Split Tunneling

​

Overview

• Local network services: Printers, file shares, media servers
• Banking apps: Some require your real IP address
• Performance-critical apps: Gaming, video calls that benefit from direct routing
• Testing: Comparing behavior inside vs. outside the tunnel

​

How Split Tunneling Works

​

Normal VPN Connection (No Split Tunneling)

┌────────────────────────────────────────────────┐
│              All Applications                   │
│  Browser, Email, Games, Local Apps, etc.      │
└────────────────────────────────────────────────┘
                      │
                      ▼
        ┌───────────────────────┐
        │   VPN Tunnel       │ ────► Internet
        └───────────────────────┘

​

With Split Tunneling Enabled

┌──────────────────────────┐   ┌──────────────────────┐
│  Normal Apps          │   │  Excluded Apps      │
│  Browser, Email, etc. │   │  Banking, Printer   │
└──────────────────────────┘   └──────────────────────┘
          │                           │
          ▼                           ▼
  ┌────────────────┐          Direct Connection
  │  VPN Tunnel   │ ─► Internet
  └────────────────┘          (Real IP)
   (VPN IP)

​

Key Concepts

• Excluded app: Traffic goes outside the VPN tunnel (uses your real IP)
• Included app: Traffic goes inside the VPN tunnel (default for all apps)
• Split tunneling state: Feature can be enabled/disabled globally

​

Platform Implementations

C:\Program Files\App\app.exe

/Applications/App.app

mullvad-exclude firefox

com.bank.mobile

​

Enabling Split Tunneling

​

Windows & macOS

​

Using the GUI

​

Using the CLI (Windows)

# Enable split tunneling
mullvad split-tunnel set on

# Add application
mullvad split-tunnel app add "C:\Program Files\App\app.exe"

# Remove application
mullvad split-tunnel app remove "C:\Program Files\App\app.exe"

# List excluded apps
mullvad split-tunnel get

# List currently excluded processes
mullvad split-tunnel get --list-processes

# Clear all excluded apps
mullvad split-tunnel app clear

# Disable split tunneling
mullvad split-tunnel set off

​

Using the CLI (macOS)

# Enable split tunneling
mullvad split-tunnel set on

# Add application bundle
mullvad split-tunnel app add /Applications/App.app

# Remove application
mullvad split-tunnel app remove /Applications/App.app

# View excluded apps and processes
mullvad split-tunnel get --list-processes

​

Linux

​

Using the mullvad-exclude Helper

# Launch app outside the tunnel
mullvad-exclude firefox

mullvad-exclude /usr/bin/transmission-gtk

# Launch with arguments
mullvad-exclude steam steam://rungameid/123456

​

Using the CLI Directly

# Start an app and get its PID
firefox &
FIREFOX_PID=$!

# Exclude the process
mullvad split-tunnel add $FIREFOX_PID

# List excluded processes
mullvad split-tunnel list

# Stop excluding
mullvad split-tunnel delete $FIREFOX_PID

# Clear all
mullvad split-tunnel clear

​

Android

​

Using the App

​

DNS Behavior

​

Desktop (Windows, Linux, macOS)

​

Android

​

Process Inheritance

​

Parent-Child Relationships

Excluded App (Parent)
  └──► Child Process 1 (Excluded)
       └──► Child Process 2 (Excluded)

• Subprocesses automatically excluded
• Browser tabs, helper processes included
• Launched applications may inherit status

​

Process Tracking (Windows)

mullvad split-tunnel get --list-processes

PID     Type        Name
1234               app.exe
5678    subprocess child.exe

• No marker: Directly excluded (executable path matches)
• subprocess: Inherited exclusion from parent

​

Limitations and Known Issues

​

General Limitations

​

macOS Specific

• WebKit browsers: Safari, WebKit-based apps cannot be excluded
• Full Disk Access required: Must grant permission in System Preferences
• IPC limitations: Apps using multiple processes may not work correctly

​

Linux Specific

• PID-based: Must manage process IDs manually
• No persistent list: Excluded PIDs lost on reboot
• Process lifetime: Exclusion removed when process exits

​

Android Specific

• System apps: Some system apps cannot be excluded
• Split VPN: OS may show “Split VPN” warning

​

Firewall Behavior

• Desktop: May have connectivity issues (firewall blocks non-tunnel traffic)
• Android: Should maintain connectivity (VPN Service API)

​

Security Considerations

​

What Split Tunneling Exposes

​

Use Cases to Avoid

• Privacy-critical applications
• Browsers for anonymous browsing
• Torrent clients (use VPN for safety)
• Apps accessing sensitive data

​

Safe Use Cases

• Local network applications (printer, NAS)
• Banking apps requiring real IP
• Gaming clients for better latency
• Video conferencing for better quality
• Speed test tools

​

Compatibility

• ✅ WireGuard protocol
• ✅ Quantum-resistant tunnels
• ✅ Multihop
• ✅ DAITA
• ✅ Obfuscation protocols
• ✅ Custom DNS
• ✅ Content blockers
• ✅ Local network access

​

Troubleshooting

​

App Still Using VPN

1. Verify exclusion (Windows/macOS):
   mullvad split-tunnel get
   
2. Check process list:
   mullvad split-tunnel get --list-processes
   
3. Restart application: Close and reopen excluded app
4. Check correct path: Ensure exact executable path is excluded

​

App Not Working When Excluded

1. Check if tunnel is connected: Ensure VPN is active
2. Firewall blocking: During connection transitions, firewall may block
3. Try including again: Remove from exclusion list
4. Check DNS: App may require specific DNS configuration

​

Linux: mullvad-exclude Not Working

# Check if mullvad-exclude is in PATH
which mullvad-exclude

# If not found, use full path
/usr/bin/mullvad-exclude firefox

# Verify cgroups v2
mount | grep cgroup2

​

macOS: Permission Denied

1. Grant Full Disk Access:
   • Open System Preferences → Security & Privacy
   • Click Privacy tab
   • Select Full Disk Access
   • Add Mullvad VPN app
2. Restart Mullvad VPN
3. Try excluding app again

​

Windows: Driver Issues

# Check split tunnel driver status
sc query mullvad-split-tunnel

# If driver not running, reinstall Mullvad VPN

​

Performance Impact

• Excluded apps: Direct routing (no VPN overhead)
• Normal apps: Standard VPN performance
• System overhead: Negligible (path/PID filtering)

​

Best Practices

​

Application Selection

1. Only exclude when necessary: Minimize excluded apps for privacy
2. Document exclusions: Keep note of why each app is excluded
3. Review regularly: Remove apps no longer needed
4. Test functionality: Verify apps work as expected

​

Security Hygiene

# Only exclude absolutely necessary apps
mullvad split-tunnel app add "C:\Local\Printer.exe"

# Local network
mullvad split-tunnel app add "C:\Network\FileShare.exe"

# Gaming (latency-sensitive)
mullvad split-tunnel app add "C:\Games\Game.exe"

# Banking, local services, games, video calls
# (Accept reduced privacy for excluded apps)

​

Testing

# 1. Check IP from normal browser (should show VPN IP)
curl https://am.i.mullvad.net/ip

# 2. Check IP from excluded app (should show real IP)
# Launch app with mullvad-exclude (Linux) or after adding to exclusions

​

Related Features

• Local Network Access - Allow LAN without split tunneling
• Custom DNS - DNS behavior with split tunneling
• Kill Switch - Firewall behavior during transitions
• WireGuard Protocol - Base VPN protocol

​

Technical Details

​

Implementation

• Driver file: mullvad-split-tunnel.sys
• Service: mullvad-split-tunnel
• Path-based filtering at kernel level

• Process-based rules
• Requires Full Disk Access for process inspection
• PID tracking in user space

• Cgroup path: /sys/fs/cgroup/mullvad-exclusions
• PID-based exclusion
• Fallback to v1 net_cls on older systems

• disallowApp() method
• Per-package exclusion
• Native Android support

​

Environment Variables (Linux)

# Override cgroup2 filesystem path
export TALPID_CGROUP2_FS=/custom/path

# Override net_cls mount directory (cgroup v1)
export TALPID_NET_CLS_MOUNT_DIR=/custom/mount

​

Further Reading

• Split Tunneling Documentation (Source)
• Linux cgroups v2 Documentation
• Android VPN Service API