ProtonVPN and NordVPN Add App-Level Traffic Routing to Windows Clients

ProtonVPN and NordVPN have updated their Windows applications to allow users to route specific application traffic outside the encrypted VPN tunnel. This feature, known as split tunneling, grants users granular control over which digital activities remain protected and which connect directly to the internet. The update aims to resolve common friction points for users who rely on VPNs for privacy but face performance penalties or local network access issues.

A standard VPN creates an encrypted bridge for all data moving to and from a device, which prevents internet service providers and network observers from monitoring activity. However, this comprehensive coverage often reduces connection speed and can mask a user's physical location. For tasks like online gaming or checking local movie showtimes, that location masking or speed loss becomes a disadvantage. Split tunneling addresses these trade-offs by allowing selected applications to bypass the encryption layer entirely.

The most common implementation of this feature is app-based routing. A user can designate a banking application to travel through the VPN for security while allowing a weather application to connect directly, ensuring forecast data reflects the user's actual geographic location. This setup eliminates the need to manually toggle the VPN on and off when switching between tasks that require different levels of protection or location accuracy.

In the ProtonVPN Windows client, the split tunneling option is located on the right side of the main console, positioned near the kill switch and port forwarding settings. Once activated, users can choose to include specific apps in the tunnel, excluding all others, or exclude specific apps, keeping all other traffic protected. NordVPN presents a similar interface where users access the feature via the settings icon in the bottom left corner. They toggle the split tunneling switch and then select which specific programs receive VPN coverage.

Other routing methods exist, including URL-based rules that target specific domain names and route-based rules that rely on IP addresses. These alternatives are less common in consumer software and are typically used for managing multiple user devices or corporate networks. For individual users, the app-based approach offers the simplest method to balance privacy with performance.

Mobile devices support similar functions, though with varying degrees of flexibility. Android phones and desktop operating systems generally allow for app-level exclusion. iPhones, however, restrict VPN applications to excluding websites and specific IP addresses rather than entire apps. This limitation means iPhone users must manage their split tunneling through domain rules instead of selecting applications from a list.

Configuring split tunneling is a one-time setup task for most users. After initial configuration, the rules remain active, providing protection where necessary and bypassing the tunnel where it is not. Users can adjust their selections at any time, but the system requires no ongoing manual intervention to maintain the chosen balance between security and speed.