The term "split tunneling" is used to describe when you want some of your programs to use the VPN while allowing the rest of your traffic to travel via your regular Internet connection. This guide explains how to set up split tunneling so that everything goes outside of the VPN tunnel by default, or so that everything goes inside the VPN tunnel by default.
See also our guide for Split tunneling with the Mullvad app (Android and Linux).
Prerequisites
First you need to have set up OpenVPN in your operating system. See the corresponding guide here:
OpenVPN installation on Windows
Option 1: How to route everything outside of the VPN by default
You will use SOCKS5 proxies for the programs that you want to travel via the VPN.
DNS configuration
Warning: Firefox does leak DNS requests outside the SOCKS5 proxy even if you have remote DNS enabled, make sure you have set your system to use a DNS that is going through the VPN to not risk leaking DNS requests to your ISP. Our public DNS server IP is 193.138.218.74.
Linux using OpenVPN
Edit /etc/openvpn/mullvad_xx.conf and add
route-nopull
route 10.0.0.0 255.0.0.0
route 193.138.218.74 255.255.255.255
Reconnect.
Follow the SOCKS5 guide guide for how to configure your clients that should go out via the VPN.
Windows using OpenVPN
Copy mullvad_xx.ovpn from C:\Program Files\OpenVPN\config\ or C:\Program Files(x86)\OpenVPN\config\ to the desktop, then edit it to add the following:
route-nopull
route 10.0.0.0 255.0.0.0
route 193.138.218.74 255.255.255.255
Save it, and then copy it back to C:\Program Files\OpenVPN\config\ or C:\Program Files(x86)\OpenVPN\config\
Click Yes on the permission requester.
Reconnect.
Follow the SOCKS5 guide for how to configure your clients that should go out via the VPN.
MacOS using Tunnelblick (OpenVPN)
Right click on the Mullvad.tblk file (found inside the downloaded Zip file) and choose "Show Package Contents". Find the file mullvad_xx.conf and open it in TextEdit.
Add the following options to it:
route-nopull
route 10.0.0.0 255.0.0.0
route 193.138.218.74 255.255.255.255
Save the file, and then import this profile into Tunnelblick
Follow the SOCKS5 guide for how to configure your clients that should go out via the VPN.
Option 2: How to route everything via the VPN by default except certain IP addresses
Note: Remove the three lines from the examples above if you have added them.
In this example we will not route www.chalmers.se through the VPN.
First figure out the IP address that you want to go outside the VPN tunnel, in this case it is www.chalmers.se
Open up a terminal / command prompt and run nslookup www.chalmers.se.
It should respond with
Server: 10.137.8.1
Address: 10.137.8.1#53
Non-authoritative answer
Name: www.chalmers.se
Address: 129.16.71.10
As you can see, it only has one IP address, 129.16.71.10, so we will add this using OpenVPN.
- Edit the OpenVPN configuration / Profile
- Add
route 129.16.71.10 255.255.255.255 net_gateway - Save changes.
- Restart OpenVPN connection.
Troubleshooting
- Are you able to ping 10.8.0.1? If you get responses then the connection to the VPN server is working.
- Are you not able to get DNS lookups through? In a terminal window, run
nslookup sunet.seand check which server it tries to use as well. - Either set your DNS to 10.8.0.1 or 193.138.218.74 to make sure the DNS requests goes via the VPN tunnel.
- If your browser works with SOCKS5 enabled works but fails without, then it is most likely a DNS issue.