VPN routing guide · sources checked 2026-11-03
VPN apps, browser extensions, and traffic coverage
Compare an operating-system VPN app with a browser extension, check which traffic each may cover, and understand Android app-based split tunneling without assuming every product works the same way.
What does split tunneling mean?
Split tunneling means that only selected traffic uses a VPN while other traffic uses the device's ordinary network connection. The exact controls and scope depend on the operating system and VPN app. Android's developer documentation describes per-app VPN routing; it does not define one universal consumer setting or menu label.
Does a VPN browser extension protect every app on my device?
Do not assume that it does. A browser extension runs within a browser's extension system and may request access to specified websites or browser features. Chrome, for example, documents an extension API that manages Chrome's proxy settings; that is a browser proxy control, not evidence that other apps use an operating-system VPN tunnel. A separate VPN app can use the operating system's VPN facility to route configured device traffic. The exact scope depends on the extension, browser, operating system, and provider setup.
Can an extension from a VPN provider control the provider's desktop app?
Some products pair an extension with a desktop app, but the name or brand alone does not establish how they work. Check the provider's current instructions for whether the extension works by itself, requires a companion app, changes browser proxy settings, or starts or controls a system VPN. Check which browsers and traffic are covered and what happens when the browser or companion app closes.
Are browser extension permissions the same as VPN app routing permissions?
No. Browser host permissions can grant an extension access to data or APIs for matching websites; some extension APIs also have separate permissions. That describes browser access, not which operating-system apps route through a VPN. On Android, the documented VpnService per-app model selects installed apps for VPN routing or exclusion. Review the exact extension permissions and the VPN app's routing controls separately.
How can I check whether my browser and other apps use the VPN?
Read the current documentation for the exact browser extension, desktop or mobile app, and operating system. Note whether the extension requires a companion app and whether that app has split-tunnel exclusions. On a device and network you control, use a non-sensitive browser IP check and, separately, a non-sensitive check in an app that is meant to use the VPN. Compare each result with the documented route. These are point-in-time observations: a browser test cannot audit other apps, DNS paths, disconnect behavior, or what a provider records. See the IP and DNS guide for test limits.
What does an Android allowed-app list do?
In Android's per-app VPN model, an allowed list sends only the listed apps through the VPN. Apps not listed use the system network as if the VPN were not running. Android documents that if neither an allowed nor a disallowed list is set, all network traffic uses the VPN.
What does an Android disallowed-app list do?
A disallowed list excludes the listed apps from the VPN; other apps use the VPN. Excluded apps use system networking as if the VPN were not running. Android's documented model allows an allowed list or a disallowed list, not both at once.
What is the privacy tradeoff for excluded apps?
Traffic excluded from the VPN does not receive that VPN tunnel's network path. The local network or internet provider may therefore see the excluded connection's network metadata, and a destination may see the public IP used by the ordinary connection. HTTPS can still protect page contents in transit. See the visibility guide for what each network observer can see.
When might per-app routing be useful?
It may help when a particular app needs a direct connection or when you intentionally want only selected apps to use the VPN. This also means those excluded apps do not get the VPN's network-path privacy. Check the app's purpose and the VPN provider's description of its setting before changing the list.
Can I keep blocking all traffic outside the VPN?
Android documents that Block connections without VPN blocks network traffic that does not use the VPN. If non-VPN traffic is blocked, apps outside an allowed or disallowed list can lose network access. An app may therefore stop connecting instead of quietly using the ordinary network. Check how your device combines per-app routing with this system option; available controls can vary by Android version, VPN app, and device management.
How can I check a routing change?
Read the VPN app's current instructions, note which apps are selected and whether the list includes or excludes them, then test only a non-sensitive task. A browser IP or DNS check observes that browser at that moment; it does not identify every app's route or prove that all traffic is covered. The IP and DNS guide explains those limits.
Does Android's behavior apply to every platform?
No. These allow-list and disallowed-list details describe Android's documented VpnService per-app model. Other operating systems and individual VPN apps can use different controls and rules. Consult the current documentation for the platform and app you use rather than assuming the Android model applies elsewhere.
Sources
- Android Developers: VPN — per-app VPN, allowed and disallowed apps, and blocked connections (updated 2026-10-23; accessed 2026-11-03)
- Federal Trade Commission: In the market for a VPN app? (2018-02-22; accessed 2026-11-03)
- MDN: host_permissions for WebExtensions (last modified 2026-04-21; accessed 2026-11-03)
- Chrome for Developers: chrome.proxy API (accessed 2026-11-03)