Split Tunneling on iPhone: How to Bypass VPN for Russian Sites

Why You Can't Exclude Apps from VPN on iPhone

iPhone VPN clients use the system's Network Extension framework. It can bind a VPN to specific apps, but Apple's developer documentation is explicit: the only way to set up per-app VPN is to register the device in MDM (Mobile Device Management), a system companies use to configure work phones. Apple staff on the developer forums confirm there is no alternative for personal devices. As far as we know, this hasn't changed in iOS 26.

Therefore, guides claiming to show 'how to exclude Sberbank from VPN on iPhone' are actually describing website-based rules. If a guide suggests installing a management profile on your personal iPhone to unlock app selection, do not do it: such profiles give their creators extensive control over your device.

What iOS does allow standard VPN apps to do is route traffic based on the destination address. The system can bypass the tunnel for specific IPs and subnets. Inside the tunnel, an Xray-core client inspects each connection and sends it either to the server or directly. This is the foundation of our setup.

How Routing Rules Replace App Exclusion

A banking app communicates with bank servers. If the domains and IP addresses of those servers fall under a 'direct' rule, the bank's traffic bypasses the tunnel, even though the app itself isn't excluded. For the bank, the result is identical: it sees your real Russian IP address.

The difference from Android lies in the details. On Android, an excluded app bypasses the VPN entirely. On iPhone, rules check each destination address separately. If the banking app also contacts third-party servers, like map services, those connections follow their own rules and might go through the VPN. This rarely causes issues, as the bank only checks the IP you use to reach its own servers.

The minimum set of rules for Russian services looks like this:

• geosite:category-ru in direct sites: covers everything in .ru, .su, and .рф zones, plus domains of Russian companies in other zones;
• geoip:ru in direct IP addresses: covers servers registered in Russia;
• Local network addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). These are included by default in Happ and Incy profiles, so you don't need to add them.

If you don't want to bypass the VPN for all Russian traffic, use narrower categories. geosite:category-gov-ru covers government sites, including Gosuslugi (Russia's public services portal). geosite:category-bank-ru includes banking sites like Sber (Sberbank), T-Bank, VTB, and Alfa-Bank. The rest of your Russian traffic will go through the VPN, but this increases the risk of a specific service missing the direct list.

To clarify what goes where, we checked the open-source v2fly/domain-list-community list, which generates the geo-files used by Happ and Incy. Status as of October 30, 2026:

These lists are constantly updated. Clients download new geo-files automatically or receive them through app updates. If a service from the table still goes through the VPN, your geo-files might be outdated. Update them in your profile settings.

How to Set Up Split Tunneling in Happ

In Happ, rules are defined by a routing profile. The easiest way to build one is using the developers' builder tool. These steps apply to the October 2026 versions of the builder and app.

1. Open routing.happ.su, the official Happ profile builder, in Safari.
2. On the Main tab, set a profile name, like 'Direct Russia'. Leave GlobalProxy enabled so everything not matching the rules goes through the VPN.
3. On the rules and exceptions tab, add geosite:category-ru to DirectSites and geoip:ru to DirectIp. Local network addresses are already there.
4. Copy the generated link (starting with happ://routing/add/…). If you want the profile to activate immediately upon importing, enable the onadd option.
5. Open Happ and add the profile from your clipboard in the routing section. You can also simply tap the link on your iPhone—it will launch Happ automatically.
6. Ensure routing is enabled and this profile is selected for your active subscription.
7. Disconnect and reconnect. Happ applies routing changes only after a reconnection.

Before creating your own profile, check your existing ones. Some VPN services include a routing profile with their subscription, and Happ links it automatically. If you already have one, check its contents—Russian sites might already be set to connect directly.

The builder also features a JSON editing mode. Our example profile looks like this (Happ will fill in any missing fields using the default profile):

{
  "Name": "Direct Russia",
  "GlobalProxy": "true",
  "DirectSites": ["geosite:category-ru"],
  "DirectIp": ["geoip:ru", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"],
  "DomainStrategy": "IPIfNonMatch"
}

Each subscription in Happ has its own set of profiles. If you add a second subscription, you must select a profile for it too. When a subscription is deleted, its profiles are removed with it. Read our Happ overview for a breakdown of other client settings.

How to Set Up Routing in Incy

Incy uses the same routing profile format as Happ: fields like DirectSites, DirectIp, ProxySites, and BlockSites match perfectly. This means a profile created in the Happ builder works for Incy, too. The interface names below apply to Incy 2.6.

1. Create a profile in the builder as described above and copy the link.
2. Change the beginning of the link from happ:// to incy://, leaving the rest as is. According to Incy's documentation, it can parse links with foreign schemes, but this method is more reliable.
3. Open Incy and tap '+ Add' → 'Paste'. Incy will automatically detect the link type and warn you that a routing profile is about to be added.
4. If pasting doesn't work, go to the 'Routing' section in settings and use the import option there.
5. Check the 'Routing' section to make sure your profile is selected and routing is turned on.
6. Reconnect the VPN. The profile will take effect once the geo-files finish downloading.

When a Service Partially Fails: Adding Custom Addresses

The geosite and geoip lists are not exhaustive. The symptoms are familiar: a bank app opens but payments fail, a marketplace loads without images, or a delivery app can't locate your address. This means one of the service's servers missed the 'direct' rule and got routed through the VPN.

You can track it down using the connection log, available in both Happ and Incy. If logging is disabled, turn it on in the client's settings. Reproduce the action that causes the failure, then check which addresses were sent through the proxy at that exact moment. You can usually identify the correct address by its name: it will contain the service's name or terms like cdn, static, or img.

• Add the domain to DirectSites using domain:domain-name. Subdomains are caught automatically.
• Add an IP address or subnet to DirectIp as is, for example, 203.0.113.0/24.
• Save the profile with the same name and import it again. Happ will overwrite the existing profile, so you won't get duplicates.

Sometimes you need the opposite: routing a Russian site through the VPN. In that case, add it to ProxySites. By default, the Happ builder prioritizes rules in this order: block, proxy, direct. This means your manual proxy rule will override the general category rule.

How to Verify Your Setup

1. Connect to the VPN and open a banking app or Gosuslugi. Login should work exactly as it does without a VPN.
2. Open a foreign IP-checker website in Safari. It should display your VPN server's IP address.
3. Open a Russian IP-checker website. It should show your real IP address because it falls under the 'direct' rule. This is exactly how it should behave.
4. Check the client's log: connections to Russian addresses should show up as direct.

For advice on which checker sites to use and how to spot DNS or WebRTC leaks, read our article on how to test your VPN.

The profile won't activate

Geo-files download in the background. The new profile won't activate until the download completes. If the files don't download within 3 minutes, Happ and Incy will pause the process, show an error on the main screen, and put a red exclamation mark next to the profile. Check your internet connection and try again. The error will disappear on its own once the files finish downloading.

Something broke after setup

Turn off routing with the master toggle and reconnect. Everything will revert to 'all traffic through VPN', helping you determine whether the rules are at fault. If it works without the rules, turn them back on and check the log to find the problematic address.

The VPN started disconnecting on its own

This might be a memory issue. iOS allocates very little memory to VPN extensions (Happ's documentation mentions 50 MB), and large geo-files don't always fit. To prevent this, Happ profiles include a UseChunkFiles parameter: the client extracts only the categories specified in your rules and feeds lightweight files to the core.

If an App Still Doesn't Work with VPN

Some apps actively check if an iPhone has an active VPN connection. Routing rules are useless here: the traffic might go directly, but the system still reports the VPN as active. Your only option is to turn the VPN off while using the app. We explain why banks do this and explore other workarounds in our article Banks and Gosuslugi Not Working with VPN.

Turning off the VPN is easier if you bypass the app entirely. Incy supports widgets and Shortcuts actions, allowing you to toggle the VPN without ever opening the client.

You can take it a step further by setting up an automation in the Shortcuts app: the VPN disconnects when you open a banking app and reconnects when you close it. Create a personal automation using the 'App' trigger and add the client's disconnect action, then create a second automation with the reverse action. Make sure your client supports these actions first, and opt to run without confirmation, otherwise your iPhone will ask for permission every single time.