Windows VPN Update: Users gain app-level control

Proton and Nord have activated split tunneling capabilities for their Windows clients, giving users direct control over which applications bypass the virtual private network. The feature allows specific programs to connect directly to the internet while others remain routed through the encrypted bridge.

This development addresses a common friction point for VPN users who face a trade-off between privacy and performance. While a VPN obscures browsing activity from internet providers and local network observers, the encryption process can reduce connection speeds. By enabling split tunneling, users can keep bandwidth-intensive or location-sensitive applications outside the tunnel without manually toggling the service on and off.

The implementation follows an app-based model. In the ProtonVPN interface, a split tunneling option appears on the right side of the main console, positioned near settings for the kill switch and port forwarding. Once enabled, users can designate specific apps to include in the tunnel or exclude from it. The NordVPN client requires users to click the cog icon in the bottom left corner and flip the split tunneling toggle. Both services allow users to select which applications receive protection.

For many consumers, this feature resolves issues with local device connectivity and geo-location accuracy. A gamer seeking the lowest possible latency might keep a game client outside the VPN while leaving a banking app protected. Similarly, a user checking local movie showtimes can exclude the ticketing app so it reflects their true physical location rather than the server location masked by the VPN. Smart home devices and printers on the same local network also become more accessible when the main application is excluded from the tunnel.

While app-based routing is the standard for consumer software, other methods exist. URL-based tunneling sets rules by domain name, allowing a user to protect a search engine but leave a local news site unprotected. Route-based and policy-based tunneling, which rely on IP addresses and broader rule sets, remain largely relevant to enterprise environments rather than individual users.

Mobile platforms offer similar controls, though with fewer options. Android devices and desktops allow for granular app selection. iPhones typically limit users to excluding specific websites and IP addresses rather than individual applications. For most users, configuring these settings is a one-time task that places protection where it is needed and removes it where it is not.