Split Tunneling on Android: How to Exclude Apps from Your VPN

What to check before you start

First, make sure your VPN actually works: the subscription is added, the connection establishes, and foreign websites open. If you are having trouble with this, start with our Android VPN guide.

Next, make a short list of apps that need a Russian IP address. This usually includes:

• mobile banks and payment apps;
• Gosuslugi and other government apps;
• marketplaces, delivery, and taxi apps that use your IP to determine your city;
• streaming and music services with local Russian catalogs.

If you are unsure whether an app needs a local address, run a test. Turn off the VPN and open the app, then turn the VPN on and open it again. If it works without the VPN but acts up with it, add it to your list.

Banking apps installed from RuStore or a bank's website might not show up in the VPN client with their usual names. Look for the exact name under the app icon on your home screen. If you are still unsure, go to Settings → Apps to find the exact system name.

The shorter the list, the better. Everything you exclude connects without VPN protection. Do not add your browser to this list. You use it for both local and foreign websites, so it is better to manage it with address-based routing rules (covered below).

You almost always want the 'all except selected' mode. Marked apps connect directly, while everything else—including apps you install tomorrow—uses the VPN. The reverse mode ('only selected via VPN') is only useful if you need a VPN for just one or two apps.

Where to find the settings in different clients

You cannot choose apps for your VPN in the Android system settings. The VPN client handles this. Here is where to find these options in popular clients as of October 2026.

How to exclude apps in Incy

In Incy, app selection is only available on Android. Google Play calls this feature 'Split Routing'. The menu names below are from Incy 3.8.1 for Android, current as of late October 2026. Incy updates its interface frequently, so look for similar terms if things change.

1. Disconnect your VPN. Android only accepts the app list when the connection starts.
2. Open Incy settings and find 'Split Tunneling' or 'Per-App Proxy'. If you don't see it, update Incy via Google Play.
3. Toggle 'Enable Per-App Proxy' and choose the bypass mode so selected apps route outside the tunnel. The other mode, 'Only selected apps go through the tunnel', won't work for your banks.
4. Mark the apps on your list. Use the search bar and 'Hide system apps' to make it easier. Incy also suggests apps, but double-check what it recommends.
5. Go back to the main screen and connect.

You can copy your selection to the clipboard as a list of package names and paste it on another phone. You will also find routing profiles in Incy's settings. These are for your browser and are covered in the Russian websites section below.

If you have 'Block internet without tunnel' enabled in Incy, check if your excluded apps still open after setup. The developers don't specify how this setting interacts with app exclusions.

How to set up split tunneling in Happ

Happ calls this feature Per App Proxy. It has three modes: off, only selected apps via VPN, and selected apps bypassing the VPN. You need the third one for banking.

1. Disconnect from the server.
2. Open Happ settings and go to Per App Proxy.
3. Turn the feature on and select the bypass mode. Marked apps will connect directly.
4. Select your apps. You can use the 'Select all' and 'Invert' buttons, or use the pre-made bundles to save time.
5. Reconnect.

Some VPN services bundle an app list with their subscription, enabling this mode automatically. If you see exclusions you didn't set up, this is usually why. We covered other Happ settings in our dedicated Happ guide.

How to exclude apps in Hiddify

These steps are for Hiddify 4.1.1, the latest stable release as of October 2026. In this version, the app list only works on Android.

1. Go to Settings → Routing.
2. Toggle 'Per-app proxy' on, then tap the menu item itself to open the list.
3. Make sure 'Bypass' mode is selected (labeled 'Do not proxy selected apps'). Hiddify usually selects this by default when you turn the toggle on.
4. Turn on 'Hide system apps' to shorten the list, then select the apps you need.
5. Disconnect and reconnect.

In the same section, you will find an 'Auto Select' option. Hiddify tries to pick apps automatically based on your chosen 'Region'. Before relying on it, double-check what it actually selected. If you change your region later, Hiddify disables auto-select and warns you with a pop-up. You can save your list to a file or copy it to the clipboard via the menu to transfer it to another phone.

If you use v2rayNG

v2rayNG is an open-source client, so its settings are easy to verify in the source code. These steps apply to version 2.3.14 (October 28, 2026).

1. Disconnect from the server and go to Settings → Per-app proxy.
2. On the app selection screen, toggle 'Enable' and switch on 'Bypass'. In Bypass mode, selected apps connect directly, and everything else uses the proxy.
3. Select your apps. The search bar, 'Select all', and 'Invert selection' options are hidden in the menu.
4. Reconnect.

For your browser, the Routing section offers a predefined 'Russia whitelist'. This routes geosite:category-ru, geoip:ru, and local network addresses directly. This set overwrites existing rules and also blocks QUIC (UDP port 443), forcing browsers to fall back to standard TCP. This is usually invisible, but if a service runs worse after importing the list, this rule might be why.

Russian websites in the browser: Rules instead of exclusions

Your browser needs the second split tunneling method: address-based rules. The client checks where the connection is going, routing Russian domains directly and everything else through the VPN.

• Incy and Happ. Use a routing profile containing geosite:category-ru in the DirectSites list and geoip:ru in DirectIp. You can see how to build and import this profile in our iPhone guide. The steps on Android are identical.
• Hiddify. Go to Settings → Routing → Region → Russia (ru). No custom profile needed.

There is an easier alternative if setting up rules feels like too much hassle: use a second browser. Exclude one (like Yandex Browser) from your VPN and use it exclusively for banking, Gosuslugi, and local marketplaces. Leave your main browser inside the tunnel for everything else. The only downside is having to remember which browser does what.

Exclusions and rules work together but do not overlap. The traffic of an excluded app never reaches the VPN client at all; Android sends it straight out. Because of this, routing rules only apply to the traffic remaining inside the tunnel.

How to test your setup

1. Connect to the VPN and open an excluded banking app. Login and standard operations should work exactly like they do without a VPN.
2. Open a foreign IP checker website in your browser. It should display your VPN server's address.
3. Open a Russian IP checker. If your local routing rules are active, it will show your real IP. This is expected: the site in the .ru zone connected directly.
4. Check one more app that you did not exclude. It should work through the VPN.

We explain how to test for DNS and WebRTC leaks and what the numbers on checker websites mean in our VPN testing guide.

Troubleshooting

Excluded app has no internet connection

You likely have 'Block connections without VPN' enabled in your Android system settings. This setting prevents anything from bypassing the tunnel, including apps you manually excluded. Mullvad's documentation explicitly mentions this limitation: excluded apps will not work with this setting turned on.

The easiest way to find this toggle is by searching your settings for 'VPN'. The usual path is Settings → Network & internet → VPN, then tap the gear icon next to your client. On Samsung devices, the VPN section is under Connections → More connection settings. Turn off 'Block connections without VPN'. You can leave 'Always-on VPN' active, as it just reconnects the VPN automatically.

VPN stopped working in browser and other apps

Check your app proxy mode. You probably selected 'only selected apps via VPN'. This routes your marked banking apps through the tunnel, while your browser and everything else connect directly. Switch the mode to bypass and reconnect.

App still complains about an active VPN

This means the app is checking the phone for an active VPN connection, making exclusions useless. The traffic goes directly, but the system still reports the VPN as running. Your only option is to turn the VPN off while using the app. The fastest way is using the quick settings panel or a client widget: Incy, for example, lets you add a tile to your quick settings.

There is a more subtle way apps detect VPNs. Many Xray-core clients run a local proxy on the phone, and apps can find it by scanning ports. Incy has a setting to protect this local proxy from apps scanning for VPNs. If you exclude apps known for doing this, you should enable this protection.

Changes did not apply

Android receives the app list when the connection starts. Disconnect using the button in your client, wait a couple of seconds, and reconnect. Just minimizing the app or switching servers won't update the list. The same applies to new apps: according to Android documentation, you can only add installed apps to the list. So, install the bank app first, then mark it, and reconnect.

Apps in Secure Folder or Work Profile behave differently

Samsung's Secure Folder, Android Work Profiles, and cloned apps live in isolated system spaces. A VPN running in your main profile might not cover them, and they won't appear in the exclusions list. If a bank is installed in one of these spaces, it likely connects without the VPN anyway.