become unstable.
Check protocol and tunneling mode limitations
Some VPN protocols behave differently with split tunneling.
WireGuard, OpenVPN, and IKEv2 may expose different route behaviors depending on how the client implements per-app exclusions.
Protocol mismatches can also affect features such as IPv6 handling, local LAN access, and route precedence.
If your VPN app offers multiple protocols, test each one to see whether the feature works consistently.
- Try switching from automatic selection to a specific protocol.
- Test with IPv6 disabled if the VPN only supports IPv4 split routes.
- Look for a setting that allows local network traffic or LAN access.
Confirm the app or service is not forcing its own proxy
Some browsers, business apps, and cloud tools use their own proxy settings or secure tunnels.
In those cases, the VPN’s split tunneling rules may not control traffic as expected because the app is already using a separate network path.
- Check browser proxy settings.
- Review enterprise app connectors and PAC file settings.
- Disable built-in secure DNS or DoH features temporarily for testing.
When traffic is routed by a proxy, the VPN client may only affect the outer connection, not the destination routing you expect.
Use logs to pinpoint the failure
Logs are the fastest way to identify whether the problem is rule-based, permission-based, or route-based.
Most major VPN apps include a diagnostics or support log export option.
Look for entries related to route injection, policy application, driver failures, DNS resolution, and permission errors.
If the same app works on one device but not another, compare the logs to isolate the operating system or security setting that differs.
Quick checklist for fixing split tunneling
- Confirm the VPN supports split tunneling on your device and protocol.
- Restart the VPN app, reconnect, and reboot the device.
- Review exact app paths and rule types.
- Test DNS behavior and flush caches.
- Temporarily disable conflicting firewall or antivirus features.
- Update or reinstall the VPN client.
- Reset network routes or VPN profiles if needed.
- Check protocol, IPv6, proxy, and managed-device restrictions.
If you still cannot isolate traffic correctly after these checks, the issue is likely in the VPN provider’s client implementation or in an organization-wide security policy that overrides local settings.