Split tunneling with the Mullvad app

Split tunneling allows you to exclude some apps from the VPN so they will use your regular Internet connection and your own IP address. This will for example allow you to access some websites that are blocking VPN services. Split tunneling is included in the Mullvad VPN app for Windows, Linux, macOS and Android.

What this guide covers

• Mullvad app for Windows
• - Unsupported apps
• Mullvad app for Linux
• Mullvad app for macOS
• Mullvad app for Android
• DNS
• FAQ

Mullvad app for Windows

How to enable split tunneling

1. Go to the app settings by clicking on the gear icon in the top right corner.
2. Click on Split tunneling.
3. Click on the plus icon on the right side of an app.
4. If an app is missing, scroll down to the bottom of the window and click on Find another app.

To test that it's working, exclude a web browser and visit our Connection check. It should say "Not using Mullvad VPN".

Split tunneling not working?

Some apps and services are known to prevent all excluded apps from using the Internet. If this happens, make sure to disable or uninstall the following:

• Intel Killer Control Center (Killer Analytics Service and Killer Network Service)
• Winaero Twеaker (if you have enabled TCP/IP Router)
• Proxifier
• GoodBuyDPI
• Kaspersky

Plex Media Server

If you exclude Plex Media Server and open it in a web browser, then the web browser may be excluded from the VPN too.

Thunderbird

If you click on a link in a mail that opens Firefox or another web browser then that web browser may be excluded from the VPN too.

Web browsers and download managers

If you download an installer from an excluded web browser or download manager and start the installer from inside it, then the installer will likely also be excluded when it runs. Some installers may use Internet connectivity, for example the Telegram app installer. It will then not go through Mullvad VPN. We recommend that you start any installers from the Windows Explorer and not from inside an excluded app.

Docker

Docker works with TCP ports only, not UDP. See our blog post: The limitations of split tunneling.

Unsupported apps

Some apps and games are difficult or impossible to exclude. We have received reports about the following:

• Games and apps that use Java:
  Minecraft: Java Edition
• Games that use anti-cheat technology:
  Apex Legends
  Warhammer 40k Darktide
  Helldivers 2
• Voice chat provided by Vivox in many games, for example:
  Overwatch
  Rainbow Six Siege
  Valorant
• Parsec

Windows Store apps

You can not exclude Windows Store apps. Check if the app has a normal Windows installer available. If it's possible to use the app/service in your web browser instead then you can exclude the web browser.

DNS

See the section about DNS in the bottom of this guide.

Mullvad app for Linux

How to enable split tunneling

1. Go to the app settings by clicking on the gear icon in the top right corner.
2. Click on Split tunneling.
3. Click on an app to launch it.

To test that it's working, launch an excluded web browser and visit our Connection check. It should say "Not using Mullvad VPN".

Symbols

Some apps like web browsers show a yellow exclamation mark to remind you to first close the app if it's already running. A red exclamation mark means that the app can't be used with split tunneling.

Using the CLI

You can also use split tunneling with the Mullvad CLI with the commands mullvad-exclude and mullvad split-tunnel. See the guide How to use the Mullvad CLI.

Tips

To launch excluded apps from the desktop you can create .desktop files and add mullvad-exclude in front of the Exec command.

To exclude Flatpak apps you can use a command similar to this:

mullvad-exclude flatpak run com.brave.Browser

DNS

See the section about DNS in the bottom of this guide.

Mullvad app for macOS

Split tunneling was added to version 2024.4 of the Mullvad VPN app for macOS. Note that split tunneling requires macOS 13 or newer.

How to enable split tunneling

1. Go to the app settings by clicking on the gear icon in the top right corner.
2. Click on Split tunneling.
3. Click on the plus icon on the right side of an app.
4. If an app is missing, scroll down to the bottom of the window and click on Find another app.

To test that it's working, exclude a web browser and visit our Connection check. It should say "Not using Mullvad VPN".

Safari

It is not possible to exclude Safari or other apps that use WebKit.

Servers (SSH, Plex etc)

Split tunneling on macOS only allows outgoing connections, not incoming connections.

DNS

See the section about DNS in the bottom of this guide.

Mullvad app for Android

How to enable split tunneling

1. Go to the app settings by tapping on the gear icon in the top right corner.
2. Tap on Advanced and then Split tunneling.
3. Select the apps to exclude from the VPN.

To test that it's working, exclude a web browser and visit our Connection check. It should say "Not using Mullvad VPN".

Split tunneling not working?

The excluded apps will not work if you have enabled Block connections without VPN in the Android settings.

DNS

When you exclude an app with Split tunneling it will still use the DNS server on the Mullvad server that you are connected to. If this is a problem with the website or service you are using then you can change it using one of the following methods:

1. Use a DNS over HTTPS service in your web browser.

2. Enable Use custom DNS server in the Mullvad app settings and set it to use a third party DNS server that you feel comfortable using, for example 9.9.9.9 or 1.1.1.1. This works when WireGuard protocol is selected in the Mullvad app, not OpenVPN protocol. Note that this will affect both excluded apps and apps that are using the VPN. Our Connection check will show a DNS leak when it's not using our DNS.

FAQ

Q: Will you add inverse/reverse split tunneling to the Mullvad app?

A: We are not planning to add this currently because we believe that a VPN should be used by default and not by exception.

Q: Will you add split tunneling to the iOS / iPadOS app?

A: It is not possible to do this currently.