# Split Tunneling

Split tunneling lets you decide, per app, which traffic goes through the SecurQbit tunnel and which uses your normal network connection. It gives you privacy where you want it without forcing every app through the VPN.

## What it is

By default, a VPN routes *all* of your device's traffic through the encrypted tunnel. Split tunneling breaks that all-or-nothing model: you build a list of apps, and SecurQbit routes them according to one of two modes.

- **Route selected apps through the VPN** (inclusion) — only the apps you pick are tunneled; everything else uses your normal connection.
- **Exclude selected apps from the VPN** (exclusion) — everything is tunneled except the apps you pick.

## Why use it

- **Banking and payment apps** that block or distrust VPN/foreign IP addresses.
- **Local network services** — printers, NAS, smart-home devices, casting — that must reach your LAN directly.
- **Latency-sensitive apps** like games or video calls that you'd rather keep off the tunnel.
- **Bandwidth control** — keep large background sync off the VPN while protecting your browser.

## Configure on Android

Android's VPN framework supports full per-app routing.

1. Open **SecurQbit > Settings > Split Tunneling**.
2. Toggle split tunneling **on**.
3. Choose a mode: **Route selected apps** or **Exclude selected apps**.
4. Tap the apps to add them to the list.
5. Reconnect if prompted so the new routing rules take effect.

```text
Mode: Exclude selected apps
  ✓ Banking App        (uses normal network)
  ✓ Smart Home Hub     (uses normal network)
  — Browser            (tunneled)
  — Email              (tunneled)
```

## Configure on iOS

1. Open **SecurQbit > Settings > Split Tunneling**.
2. Enable split tunneling and choose inclusion or exclusion mode.
3. Select the apps to route or exclude.
4. Approve any updated VPN configuration prompt.

> **Note:** iOS applies app-level routing through the system VPN profile. Some system-level traffic and certain Apple services may not honor per-app rules; when in doubt, test the specific app after enabling.

## Caveats

- **Excluded apps are not protected.** Their traffic leaves your device unencrypted over your normal network and reveals your real IP. Only exclude apps you trust on the current network.
- **DNS:** tunneled apps use SecurQbit's resolver; excluded apps use your system resolver, which your network can see.
- Changing rules may require a quick reconnect to apply.

## Next steps

Review [No-Logs & Privacy](/no-logs-privacy) to understand what stays private, or read [Firewall Bypass & Obfuscation](/firewall-bypass) to keep tunneled apps connected on restrictive networks.