Windows VPN users can now cut latency by routing specific games past the encrypted tunnel

Two of the market's most prominent virtual private network providers have enabled a granular routing feature for their Windows clients. ProtonVPN and NordVPN now allow users to determine exactly which applications send data through the encrypted bridge and which connect directly to the internet. This update brings split tunneling functionality to the desktop environment, a tool that was previously more common on mobile platforms or enterprise systems.

The core mechanic involves bypassing the VPN for selected software to reduce latency. The encrypted tunnel that normally shields a user's traffic from internet service providers and local network observers is selectively disabled for specific programs. A gamer seeking the lowest possible ping, for instance, can route their game client outside the VPN while keeping a banking application protected inside it. This eliminates the need to toggle the entire service on and off for different tasks.

The implementation differs slightly between the two providers but follows a similar logic. In the ProtonVPN Windows interface, a split tunneling option is located on the right side of the main console, next to the kill switch and port forwarding controls. Users can choose to include specific apps in the tunnel or exclude them, with the opposite setting applying to all other software. In NordVPN for Windows, the setting is accessed via the cog icon in the bottom left corner of the interface. After activating the toggle, users select the specific applications that will retain VPN protection.

The feature addresses specific friction points of standard VPN usage. Local services, such as streaming platforms or smart home devices, often rely on the user's physical location or local network address. A standard VPN masks this data, which can prevent a ticketing app from showing nearby movie times or stop a printer from communicating with a home computer. Split tunneling allows these local interactions to proceed without the encryption overhead or location masking.

While app-based routing is the primary method for consumer users, other variations exist. Some services offer URL-based rules that apply to specific domain names, or route-based rules that target specific IP addresses. These latter methods are less common in consumer software and are typically reserved for administrators managing multiple user accounts. On mobile devices, the functionality is more restricted. Android devices and desktops offer full app-level control, whereas iPhones generally limit users to excluding specific websites or IP addresses rather than entire applications.

The setup process is designed as a one-time configuration task. Once users designate which applications remain off the VPN, the system maintains that state. Users can revisit the settings at any time to adjust the list, but the feature does not require daily management. This allows for a persistent security posture where protection is active for sensitive activities like online banking and dormant for low-stakes tasks like checking the weather.