Which Mac VPNs have split tunneling?

Split tunneling means some traffic goes through the VPN and the rest doesn't. On Windows and Android nearly every provider offers it. On macOS the picture is patchier, and a lot of what's written about it online is out of date.

Every row below is checked against the provider's own documentation, linked at the bottom. Last verified August 2026.

The part the tables usually miss

Every provider above does split tunneling the same way round: your whole Mac joins the VPN, and you list apps to exclude from it. The tunnel is the default and exclusions are the exception.

That matters more than it sounds. If the VPN drops, or you forget to connect, or an app you didn't think about starts talking, the default is that your traffic is going through another country. You're opting things out of a decision that's already been made for the whole machine.

The other model is the opposite: your Mac stays on its normal connection, and individual apps opt in. Nothing is tunneled unless you asked for it. If the tunnel drops, the apps you picked lose connectivity rather than silently falling back. That's how VPNonly works, and it's the reason it exists.

The other difference: it's tied to your provider

Every feature in that table only works with that company's own service. Surfshark's Bypasser doesn't help if you're on Mullvad. If you switch providers, or run two, or use a WireGuard server you host yourself, you start again.

A separate tool sits above all of them. VPNonly takes a WireGuard config from any provider — Mullvad, Proton, IVPN, AirVPN, your own server — or a NordVPN access token, and routes per app the same way regardless.

Tested end to end with VPNonly: NordVPN and Mullvad, exit address verified in both cases. Surfshark, Proton, IVPN and AirVPN all publish standard WireGuard configs, which is exactly what the import takes, but those rows come from their documentation rather than from a test on this Mac. We'll say which is which.

So which should you use?

• If you're on ExpressVPN, Surfshark, Mullvad or Windscribe and the exclude model suits you, use what you already pay for. It's included, and there's no reason to buy anything else.
• If you're on NordVPN, there's nothing in the Mac app to use. That's the gap this site was built for.
• If you want apps to opt in rather than opt out, or you use more than one provider, a per-app router is the different shape of tool.

One thing worth noticing: Proton's macOS implementation also requires restarting each app after you connect. That isn't a Proton failing, it's macOS. An app's network identity is fixed when it launches, so anything doing per-app routing has to relaunch it once. VPNonly has the same constraint, and explains why here.

One limit that applies to all of them

Safari can't be split-tunneled by anything. WebKit hands its connections to separate system processes that macOS launches on its own, so they don't carry the app's identity, and no per-app router can match them. Proton documents this for their implementation, and it's true of VPNonly too. If you want a browser on a different exit IP, use Chrome, Firefox, Arc or Brave.

Sources

• NordVPN — Split tunneling (their feature page, which lists the supported platforms)
• ExpressVPN — Split tunneling
• Surfshark — How to use Bypasser on macOS
• Mullvad — Split tunneling with the Mullvad app
• Windscribe — Split tunneling
• Proton VPN — How to use split tunneling

If something here is wrong or has changed, tell me and I'll fix it. These pages get out of date quickly, which is most of the reason the rest of the internet's versions are wrong.

Get VPNonly for Mac — $19

The app’s exact privileged engine source is public and MIT licensed.