Split Tunneling

Split tunneling lets you decide, app by app or destination by destination, what goes through the VPN tunnel and what uses your ordinary connection. Instead of an all-or-nothing tunnel, you might route a browser through the VPN for privacy while letting a local printer, a banking app or a latency-sensitive game connect directly. It is about selective routing: getting the VPN's protection where you want it without the overhead or geo-side-effects where you do not.

The client maintains rules mapping specific apps or IP ranges to the tunnel and everything else to the default route. Traffic assigned to the tunnel gets the VPN's encryption and exit IP; the rest keeps your real IP. That selectivity is the whole benefit — and its risk: anything left outside the tunnel is fully exposed, so a misconfigured rule can leak traffic you meant to protect. Split tunneling suits mixed workloads but demands care about which side of the split sensitive traffic lands on.

Because the s4m VPN is delivered as standard WireGuard and OpenVPN connections, split tunneling depends on your client and configuration rather than a server feature — WireGuard's AllowedIPs and many OpenVPN clients support it. A lighter alternative is to use an s4m proxy for just the apps you want routed, leaving everything else on your normal connection — effectively per-app tunneling by configuration. Enable a kill switch on the tunneled side so a drop does not silently expose it.