The State of Split Tunneling on iOS: 2026
Finding: as of August 2026, none of the four largest consumer VPNs can exclude an app from the VPN tunnel on iPhone. ExpressVPN offers split tunneling by single IP address only. NordVPN offers no split tunneling on iOS (or macOS) at all. Surfshark's Bypasser on iOS is website-only. Astrill's per-app filter exists on desktop and Android only. Every claim below is sourced from the vendor's own published documentation, and the common excuse (that Apple forbids it) is only half true.
Why this matters
Split tunneling decides which traffic goes through the VPN and which reaches the internet directly. On a phone abroad, it's the difference between a device that works and one that fights you: with everything tunneled, local maps, ride-hailing, payment apps, and banking apps see a foreign or shared datacenter IP and misbehave, so users toggle the VPN off and on all day. iPhone is where this hurts most, and iPhone is exactly where the major vendors offer the least.
The matrix
| VPN | iOS: exclude an app | iOS: anything else | macOS | Windows / Android |
|---|---|---|---|---|
| ExpressVPN | No | Single IP addresses only; vendor's own doc warns it "will not work reliably for large websites" | Per-app rules returned late 2025 via the new Qt app | Per-app supported |
| NordVPN | No | Nothing; iOS absent from vendor's split-tunneling documentation | Not supported | Per-app on Windows, Android, Android TV |
| Surfshark | No | Websites only: "only website bypassing is available" (vendor doc, June 2026) | Apps and websites (since April 2025) | Per-app supported |
| Astrill | No | Smart Mode (website-region routing, OpenWeb protocol only) and a manual site list | Per-app Application Filter | Per-app supported |
| Shadowrocket | Effectively yes, via manually authored per-request rules | Full rule engine (domain, GeoIP, per-request) | No native Mac app (iPad app on Apple Silicon only) | iOS-family only |
| Traveler's VPN (ours) | Yes, automatic per-destination routing | Region-aware profiles, self-updating rule sets | Same engine, native menu-bar app | Apple platforms only |
Statuses as of August 3, 2026. Sources: each vendor's published support documentation; links in the vendor sections below.
Vendor by vendor, from their own docs
ExpressVPN
ExpressVPN's iOS split tunneling (iOS 15+) accepts individual IPv4 addresses only: no apps, no domains, no ranges. Its own support page cautions that the feature "will not work reliably for large websites" (which resolve to many rotating IPs) and that it's incompatible with the Advanced Kill Switch. Per-app split tunneling exists on Windows, Android, Linux, and, since the Qt-based desktop rewrite entered beta in late 2025, on macOS again after years of absence. Source: ExpressVPN support, "How to use split tunneling on iOS" and "Split tunneling on desktop."
NordVPN
NordVPN's support article "What is Split Tunneling and how to use it" lists app-based split tunneling for Windows, Android, and Android TV, with a port/subnet allowlist on Linux. iOS and macOS do not appear in the document at all. On Apple platforms, NordVPN is a single switch. Source: NordVPN support documentation, retrieved August 2026.
Surfshark
Surfshark's Bypasser is real split tunneling on most platforms, including macOS since April 2025. On iOS, the vendor's own doc (updated June 5, 2026) states: "Currently, only website bypassing is available on the Surfshark app for iOS." A user cannot exclude a banking or ride-hailing app; they can only enumerate websites by hand. Source: Surfshark support, "How to use Bypasser for iOS."
Astrill
Astrill's per-app Application Filter is desktop and Android only. On iOS, users get Smart Mode, which routes by website region and works only over Astrill's OpenWeb protocol, plus a manual website list on other protocols. Apps cannot be excluded on iPhone. Source: Astrill's feature documentation for Smart Mode and Application Filter.
The exceptions that prove it's possible
Shadowrocket, the $2.99 power-user client, has offered per-request rule-based routing on iOS since 2015: by domain, domain suffix, GeoIP, and more. It requires users to author or import rule configurations, but it demonstrates the capability plainly. Our own app does the same class of routing with bundled automatic profiles. The capability exists on iOS; the big vendors simply haven't shipped it.
"Apple doesn't allow it" is half true
Vendors sometimes attribute the gap to iOS restrictions. The precise version: Apple's per-app VPN API (excluding a specific app at the OS level) is genuinely reserved for managed enterprise devices via MDM. But that's not the only road. An iOS VPN app runs a Network Extension (NEPacketTunnelProvider) that receives the device's traffic and is free to decide, per connection and per destination, what goes through the tunnel and what routes directly. Destination-based split tunneling, which is what travelers actually need (local services direct, blocked services tunneled), is fully implementable on stock iOS. Shadowrocket, Surge, Quantumult X, and Traveler's VPN all ship it today.
What's fair to say: destination-routing takes real engineering (rule sets, DNS handling, per-region maintenance) that an on/off tunnel doesn't. What's not accurate is the claim that iPhone split tunneling is impossible.
Methodology and corrections. This report deliberately uses only vendor-published documentation, retrieved August 3, 2026, no lab testing and no third-party reviews, so every claim is checkable against the vendor's own words. Vendors ship changes; if a linked doc has changed or we've misread something, tell us via support and we'll correct it with a changelog note. This page is free to cite with attribution.
What travelers should take from this
- If you carry an iPhone and expect "split tunneling" from a major VPN because their site advertises it, check the platform fine print; on iOS you're likely getting an on/off switch.
- The practical consequences abroad: local apps slow or break while connected, banks see shared datacenter IPs, and the workflow becomes manual toggling.
- Rule-based clients (Shadowrocket if you like configuring, Traveler's VPN if you want it automatic) are currently the only way to get true destination-based routing on iPhone.
