Split tunneling on Windows: Bypassing the VPN for Russian sites and apps

Choose your mode first: VPN or system proxy

In Hiddify's settings, under "Inbounds," there is a "Service Mode" option. This determines which apps use the VPN at all, so start here.

• "VPN". Hiddify creates a virtual network adapter (TUN mode), routing all app traffic through it. This requires administrator privileges.
• "VPN Service". The same TUN mode, but running as a Windows background service so you don't have to launch Hiddify as an administrator every time. Developers previously marked this as experimental.
• "Set System Proxy". Hiddify sets itself as the proxy server in Windows settings. Browsers and some apps respect this, while others connect directly.
• "Proxy Service Only". Hiddify simply runs a local proxy without directing any traffic to it. This is for users who configure apps manually.

This is the main choice for split tunneling. System proxy mode is inherently split: browsers use the VPN, while almost everything else bypasses it. VPN mode routes the entire computer, meaning you have to split traffic using rules.

If you are unsure, start with "VPN" mode and the "Russia" region. Everything will go through the tunnel except Russian addresses, saving you the trouble of guessing which app respects proxy settings.

Russian websites directly: The "Russia" region

1. Go to Settings → Routing.
2. Under "Region," select "Russia (ru)."
3. Ensure "Bypass LAN" is enabled so your printer, network folders, and router remain accessible.
4. Disconnect and reconnect.

Based on the client's source code, Hiddify adds several rules to the configuration after this. Domains ending in .ru connect directly, and their IP addresses are resolved via a "direct" DNS server. Addresses from the geoip-ru and geosite-ru lists also connect directly. Hiddify downloads these lists from its GitHub repository and updates them every few days.

If "Other" is selected under Region, there are no regional rules. In "VPN" mode, all traffic, including Russian traffic, goes through the tunnel.

The domain ending rule only triggers for .ru. Sites with .рф or .su domains will connect directly only if they are in the geosite-ru list or their servers are physically located in Russia.

The region setting works in both modes because the client's core makes the routing decision. The only difference is what traffic reaches the core: all traffic in VPN mode, or only traffic from apps that respect proxy settings in system proxy mode.

How to bypass the VPN for a specific app

In the stable Hiddify 4.1.1 (from March 2026), the "Per App Proxy" option is only available on Android. The custom rules editor, which lets you specify a process name, exists in the code but is hidden in the stable interface. It is already available in test builds, where process-based rules are marked as working only in TUN mode. Once the feature hits the stable release, look for it in the Routing section.

If you need to exclude an app right now, you have three options.

1. "Set System Proxy" mode. Apps that ignore the system proxy already bypass the VPN. This is perfect if you mainly need a VPN for your browser.
2. Happ for Windows. It features Per App Proxy with "bypass VPN for selected apps" and "VPN only for selected apps" modes. You define apps by their executable filename. Other client settings are covered in our Happ overview.
3. Turn off the VPN while using the app. For a banking client or software that actively detects VPNs, this is sometimes the most reliable way.

You can find an app's executable filename in the Task Manager: go to the "Details" tab and look at the "Name" column. Browsers and messengers often have multiple processes, but they usually share the same name, so you only need to add it to the list once.

Split tunneling in Happ for Windows

If you absolutely must exclude specific apps, Happ for desktop can do what stable Hiddify cannot yet. Its Per App Proxy feature is available on Windows, macOS, and Linux. Throughout 2026, the developers significantly improved it: according to the changelog, it now supports all TUN modes and UDP traffic. The interface changes between versions, so below is the logic rather than exact button names.

1. Add your subscription to Happ and verify the connection works.
2. Switch the connection to TUN mode. The app list is designed for this: according to Happ's changelog, selected apps in this mode also follow the routing profile.
3. Open Per App Proxy and select a mode. Happ's documentation describes them as "Direct for selected apps" (bypassing the VPN, everything else goes through) and "Proxy for selected apps only" (the reverse).
4. Add your apps. On Windows, they are defined by the executable filename, such as app.exe.
5. Disconnect and reconnect.

In Happ for Windows, Russian sites connect directly using the same routing profile as on a phone (geosite:category-ru and geoip:ru). The profile is tied to the subscription and is easy to build using the routing.happ.su generator. This process is detailed step-by-step in the iPhone guide; the steps are identical on a computer.

TUN vs. system proxy: Practical differences

The difference between modes isn't just about which apps use the VPN. Windows system proxy operates over HTTP, which only handles TCP connections. Voice calls, games, and some video services use UDP. In system proxy mode, this UDP traffic bypasses the VPN, even if the app respects proxy settings.

This leads to three common setups.

Browser-specific considerations

Chrome and Edge use the Windows system proxy. Firefox defaults to system settings but has its own: Settings → General → Network Settings → Settings. If this is set to Manual or "No proxy," Firefox will bypass Hiddify in system proxy mode.

In system proxy mode, the browser can leak your real IP address via WebRTC. This technology is used for in-browser video calls and relies on UDP, which doesn't pass through an HTTP proxy. "VPN" mode prevents this issue. We explain how to check for WebRTC leaks in our VPN testing article.

Browser VPN extensions operate on top of everything else. If an extension is enabled, Hiddify only sees the connection to the extension's server, meaning rules for Russian sites will not trigger. For a clean test, it is best to disable extensions.

If a Russian site stubbornly routes through the VPN in your browser, check the "Secure DNS" setting in Chrome and Edge, or "DNS over HTTPS" in Firefox. This makes the browser resolve IP addresses via its own DNS server, making it harder for the VPN client to see where the connection is actually going. Try disabling it and reconnecting.

If you use a built-in Windows VPN connection

Corporate VPNs are often configured using Windows' built-in tools, without a separate client app. Split tunneling works more simply for these connections: it is either off (all traffic goes into the tunnel) or on (only corporate network addresses go into the tunnel).

This is controlled by the "Use default gateway on remote network" checkbox. You can find it in the VPN connection properties: Network tab → Internet Protocol Version 4 (TCP/IPv4) → Properties → Advanced. Unchecking this box enables split tunneling. The following PowerShell command does the same thing:

Set-VpnConnection -Name "Connection Name" -SplitTunneling $true

If internal company resources stop loading after doing this, they need routes, which can be added with the Add-VpnConnectionRoute command. It is best to ask your IT department here: only they know which addresses need to be routed into the tunnel. Standard built-in VPN settings don't support domains or geoip lists; for that, you need clients like Hiddify or Happ.

How to check the result

1. Disconnect and reconnect to apply the rules.
2. Open your bank's website or Gosuslugi (Russia's public services portal). The login should work exactly as it does without a VPN.
3. Open a foreign IP-checking website. It should display the VPN server's address.
4. Open a Russian IP-checking website. It will show your real IP address because it falls under the "direct" rule. This is expected behavior.
5. If you excluded an app in Happ, launch it and make sure it connects.

If the Russian check site shows the VPN server's address, the rule didn't trigger. Verify the region actually saved and reconnect. If the foreign site shows your real address, the browser bypassed the VPN entirely: this happens in system proxy mode with Firefox or if a VPN extension is enabled.

You can see which exit a specific connection used in Hiddify's logs. To do this, raise the "Log level" in the settings and repeat the action.

Common problems

Hiddify says VPN mode requires administrator privileges

This is the "VPN mode requires administrator privileges" message. Close Hiddify, right-click its shortcut, and select "Run as administrator." Alternatively, change the "Service Mode" to "VPN Service" or system proxy.

The region is selected, but Russian sites go through the VPN

Reconnect first. If that doesn't help, wait a few minutes: Hiddify downloads the geoip-ru and geosite-ru lists on first launch, and the rules won't work until they finish downloading. Then, check the browser settings outlined in the section above.

A website only partially loads

A service might host parts of its infrastructure on foreign IP addresses and parts on Russian ones. When this happens, text loads, but images or payment gateways do not. We explain why this occurs in our general split tunneling article. The quickest fix is to open the service with the VPN turned off.

Hiddify won't connect at all

This isn't a split tunneling issue. We troubleshoot launch errors and timeouts in our Hiddify guide, and the general diagnostic process is covered in our desktop VPN instructions.