Free tools Windows power users keep installed
One-click scans. No signup required.
Use split tunneling to send selected traffic through your VPN while other apps or sites use your normal internet connection. In your VPN app or device settings, look for Split tunneling, per-app VPN, an app allowlist/blocklist, or traffic-routing options. If you want every covered connection protected, use a full tunnel instead.
Choose the routing mode that matches your goal
| Mode | Where traffic goes | When it fits | What happens if the VPN drops | Who controls it |
|---|---|---|---|---|
| Full tunnel | All covered traffic uses the VPN. | Company policy or a requirement that all internet traffic use the VPN. | A kill-switch or always-on policy may block connections until the VPN returns. | You or an administrator, depending on the device. |
| Split tunnel | Selected traffic uses the VPN; the rest uses the device’s physical network connection. | Keeping ordinary browsing local while reaching work resources, internal-only sites, or local devices. | Traffic assigned to the VPN may fail; locally routed traffic can continue unless a blocking policy is enabled. | You, if the app exposes the setting; otherwise an administrator. |
| Per-app VPN | Apps on an allowlist or blocklist are routed through the VPN. | Only particular apps need the private network. | On Android, excluded apps normally use system networking unless “Block connections without VPN” is enabled. | Often an administrator on managed Android devices. |
Google describes full-tunnel Chromebook configurations as sending Chrome and Android app traffic through the VPN. With split tunneling, selected sites use the tunnel and other traffic skips it through the physical connection (Google Chromebook Help).
Set up split tunneling
1. Define what “regular internet” means
- All apps except work or private-network apps.
- One or more sites that must use the VPN.
- Local-network devices such as printers that must remain reachable.
- All ordinary internet locally routed while only private resources use the VPN.
Your answer determines whether you need app-based, site-based, or route-based splitting. Not every VPN app supports all three.
2. Find the routing control
- Open the VPN app or the operating system’s VPN settings.
- Search for Split tunneling, per-app VPN, allowlist, blocklist, excluded apps, or traffic routes.
- Enable split tunneling and add the apps, sites, or private routes that should use the VPN. Depending on the product, you may instead add the items that should bypass it.
- Reconnect the VPN, then test each category separately: a private resource, an ordinary website, and a local device if relevant.
On a managed computer or phone, the setting can be locked or preconfigured by an administrator. Google documents this distinction for Chromebook and Android Enterprise deployments (Google Android Enterprise Help).
#1 Best Overall
- 【Five Gigabit Ports】1 Gigabit WAN Port plus 2 Gigabit WAN/LAN Ports plus 2 Gigabit LAN Port. Up to 3 WAN ports optimize bandwidth usage through one device.
- 【One USB WAN Port】Mobile broadband via 4G/3G modem is supported for WAN backup by connecting to the USB port. For complete list of compatible 4G/3G modems, please visit TP-Link website.
- 【Abundant Security Features】Advanced firewall policies, DoS defense, IP/MAC/URL filtering, speed test and more security functions protect your network and data.
- 【Highly Secure VPN】Supports up to 20× LAN-to-LAN IPsec, 16× OpenVPN, 16× L2TP, and 16× PPTP VPN connections.
- Security - SPI Firewall, VPN Pass through, FTP/H.323/PPTP/SIP/IPsec ALG, DoS Defence, Ping of Death and Local Management. Standards and Protocols IEEE 802.3, 802.3u, 802.3ab, IEEE 802.3x, IEEE 802.1q
Android: route apps through or around the VPN
Android Enterprise supports VPN app allowlists and blocklists. An allowlist sends specified apps through the VPN; a blocklist identifies apps that should not use it. Apps excluded from the VPN use normal system networking unless the administrator enables Block connections without VPN (Google Android Enterprise Help).
- Open the VPN or work-profile configuration supplied by your organization or VPN provider.
- Choose the app allowlist or blocklist option, if available.
- Add the apps that require private-network access, or exclude the apps that should use ordinary internet.
- Check the behavior of “Block connections without VPN.” Turned on, it prevents excluded or otherwise unprotected traffic from connecting when the VPN is unavailable; turned off, that traffic can use the regular connection.
Exact menu names vary by Android version, device manufacturer, VPN client, and management policy.
Rank #2
- 【AC1200 Dual-band Wireless Router】Simultaneous dual-band with wireless speed up to 300 Mbps (2.4GHz) + 867 Mbps (5GHz). 2.4GHz band can handles some simple tasks like emails or web browsing while bandwidth intensive tasks such as gaming or 4K video streaming can be handled by the 5GHz band.*Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【Easy Setup】Please refer to the User Manual and the Unboxing & Setup video guide on Amazon for detailed setup instructions and methods for connecting to the Internet.
- 【Pocket-friendly】Lightweight design(145g) which designed for your next trip or adventure. Alongside its portable, compact design makes it easy to take with you on the go.
- 【Full Gigabit Ports】Gigabit Wireless Internet Router with 2 Gigabit LAN ports and 1 Gigabit WAN ports, ideal for lots of internet plan and allow you to connect your wired devices directly.
- 【Keep your Internet Safe】IPv6 supported. OpenVPN & WireGuard pre-installed, compatible with 30+ VPN service providers. Cloudflare encryption supported to protect the privacy.
Chromebook and ChromeOS behavior
ChromeOS can use split tunneling so selected sites go through the VPN while other traffic uses the physical network. This is useful when you need an internal-only site over the VPN but still need printers or other devices on your local network (Google Chromebook Help).
Open the Chromebook’s network or VPN configuration and inspect the available routing or split-tunnel options. A school or workplace administrator may control these settings, so a missing option does not necessarily indicate a fault with the Chromebook.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- New-Gen WiFi Standard – WiFi 6(802.11ax) standard supporting MU-MIMO and OFDMA technology for better efficiency and throughput.Antenna : External antenna x 4. Processor : Dual-core (4 VPE). Power Supply : AC Input : 110V~240V(50~60Hz), DC Output : 12 V with max. 1.5A current.
- Ultra-fast WiFi Speed – RT-AX1800S supports 1024-QAM for dramatically faster wireless connections
- Increase Capacity and Efficiency – Supporting not only MU-MIMO but also OFDMA technique to efficiently allocate channels, communicate with multiple devices simultaneously
- 5 Gigabit ports – One Gigabit WAN port and four Gigabit LAN ports, 10X faster than 100–Base T Ethernet.
- Commercial-grade Security Anywhere – Protect your home network with AiProtection Classic, powered by Trend Micro. And when away from home, ASUS Instant Guard gives you a one-click secure VPN.
Work-resource-only access with CloudConnexa
OpenVPN CloudConnexa documents an internet-access mode in which private and trusted traffic uses the tunnel while other internet traffic remains on the local connection. When split tunneling is off, all internet traffic is routed through CloudConnexa (OpenVPN, “About Internet Access Configuration”). This is the pattern to choose when work systems must be protected but general browsing should not traverse the corporate gateway.
Why internet stops when the VPN disconnects
Check for Block connections without VPN, always-on VPN, or an equivalent kill-switch setting. Chromebook and Android Enterprise documentation describe policies that block traffic outside an always-on VPN. With such a policy enabled, losing the tunnel can make all or some internet access appear to stop until the VPN reconnects (Google Chromebook Help; Google Android Enterprise Help).
Rank #4
- 【DUAL BAND WIFI 7 TRAVEL ROUTER】Products with US, UK, EU, AU Plug; Dual band network with wireless speed 688Mbps (2.4G)+2882Mbps (5G); Dual 2.5G Ethernet Ports (1x WAN and 1x LAN Port); USB 3.0 port.
- 【NETWORK CONTROL WITH TOUCHSCREEN SIMPLICITY】Slate 7’s touchscreen interface lets you scan QR codes for quick Wi-Fi, monitor speed in real time, toggle VPN on/off, and switch providers directly on the display. Color-coded indicators provide instant network status updates for Ethernet, Tethering, Repeater, and Cellular modes, offering a seamless, user-friendly experience.
- 【OpenWrt 23.05 FIRMWARE】The Slate 7 (GL-BE3600) is a high-performance Wi-Fi 7 travel router, built with OpenWrt 23.05 (Kernel 5.4.213) for maximum customization and advanced networking capabilities. With 512MB storage, total customization with open-source freedom and flexible installation of OpenWrt plugins.
- 【VPN CLIENT & SERVER】OpenVPN and WireGuard are pre-installed, compatible with 30+ VPN service providers (active subscription required). Simply log in to your existing VPN account with our portable wifi device, and Slate 7 automatically encrypts all network traffic within the connected network. Max. VPN speed of 100 Mbps (OpenVPN); 540 Mbps (WireGuard). *Speed tests are conducted on a local network. Real-world speeds may differ depending on your network configuration.*
- 【PERFECT PORTABLE WIFI ROUTER FOR TRAVEL】The Slate 7 is an ideal portable internet device perfect for international travel. With its mini size and travel-friendly features, the pocket Wi-Fi router is the perfect companion for travelers in need of a secure internet connectivity on the go in which includes hotels or cruise ships.
- Keep blocking enabled when preventing any unprotected traffic is more important than staying online.
- Allow non-VPN connections when uninterrupted ordinary internet matters more and you accept that excluded traffic can leave through the local connection.
On a managed device, only the administrator may be able to change this policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Test and troubleshoot the split tunnel
Private resource does not open
- Confirm the site or app is included in the VPN allowlist and that the VPN shows connected.
- Check whether the private resource requires a work profile, corporate DNS, or an administrator-pushed route.
- Reconnect after changing routing rules; many clients apply them only on the next connection.
Local printer or device is unreachable
- Verify local-network traffic is excluded from the VPN, if your client offers local-LAN access or route exclusions.
- Check that the device and printer are on the same physical network.
- A full-tunnel or administrator policy can intentionally prevent local access.
Ordinary browsing is blocked
- Inspect the kill-switch or “Block connections without VPN” setting.
- Check whether the browser is included in a VPN allowlist or whether all traffic is forced through a full tunnel.
- If the device is managed, ask the administrator whether bypass traffic is prohibited.
Only some apps behave differently
App-based rules take precedence over broad expectations. Review each app’s inclusion or exclusion status, then reconnect and test again. A VPN client may also classify browser traffic by site or process rather than by the network you are using.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBest Value
- Next-Gen Gigabit Wi-Fi 6 Speeds: 2402 Mbps on 5 GHz and 574 Mbps on 2.4 GHz bands ensure smoother streaming and faster downloads; support VPN server and VPN client¹
- A More Responsive Experience: Enjoy smooth gaming, video streaming, and live feeds simultaneously. OFDMA makes your Wi-Fi stronger by allowing multiple clients to share one band at the same time, cutting latency and jitter.²
- Expanded Wi-Fi Coverage: 4 high-gain external antennas and Beamforming technology combine to extend strong, reliable, Wi-Fi throughout your home.
- Improved Battery Life: Target Wake Time helps your devices to communicate efficiently while consuming less power.
- Improved Cooling Design: No heat ups, no throttles. A larger heat sink and redefined case design cools the WiFi 6 system and enables your network to stay at top speeds in more versatile environments.
Security and privacy trade-offs
- Traffic sent through the VPN receives the VPN’s network path and any private-resource access it provides.
- Traffic that bypasses the tunnel uses the local network and internet provider, so it does not receive the VPN’s routing or VPN-side protections.
- A kill-switch reduces the chance of accidental bypass but can interrupt ordinary internet access.
- Split tunneling can preserve access to local devices and reduce unnecessary routing through a work gateway, but the correct policy depends on your organization’s security requirements.
There is no universal “best” setting: select full tunnel when policy requires complete coverage, and split or per-app routing when only defined traffic needs the VPN.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
