ProtonVPN and NordVPN Activate App-Level Traffic Controls on Windows Clients

ProtonVPN and NordVPN have enabled split tunneling capabilities in their Windows clients, allowing users to direct specific applications through an encrypted tunnel while leaving others on the direct network connection. This feature addresses speed loss and location masking issues that often occur when all traffic is routed through a virtual private network.

The update lets users define which programs require encryption. A user can keep a banking application inside the VPN for security while allowing a weather app to bypass the tunnel. This ensures the weather forecast reflects the user's actual physical location rather than the spoofed location provided by the VPN server. Similar logic applies to online gaming, where players may exclude game clients to minimize latency.

Split tunneling functions by sending selected traffic around the encrypted bridge that normally connects a device to the web. This prevents internet service providers and other entities on the same network from viewing unencrypted data for chosen apps. Users no longer need to toggle the entire VPN on and off to manage this balance between protection and speed.

The most common implementation is app-based control. In the ProtonVPN Windows interface, a split tunneling link appears on the right side of the main console. Users can select apps to include in the tunnel, which excludes everything else, or select apps to exclude, which includes everything else in the tunnel. NordVPN uses a similar approach, with users accessing the feature via the cog icon in the bottom left corner and flipping a toggle switch to select specific applications for protection.

Other routing methods exist but are less common in consumer software. URL-based tunneling sets rules by domain name, allowing a search engine to be protected while a local news site remains direct. Route-based and policy-based tunneling rely on IP addresses and broader rule sets, respectively, and are typically used in enterprise environments to manage multiple users.

Mobile devices offer similar controls through app settings, though with limitations. Android devices and desktop platforms generally allow app-based exclusion. iPhones typically restrict users to excluding specific websites and IP addresses rather than entire applications. Most users configure these settings once and rarely need to adjust them, creating a stable setup that maintains protection for sensitive apps while keeping performance high for others.

The feature is available on paid tiers for most VPN services. The implementation varies slightly between products, but the core function remains consistent: users choose which digital activities remain hidden behind the encrypted bridge and which proceed directly to the internet.