Softonic spent the start of the summer arguing that split tunneling has become the single most useful feature any consumer VPN can ship: full control over which apps route through the tunnel, no need to pause the VPN to log into a bank, and noticeable speed gains on the connections you leave outside. The catch is that the feature is uneven across desktops. Some VPNs only ship split tunneling on Windows. A few support macOS. Fewer still support Linux, and the ones that do often run it through a CLI rather than the GUI. We installed eight desktop VPN clients on Windows 11, macOS Sequoia, and Ubuntu 24.04, and ranked them on whether the split tunnel actually works the way it advertises.
Each pick below ships a real split tunnel on at least one of the three desktop OSes. We flagged the gaps explicitly so the table tells you whether the app fits the OS you actually run.
What to look for in split tunneling on desktop
The category looks uniform until you try to configure it. Five criteria separate the picks below from the long tail of half-shipped split tunnels:
- App-level versus IP-level. App-level routes specific binaries through or around the tunnel. IP-level routes by destination. Power users need both.
- Inverse versus standard. Standard mode picks the apps that bypass the VPN. Inverse mode picks the apps that use it. Inverse is the right default for privacy.
- OS coverage. Windows is universally supported. macOS and Linux are not. Read the OS column before you buy.
- Kill switch interaction. Kill switches that ignore the split tunnel will cut your bypassed apps too. The good ones do not.
- DNS leakage. A split tunnel that lets a “bypassed” app leak through the encrypted DNS resolver defeats the privacy goal.
Quick comparison
| App | Best for | Split tunnel OS coverage | Free plan | Starting price |
|---|---|---|---|---|
| Proton VPN | Privacy-first split tunneling | Windows, Linux CLI | Yes, no data cap | From $2.99/mo on long plans |
| NordVPN | Broad desktop coverage | Windows, macOS, Linux | No | From $3.39/mo |
| Surfshark | Unlimited devices | Windows, macOS | No | From $2.19/mo |
| Mullvad | Flat-rate, no account | Windows, Linux, macOS | No | Flat €5/mo |
| Windscribe | Generous free tier | Windows, macOS | 10 GB/mo free | From $5.75/mo |
| ExpressVPN | Polished cross-platform client | Windows, macOS, Linux router only | No | From $4.99/mo |
| IVPN | Minimalist privacy buyer | Windows, macOS, Linux | No | From $2.00/mo for 2 devices |
| hide.me VPN | Free split tunneling | Windows, macOS, Linux CLI | 10 GB/mo free | From $2.59/mo |
The 8 best VPNs with split tunneling for desktop
1. Proton VPN, best for privacy-first split tunneling
Proton VPN ships split tunneling on Windows and via the Linux CLI, both at app level and IP level, with inverse mode included. The implementation respects the kill switch in the way you want: bypassed apps still work when the tunnel drops, tunneled apps do not. Privacy posture is the cleanest in the category, with a Swiss jurisdiction, a published no-logs audit, and open source clients across every platform.
Where it falls short: macOS does not yet ship split tunneling in the GUI. Linux runs split tunneling via the CLI only.
Pricing:
- Free: unlimited data, three countries, no split tunneling
- Paid: Proton VPN Plus from $2.99 per month on a two-year plan unlocks split tunneling, the Secure Core relay chain, and Tor over VPN
Platforms: Windows, macOS, Linux, plus Android and iOS
Download: protonvpn.com · GitHub
Bottom line: The default pick for buyers who care about the audit trail as much as the feature checklist, and who run Windows or Linux as their daily driver.
2. NordVPN, best for broad desktop coverage
NordVPN is the only mainstream VPN that ships split tunneling on all three desktop OSes through the GUI. The Windows client implements it as a standard allow-or-deny list per process. The macOS client added it in 2024, and the Linux client supports both app-level and route-based exclusion. Threat Protection layers in DNS-based ad and tracker blocking that respects the split tunnel boundary.
Where it falls short: Two-year billing is required to hit the headline price. The macOS implementation is newer and has fewer toggles than the Windows version.
Pricing:
- Free: no
- Paid: Basic from $3.39 per month on a two-year plan, Plus adds the password manager, Complete adds 1 TB encrypted storage
Platforms: Windows, macOS, Linux, plus iOS, Android, TV
Download: nordvpn.com · Microsoft Store
Bottom line: The right pick when the household has a Windows desktop, a MacBook, and at least one Linux laptop, and you want the same split-tunnel UX on all three.
3. Surfshark, best for unlimited devices
Surfshark ships split tunneling under the “Bypasser” name, app level and IP level, on Windows and macOS. The standout is the per-website routing on the desktop browser extension, which solves the case where a single site needs the local IP but the rest of the browser does not. Unlimited simultaneous connections per account makes Surfshark the right pick for a multi-user household.
Where it falls short: Linux desktop has no GUI Bypasser yet, only a CLI. Audits trail Proton VPN and Mullvad in depth and frequency.
Pricing:
- Free: no
- Paid: Starter from $2.19 per month on a 27-month plan, Surfshark One adds antivirus and breach alerts
Platforms: Windows, macOS, Linux CLI, plus iOS, Android
Download: surfshark.com · Microsoft Store
Bottom line: The pick for a five-person household that wants split tunneling on Windows and Mac without a per-seat license fight.
4. Mullvad, best flat-rate, no-account split tunneling
Mullvad keeps its pricing structure refreshingly simple: €5 per month, flat, with a 16-digit account number instead of an email address. Split tunneling on Windows and Linux is app-level and inverse by default, which matches the privacy posture. The macOS client gained a working split tunnel in late 2024 and now matches the Windows feature set for routing rules.
Where it falls short: No long-term discount. No free trial.
Pricing:
- Free: no
- Paid: €5 per month, flat, paid by card or anonymously by cash or crypto
Platforms: Windows, macOS, Linux, plus iOS and Android
Download: mullvad.net · GitHub
Bottom line: The right pick for the buyer who reads the audit and the open source client repository before reading the marketing page.
5. Windscribe, best for the free tier
Windscribe is the rare VPN that ships split tunneling on the free tier. The Windows and macOS clients implement it as a per-IP route list, and the free plan ships 10 GB per month with access to ten countries. R.O.B.E.R.T., the DNS-based blocker, integrates cleanly with the split tunnel so the bypass exception still benefits from tracker blocking.
Where it falls short: Linux runs as a CLI without split tunneling in the GUI. Speed on the free plan is fine for browsing, not for 4K streaming.
Pricing:
- Free: 10 GB per month, split tunneling included
- Paid: Pro from $5.75 per month on annual billing, build-a-plan from $1 per location per month
Platforms: Windows, macOS, Linux CLI, plus iOS and Android
Download: windscribe.com · GitHub
Bottom line: The pick for buyers who want to try split tunneling before paying.
6. ExpressVPN, best for the polished cross-platform client
ExpressVPN ships split tunneling on Windows and macOS as a per-app inclusion or exclusion list, with the Lightway protocol keeping bypass-app routing fast. The Linux client supports per-router split tunneling rather than per-app; for desktop Linux split tunneling, look elsewhere. The audit cadence is solid, and the client UX is the most polished of the eight picks.
Where it falls short: Pricing is the highest on this list at full rate, and Linux desktop split tunneling is a router-only feature.
Pricing:
- Free: no
- Paid: 2-year plan from $4.99 per month, includes the password manager and a 30-day refund
Platforms: Windows, macOS, Linux (router only for split tunneling), plus iOS and Android
Download: expressvpn.com
Bottom line: The pick for buyers who want the most polished client and do not mind paying the premium.
7. IVPN, best for the minimalist privacy buyer
IVPN ships AntiTracker, a multi-hop route, and a per-app split tunnel called SplitTunnel on Windows, macOS, and Linux through the official CLI and GUI. The company publishes its no-logs audits, ships open source clients on every desktop, and accepts anonymous payment by cash or crypto. The two-device plan exists for the buyer who only needs a laptop and a phone.
Where it falls short: Smaller server footprint than NordVPN or Surfshark. No streaming-unblock guarantee.
Pricing:
- Free: no
- Paid: Standard plan from $2 per month for two devices, Pro plan with multi-hop and seven devices from $4 per month
Platforms: Windows, macOS, Linux, plus iOS and Android
Bottom line: The pick for the privacy buyer who wants three OSes, a real audit, and a one-page menu.
8. hide.me VPN, best free split tunneling
hide.me VPN ships a 10 GB-per-month free plan that includes split tunneling on Windows and macOS, with the Linux CLI client adding a per-app router. Speeds on the free plan are noticeably better than Windscribe’s, and the kill switch respects the split tunnel boundary cleanly on Windows.
Where it falls short: macOS only added split tunneling recently and the implementation lags Windows. Linux split tunneling lives entirely in the CLI.
Pricing:
- Free: 10 GB per month
- Paid: Premium from $2.59 per month on a two-year plan
Platforms: Windows, macOS, Linux, plus iOS and Android
Download: hide.me
Bottom line: The pick for buyers who want a working split tunnel on the free tier without the data cap that Windscribe applies first.
How to pick the right one
- Pick Proton VPN if the audit history matters as much as the feature list and you run Windows or Linux.
- Pick NordVPN if the household runs all three desktop OSes and you want the same UX on each.
- Pick Surfshark if more than four people share the account and need split tunneling on Windows or Mac.
- Pick Mullvad if you would rather pay a flat €5 with cash than answer email-verification prompts.
- Pick Windscribe if you want to test split tunneling before paying anyone.
- Pick ExpressVPN if the desktop client polish is worth the price premium.
- Pick IVPN if you want a minimalist tool with three-OS desktop coverage and a two-device plan.
- Pick hide.me if the free tier needs to ship a working split tunnel.
FAQ
What is VPN split tunneling and why does it matter?
Split tunneling lets a VPN client route some app or destination traffic through the encrypted tunnel and the rest through the regular connection. The point is to keep latency-sensitive or local-only services (banking, Chromecast, work intranets) unaffected while privacy-sensitive traffic still goes through the VPN.
Which desktop VPN has the best split tunneling on Linux?
NordVPN, Mullvad, and IVPN are the three that ship a GUI or CLI split tunnel on Linux today. Proton VPN supports it via the official Linux CLI. Surfshark, ExpressVPN, and hide.me support it on Linux only through the CLI or a router rule.
Does free Proton VPN include split tunneling?
No. Split tunneling is a paid-only feature on Proton VPN. The free plan ships unlimited data and three countries, but no split tunnel.
Can I split-tunnel by website rather than by app?
Surfshark’s Bypasser is the cleanest implementation per-website in a browser extension. NordVPN and Proton VPN both ship per-IP routing that achieves the same outcome by IP rather than by host.
Does split tunneling break the VPN kill switch?
It should not. Every pick above keeps the kill switch scoped to the apps inside the tunnel. Apps you have explicitly bypassed continue to work when the tunnel drops because they are not inside the kill-switch boundary in the first place.
