Kaveo
Split tunneling (split routing) sends part of the traffic through the VPN and part directly. Here is why it is needed, how app exclusions differ from rules for sites and how to check the result.
Whether split tunneling is available depends on the app and platform. Check it in your VolnaLink app: this article describes the general technology, not a confirmed feature of every client.
Why split the traffic
A VPN for everything is not always convenient. Typical situations:
- Banking service: may request extra confirmation when you sign in from an IP address in another country.
- Local devices such as a printer, network drive or cameras stop responding.
- Games sometimes give lower ping directly than through a tunnel.
- Speed: part of the downloads may go faster directly.
Split tunneling solves this: you decide what goes through the VPN and what bypasses it.
Two kinds of rules: apps and sites
App exclusions work per program: the listed app goes to the network directly (or, the other way round, only it goes through the VPN). Such a rule does not depend on which sites the app contacts.
Rules for domains or sites work per destination: traffic to the listed sites bypasses the tunnel in whatever app you open them. If the bank opens in a browser, you need a rule for the site, not for the banking program.
Which of these kinds really exist depends on the platform and client version. The device pages have a screenshot of the "Routing" screen, where a list of sites that bypass the connection is set. Check whether app exclusions exist on your platform in the app itself.
Modes: exclusions and inclusions
Exclusion list. Everything goes through the VPN except the listed items. Suits cases when the VPN is needed all the time and exceptions are few, such as a bank and a printer.
Inclusion list. Everything goes directly except the listed items. Suits cases when the VPN is needed for one or two tasks.
How to set it up
- Open the routing settings in the app (on platforms that have them the section may be called "Routing").
- Choose the kind of rule, app or site, from those available in your version.
- Add the items to the list.
- Reconnect so the rules apply.
Domain examples: why one address is not enough
A service rarely lives on one domain. It may use several addresses and related domains: separate ones for the interface, static files, the API, advertising and sign-in. If you add only the main domain to a rule, part of the requests will take another route. Add related domains as you check, and keep the list short.
How to check the result
Opening an IP check page in an ordinary browser does not confirm the route of another, excluded app: these are different programs and different connections. Choose the way of observing by the rule you set.
- A rule for an app. The only direct way is to look at the traffic of the app itself: in its interface or in the client's log, if the app shows such information. If there is no such way, that is a limitation: a check through the browser proves nothing.
- A rule for a site. Open that site in the same browser with the rule on and off and compare the result. For checking the address, note that our page gets the IP by a request to a third-party service (at the time of publication, for example api4.ipify.org), so a rule for our site's domain will not change the result: add the domain of the address lookup service itself to the list.
- The client log. The app has a "Logs" section. The format of the records depends on the version, and it does not always show which route was chosen; keep this limitation in mind.
Common mistakes
Forgetting the browser. If the bank opens in a browser and only the banking app is excluded, the rule will not work. For websites you need rules by address, not by program.
Excluding too much. Everything in the exclusions works without the tunnel. Keep the list short.
Not checking the result. After setup, check the very app or site the rule was written for, in the way described above.
Local network
A separate setting allows access to home network devices. In many apps it is a single switch: traffic to local addresses goes outside the tunnel.
Related reading
Plans and 8 hours free without a card: see Kaveo plans.