How to set up a split-tunnel WireGuard configuration via AllowedIPs
In the WireGuard client, a split tunnel is defined by the AllowedIPs line on a peer: only the listed ranges go through it, provided the system routes direct them into WireGuard.
The setup depends on what you need to split: apps, websites or IP addresses. Traffic outside the VPN tunnel is not protected.
Choose a Splitting Method
For a browser as a whole, I recommend per-app selection; for individual websites, use domain-based rules. A domain is a site's name, a subnet is a range of IP addresses.
There are three main mechanisms:
| Method | What you select | Where it is configured | Task | What to check |
|---|---|---|---|---|
| By apps | Entire programs | VPN clients on Android via VpnService, WireGuard Android, v2rayNG | Browser through the VPN, bank direct | Include or exclude mode |
| By addresses and subnets | IPs and ranges | AllowedIPs in WireGuard, VPN routes in Windows | Work subnet through the tunnel | IPv4 and IPv6 routes |
| By domains and IP lists | Websites and groups of addresses | Xray rules in v2rayN/v2rayNG, PAC in v2rayN for Windows | Only selected sites through the proxy | Whether the app's traffic reaches the client |
For this task, I recommend considering CitadelVPN: split tunneling is included in all plans. Add the subscription link or a VLESS link from your account area to a compatible client, such as v2rayNG or Hiddify. Then set the rules: their capabilities depend on the client and platform. Support can help with configuration.
The method is chosen. Now decide where the remaining traffic will go.
Set the Path for Unselected Apps
Check what the toggle in your client says: there are two modes.
| Mode | Selected apps | Everything else |
|---|---|---|
| Only selected apps through the VPN | Through the tunnel | Direct |
| Everything through the VPN except selected apps — inverted mode | Direct | Through the tunnel |
Android's VpnService allows only one list per tunnel: either included or excluded apps.
To enable the VPN only for your browser, set the following in the client settings:
"Only selected apps" → your browser.
Reconnect and check the IP in that browser. For streaming, choose its dedicated app: adding the browser will send all of its websites through the VPN.
Keep the Necessary Connections Direct
A banking app that needs your local British IP address can be excluded from the VPN. This keeps your regular network address, but does not guarantee that you will be able to sign in.
Example: you turn on the VPN and your printer disappears. You enable local network bypass and test printing. This preserves access to local devices, provided other settings do not block it.
In WireGuard, AllowedIPs specifies the subnets assigned to the peer; the system routes determine what enters the tunnel. The value 0.0.0.0/0 covers all IPv4 addresses, while selecting individual subnets and bypassing the local network are covered in the WireGuard guide.
Calls and games are best left direct for lower latency, downloads for saving your VPN data allowance. Verify any speed-up yourself: it is not guaranteed.
Work and personal VPNs can conflict over routes and DNS. On a work device, follow your organisation's settings; for a personal VPN, I recommend your own device. The UK's NCSC recommends that organisations use a full device tunnel. If you need protection for all traffic or do not trust the network, choose a full tunnel and verify its coverage.
Separate Websites Within the Browser
Xray rules route domains and IPs through the proxy or directly. PAC is a rule file for proxy selection: addresses matching the conditions go through it, and it does not automatically cover all blocked sites; the differences between PAC, global mode and local network bypass are described in the v2rayN guide.
Only some programs use the system proxy: a "global" label does not change this. The v2rayN rule sets are geared towards China; for the UK, set your own rules. Splitting websites by IP is imprecise: different domains may share a single address.
Check Both Routes
A connection icon is not enough. An app left off the list or a misconfiguration may send data directly. Check four things:
- External IP in the app going through the VPN: it must match the tunnel's exit.
- External IP of the excluded app: it must match the regular connection. A check in a different browser does not prove this.
- DNS and IPv6: which path name queries and IPv6 connections take. An IPv4 rule does not cover them; incomplete settings may leave them outside the tunnel.
- Local devices: open network storage or send a page to print.
For WireGuard, additionally check the current AllowedIPs if the wg utility is installed. Replace wg0 with the name of your interface:
wg show wg0 allowed-ips
Compare the output with the required subnets. The command does not replace a route check. In a graphical client, this step can be skipped.
In an Xray client, add the IP-checking site to the rule being tested. After a change, reconnect and open a new connection: an old one may keep its previous path.
Frequently Asked Questions
Can you select apps on an iPhone?
The official WireGuard for iOS has no per-app selection; there is an option to exclude private IPs and to enable based on network conditions. On iOS, per-app VPN is a mechanism for managed devices.
Will an excluded app show my regular IP?
Yes, when connecting directly it uses your network's external IP. The VPN enabled for other programs does not change this.
Why is the printer unreachable after excluding its address?
Check whether the client blocks connections outside the VPN. Such blocking can interfere with direct access; on a work device, do not change it against your organisation's rules.
Choose the Minimal Rule and Verify the Result
For a browser as a whole, choose per-app rules; for subnets, routes and AllowedIPs; for websites, Xray or PAC. Check the IPs of the relevant programs, DNS, IPv6 and local devices. Direct traffic remains outside the VPN's protection.