Why exceptions are needed
A whole-home VPN on the router covers devices that cannot run a VPN app. Some services behave differently when your traffic comes from a VPN address. NordVPN's help article notes that some apps or services may not work as expected when excluded from the VPN with split tunneling. It also says streaming location detection can go wrong when excluded apps show your ISP address while DNS still goes through NordVPN. Exceptions let you keep the tunnel for most traffic and send a short list outside it. [2]
This guide describes GL.iNet firmware 4.9 and later, which GL.iNet's VPN dashboard page is based on. Older firmware has different screens. [1]
How GL.iNet VPN policies are built
Each tunnel group combines one or more VPN profiles, a client source (who) and a target (where). Traffic is checked against groups in priority order and goes to the first group that matches. [1]
| Setting | Options in firmware 4.9 | Typical home-office use |
|---|---|---|
| Client source | All Clients; Specified Connection Types (LAN subnet, Drop-in Gateway, Guest Network); Specified Devices (by MAC); Exclude Specified Devices | Exclude a TV, or put only the guest network through the tunnel |
| Target | All Targets; Specified Domain / IP List; Exclude specified Domain / IP List | Exclude a bank's and a streaming service's domains |
| Tunnel Kill Switch | Blocks the group's traffic if its tunnel drops; if off, that traffic fails over to the All Other Traffic route | On for privacy-critical groups |
| Allow Non-VPN Traffic (global) | On by default; unmatched traffic uses the normal WAN | Leave on so excluded items keep working |
| Enhanced Kill Switch (global) | Blocks unmatched traffic; all internet must use a VPN | Only if nothing should ever bypass the VPN |
Device rules or domain rules
Device rules are the most predictable. A TV excluded by MAC address never uses the tunnel. A work laptop added to a device group always does. If a device uses a randomized or private Wi-Fi address, its MAC can change, so set that device to use a fixed address on your network. [1]
Domain or IP rules are more precise, but you have to maintain them. GL.iNet's docs say you enter the list manually. Start with the domains you type into the browser. If a site still sees a VPN address, check which other domains the page or app loads, add them, and test again. [1]
DNS follows the routing decision. GL.iNet's firmware 4.11 DNS docs say VPN-policy traffic uses the DNS servers provided by the VPN tunnel and non-VPN traffic uses the WAN's DNS servers, unless you apply manual DNS to the tunnels. [4]
Worked example: a fictional two-person home office
The household has two work laptops, two phones, a smart TV and a games console. The goal is to keep all traffic in the VPN except online banking on any device and the TV's streaming apps.
One tunnel group does the job. Set its client source to Exclude Specified Devices and add the TV's MAC address, so every other device matches. Set its target to Exclude specified Domain / IP List and enter the bank's domains. Turn the group's Kill Switch on. Leave the global Allow Non-VPN Traffic on, so the TV and the bank's domains go out through the normal WAN. [1]
Result: laptops, phones and the console use the tunnel. The TV and the listed banking domains do not. If the VPN drops, the Kill Switch blocks traffic in group 1 instead of letting it leak to the WAN. The excluded items keep working throughout. [1]
When the VPN app's split tunneling is simpler
If only one or two computers need exceptions, an app on the device may be easier than a router rule. NordVPN documents split tunneling by app on Windows and Android, and on Android TV. On Linux it offers an allowlist by port, port range or subnet instead. Those are the platforms its split tunneling article covers. [2]
Proton VPN says split tunneling needs a paid plan. On Windows it supports apps and IP addresses. On Android it supports apps and IPs, with an inverse (include) mode. On macOS it is experimental, excludes apps only, works only with WireGuard and Stealth, and does not reliably handle Safari and other WebKit apps. Proton also says split tunneling is generally incompatible with its kill switch, except on Windows. [3]
Do not run a device VPN app and a router tunnel on the same traffic without a reason. Decide which layer owns each device.
Verification checklist
- Write down your normal public IP with the VPN off, then turn the policy on.
- From a laptop in the tunnel, open a what-is-my-IP page: it should show the VPN address.
- From the excluded TV, or the same page opened on a listed domain if you can, confirm your ISP address.
- Log in to the bank on a phone that is in the tunnel; the bank's domains should bypass it. If the bank still flags a VPN, add the missing domains.
- Disconnect the VPN profile and confirm that tunnel devices lose internet (Kill Switch) while excluded ones keep it. [1]
- Keep a screenshot of each tunnel group and its priority order before any firmware upgrade.
Questions before you decide
Does domain-based exclusion work automatically for every banking site?
No. GL.iNet's docs say you enter the domain or IP list manually. A service that loads from domains you did not list may still go through the tunnel, so test each one and add what is missing.
Can I use NordVPN or Proton VPN split tunneling instead?
On some devices. NordVPN documents app-based split tunneling on Windows and Android, and an allowlist by port or subnet on Linux. Proton VPN offers split tunneling on paid plans: apps and IPs on Windows and Android, and app exclusion only, as an experimental feature, on macOS.
What does Enhanced Kill Switch do?
GL.iNet says it blocks traffic that matches no tunnel, so all internet access must go through a VPN. It does not override each tunnel's own Kill Switch setting.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- GL.iNet Router Docs 4: VPN Dashboard Accessed 30 Oct 2026
- NordVPN Help Center: What is split tunneling and how to use it Accessed 30 Oct 2026
- Proton VPN Support: Split tunneling Accessed 30 Oct 2026
- GL.iNet Router Docs 4: DNS (firmware v4.11) Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.