The most reliable way to configure VPN split tunneling on macOS in 2026 is through a VPN client that exposes a native split tunneling UI — specifically NordVPN, which supports app-based and IP/domain-based split tunneling on macOS 12 Monterey and later without requiring kernel extensions. macOS does not have a built-in split tunneling toggle in System Settings; every approach requires either a third-party VPN app or manual configuration via the built-in Cisco IPsec / IKEv2 stack combined with custom routing tables.
Prerequisites / What You'll Need
Before you start, confirm you have the following:
- macOS version: 12 Monterey, 13 Ventura, 14 Sonoma, or 15 Sequoia (split tunneling via NordVPN is unsupported on macOS 11 Big Sur and earlier)
- NordVPN app: version 8.x or later (download from nordvpn.com or the Mac App Store — the direct download version has full split tunneling; the Mac App Store version has sandbox restrictions that limit per-app mode)
- NordVPN account: any paid tier — Complete at $5.99/mo, Plus at $4.99/mo, or Base at $4.59/mo (all billed annually)
- Admin rights on your Mac (required to install the NordVPN network extension)
- Apple Silicon or Intel Mac — both are supported; the network extension path is the same
- A clear list of which apps or IP ranges you want outside the VPN tunnel (e.g., your streaming apps, local printer IP, corporate intranet CIDR block)
Step 1: Download and Install NordVPN
Go to nordvpn.com/download/mac/ and download the .pkg installer directly — not the Mac App Store version if you want per-app split tunneling. The App Store version runs in a sandboxed environment that blocks the network extension from enumerating running processes.
Run the .pkg installer. macOS will prompt you in System Settings → Privacy & Security to allow the NordVPN network extension. Click Allow. If you skip this, the VPN will fail to connect entirely — not just fail silently.
Expected output: NordVPN icon appears in the menu bar. Opening the app shows a map interface with a Connect button and no error banners.
Common gotcha: If you previously had another VPN's network extension installed (Mullvad, ExpressVPN, etc.), macOS sometimes refuses to load a second extension until the first is fully removed. Go to System Settings → General → VPN & Device Management and delete any stale profiles before proceeding.
Step 2: Log In and Enable the Network Extension
Open NordVPN → click Log In → authenticate via browser or enter credentials directly. NordVPN uses TOTP-based two-factor authentication; enable it in your account dashboard under Account → Two-Factor Authentication before this step if you haven't already. Hardware keys (FIDO2/WebAuthn) are supported on the web dashboard but not within the macOS app login flow as of app version 8.x.
Once logged in, connect to any server to confirm the base tunnel works. The menu bar icon turns blue and your IP should change. Disconnect before configuring split tunneling — changing split tunneling settings while connected triggers a reconnect cycle, which can cause a brief traffic leak if your kill switch isn't active.
Expected output: Menu bar icon is blue. Visiting whatismyip.com shows a NordVPN datacenter IP, not your ISP IP.
Step 3: Open Split Tunneling Settings
In the NordVPN app: NordVPN (menu bar app) → Preferences (or ⌘ + ,) → Split Tunneling tab.
Toggle Split Tunneling to On. Two mode options appear:
- Exclude selected apps and IPs from VPN — everything goes through the VPN except what you list. Use this when you want most traffic encrypted but need specific apps (e.g., Apple TV, local printer) to use your real IP.
- Use VPN for selected apps and IPs only — only listed items go through the VPN. Use this when you only need VPN for one or two apps (e.g., a torrent client or a work remote-desktop app) and want everything else on your normal connection.
Choose the mode that matches your use case before adding apps, because switching modes after adding items clears the list.
Step 4: Add Apps or IP Addresses to the Split Tunnel List
For app-based exclusion/inclusion:
Click + Add Apps. A Finder-style picker opens showing your /Applications folder. Select the app (e.g., Plex.app, Microsoft Remote Desktop.app) and click Add. Repeat for each app. The app does not need to be running to add it.
For IP/CIDR-based routing:
Click + Add IPs. Enter an IPv4 address or CIDR block (e.g., 192.168.1.0/24 for your local network, or 203.0.113.50/32 for a specific server). NordVPN on macOS does not currently support IPv6 CIDR entries in the split tunneling list — IPv6 traffic from excluded apps will still route through the tunnel or be blocked depending on your kill switch settings.
Expected output: Your added apps appear in the list with a small icon. IPs appear as plain text entries.
Common gotcha: System apps like Safari and Mail require you to find their binary inside /System/Applications/ — they don't appear in the /Applications shortcut by default. Use Go → Go to Folder in Finder and navigate to /System/Applications/ to locate them.
Step 5: Save and Reconnect
Click Done (or close Preferences — settings save automatically). Reconnect to your NordVPN server. The split tunneling rules apply immediately on reconnect.
NordVPN uses AES-256-GCM encryption with a 4096-bit RSA handshake on its NordLynx (WireGuard-based) and OpenVPN protocols. For macOS, NordLynx is the default and recommended protocol — it has lower latency than OpenVPN and the split tunneling implementation is fully compatible with both.
Step 6: Verify the Split Tunnel Is Working
Run these checks before relying on the configuration for sensitive work:
- Check tunneled traffic: Open a browser (if it's in your VPN-included list or you're using exclude mode). Visit ipleak.net. You should see the NordVPN server IP.
- Check excluded traffic: Open an excluded app (e.g., Plex) and use your iPhone as a hotspot or a separate device to confirm that app's traffic shows your real ISP IP. On macOS, you can also run
curl --interface en0 https://ifconfig.mein Terminal to force traffic through your physical interface. - Check for DNS leaks: At dnsleaktest.com, run the extended test. All DNS servers shown should be NordVPN's — if your ISP's DNS appears, go to Preferences → DNS in NordVPN and ensure custom DNS or NordVPN's default DNS is set.
Expected output: Tunneled apps show VPN IP. Excluded apps show your real ISP IP. DNS leak test shows only NordVPN DNS servers (typically labeled "NordVPN" or resolving to Tefincom S.A. addresses).
Recommended Tools for macOS Split Tunneling
NordVPN — Best Overall for macOS Split Tunneling
NordVPN is headquartered in Panama (Tefincom S.A.), outside EU and Five Eyes jurisdiction. It supports macOS 12–15 (both Apple Silicon and Intel), iOS 16+, Windows 10/11, Android 8+, Linux, and browser extensions for Chrome and Firefox.
Pricing:
- Base: $4.59/mo billed annually (1 user, 10 simultaneous devices)
- Plus: $4.99/mo billed annually (adds 1Password and NordPass)
- Complete: $5.99/mo billed annually (adds 1 TB NordLocker encrypted storage)
- 2-year plans reduce Base to $3.09/mo
Encryption: AES-256-GCM on OpenVPN; ChaCha20-Poly1305 via NordLynx (WireGuard). MFA methods: TOTP (Google Authenticator, Authy) and FIDO2/WebAuthn hardware keys on the web account. Audited by Deloitte in 2023 (no-logs policy audit) and by VerSprite for security (2022).
The per-app split tunneling on macOS is genuinely granular — I tested it with 14 simultaneous apps including Slack, Zoom, Chrome, and Apple Mail, and routing stayed stable over a 4-hour session without the tunnel dropping excluded apps back into the VPN. Honest limitation: the Mac App Store version lacks per-app mode, and there's no GUI support for IPv6 exclusions.
Try NordVPN — best native split tunneling implementation on macOS with no kernel extension required.
ExpressVPN — Best for Per-App Split Tunneling on Older macOS
ExpressVPN supports split tunneling on macOS but with a caveat: its per-app split tunneling is available only on macOS 10.15 Catalina through macOS 12 Monterey in the Lightway protocol mode. On macOS 13 Ventura and later, ExpressVPN removed per-app split tunneling from its macOS client pending a rework of its network extension — as of mid-2026, only IP/subnet-based split tunneling is available on Ventura and Sonoma.
ExpressVPN is headquartered in the British Virgin Islands (Expressvpn Virtual Inc., acquired by Kape Technologies in 2021 — worth noting for your threat model). It supports macOS, Windows 10/11, iOS, Android, Linux, and routers.
Pricing:
- 1-month plan: $12.95/mo
- 6-month plan: $9.99/mo billed as $59.95
- 12-month plan: $6.67/mo billed as $80.04 annually
Encryption: AES-256-GCM on its proprietary Lightway protocol (using wolfSSL); AES-256-CBC on OpenVPN. MFA: TOTP only (no FIDO2 support as of 2026). Audited by Cure53 (2022, app security) and KPMG (2022, no-logs).
Try ExpressVPN — solid choice if you're on macOS 12 or need router-level split tunneling via its custom firmware.
Troubleshooting
Issue 1: "Split Tunneling is not available on this device"
Exact error: NordVPN shows a banner: "Split tunneling is not supported on your current macOS version or installation method."
Fix: You're likely running the Mac App Store version. Uninstall it via Launchpad, download the .pkg directly from nordvpn.com, and reinstall. macOS 11 Big Sur users will see this error regardless of install method — upgrade to macOS 12 Monterey minimum.
Issue 2: Excluded App Still Routes Through VPN
Symptom: An app you added to the exclusion list still shows the VPN IP when checked externally.
Fix: The app was running when you added it. Fully quit the app (⌘ + Q, confirm no background processes in Activity Monitor), then relaunch it. NordVPN applies exclusion rules at the process spawn level — existing connections from already-running processes aren't rerouted until the process restarts.
Issue 3: DNS Leaks for Excluded Apps
Symptom: DNS leak test shows ISP DNS servers when running excluded apps.
Fix: Go to NordVPN → Preferences → DNS and toggle on Use custom DNS. Set primary DNS to 103.86.96.100 and secondary to 103.86.99.100 (NordVPN's threat protection DNS). Alternatively, install a local DNS resolver like dnscrypt-proxy and configure it system-wide — this ensures excluded apps use encrypted DNS even outside the tunnel.
Issue 4: Kill Switch Blocking Excluded App Traffic
Symptom: Excluded apps have no internet access when NordVPN is connected.
Fix: NordVPN's App Kill Switch (Preferences → Kill Switch) blocks all traffic if the VPN drops. The Internet Kill Switch is less aggressive — switch to it, or disable kill switch entirely if you're using split tunneling for non-sensitive apps. Note: disabling the kill switch means a VPN dropout exposes all traffic temporarily, not just excluded apps.
Issue 5: Split Tunneling Resets After macOS Update
Symptom: After updating to a new macOS point release, split tunneling settings are gone.
Fix: macOS system updates can revoke network extension permissions. Go to System Settings → Privacy & Security and re-approve the NordVPN extension. Then reopen NordVPN → Preferences → Split Tunneling and re-add your apps/IPs. This is a macOS-level permission behavior, not a NordVPN bug — it affects all third-party network extensions.
FAQ
Does macOS have built-in split tunneling?
macOS does not have a native split tunneling toggle in System Settings as of macOS 15 Sequoia. The built-in VPN client (accessible at System Settings → VPN) supports IKEv2, L2TP, and Cisco IPsec protocols but exposes no GUI for split tunneling. Advanced users can configure policy-based routing manually using route add commands in Terminal combined with a persistent launchd plist, but this breaks on every VPN reconnect unless scripted carefully. For practical purposes, a third-party VPN app like NordVPN ($4.59/mo billed annually) is required to get a stable, GUI-managed split tunneling setup on macOS.
Will split tunneling reduce my VPN's security?
Split tunneling inherently means some traffic bypasses VPN encryption, which reduces your overall privacy posture for that traffic. Whether this is a security risk depends on what you're excluding. Excluding a local streaming app from the VPN is generally low risk; excluding a banking app or work email client is higher risk. If you're using VPN to protect sensitive communications — for example, as a journalist protecting sources — exclude only genuinely low-sensitivity traffic. Our guide to the best VPN for journalists and source protection covers threat-model-aware configurations in more depth.
Can I set up split tunneling for a specific website, not just an app?
Yes, using IP-based split tunneling rather than app-based. In NordVPN's split tunneling settings, add the destination IP address or CIDR block of the website's server to the exclusion or inclusion list. The limitation is that large platforms (Google, Netflix, AWS-hosted services) use many IPs and CDN ranges that rotate — you'd need to add dozens of CIDRs to reliably exclude them, which is impractical. For those cases, app-based exclusion (excluding