We had to change our old domain. guideora.net is our new and only official domain. Never trust any fake domain using the GUIDEORA name, or similar names pretending to be GUIDEORA.

GUIDEORA

vpn guide

Your Bank App vs the VPN: When Split Tunneling Is the Point

Jordan HaleJordan Hale· Privacy Editor· Updated January 12, 2024· 11 min read

Some links on this page may earn GUIDEORA a commission. Disclosure

Quick take

A full-tunnel VPN encrypts the hop you do not control. Split tunneling lets chosen apps skip that hop — useful for a bank that hates foreign IPs, or a game that needs a local route. It is also how you accidentally send the browser back onto cafe Wi-Fi. Proton VPN is the privacy-first example this site uses; confirm split-tunnel controls in the live apps. GUIDEORA does not run the tunnel.

All-or-nothing is a setting, not a personality

VPN ads sell a single pipe: every packet, one server, one country. That is a clean story. It is also why a banking app suddenly thinks you live in Switzerland and why a video call sounds like a submarine. Split tunneling is the unglamorous map of which apps are allowed to skip the pipe.

The risk is not 'advanced users.' The risk is a toggle named convenience. If the browser is on the split list, the cafe sees your hostnames again. If the bank is on the full tunnel, some issuers will challenge every login. Neither outcome is a moral failure. Both are configuration.

From the record

Encrypt the hop you do not trust. Do not encrypt the hop that breaks a job you named out loud.

GUIDEORA rule for split tunneling

When splitting actually helps

Split when a local printer, a latency-sensitive game, or a finicky bank app misbehaves on a distant exit. Keep the browser and mail in the tunnel on travel networks. On a home fiber line you already trust, a full-time full tunnel is often fatigue, not safety — another article on this site covers that.

A network path splitting between a local app and a VPN tunnel
Split tunneling is a map of trust, not a cheat code.

Full tunnel

Default privacy

Split by app

A trust list

Bank apps

Often picky

Cafe Wi-Fi

Do not leak the browser

  • Name the app that must skip the VPN before you open settings.
  • Never put the browser on the skip list on hotel or cafe Wi-Fi.
  • Re-test the bank login after a server change. IP reputation moves.
  • A kill switch still matters for the apps that stay in the tunnel.

How Proton VPN currently frames the split

Proton VPN currently documents split-tunnel / excluded-app style controls in its apps, alongside a real free tier and a kill switch. Features vary by platform. That is the example this guide uses because the privacy defaults match the job: encrypt the hop, then make exceptions on purpose.

Confirm the live split-tunnel labels in Windows, Android, and iOS — they are not identical. Checkout always wins if a card here disagrees.

Pros

  • +A named exception can keep a bank app from fighting the exit IP
  • +You keep encryption for the apps that actually sit on hostile Wi-Fi
  • +Proton currently pairs this with a usable free tier to learn the setting

Cons

  • −A sloppy skip list puts the browser back on the cafe LAN
  • −Game and bank exceptions are not the same as 'Netflix forever'
  • −Platform apps do not always expose the same split UI

When to keep the full pipe

Keep a full tunnel on networks you would not type a password into. Split only after you can name the app and the reason. Proton VPN is the privacy-shaped example this site uses. GUIDEORA is not the app.

Editor take

Split on purpose, not as a vibe

Use full-tunnel on travel Wi-Fi. Add app exceptions only for jobs you can explain. Proton VPN is the example this guide points at. Confirm current split-tunnel docs. GUIDEORA does not configure your apps.

See Proton VPN's current plan