Author: Pavel Onuchin, VPN and network security specialist

7 min read

Updated: October 23, 2026

Your Bank and Local Services Won't Open Over a VPN: Setting Up Split Tunnelling

If your banking app, government portal or local marketplace stopped opening once the VPN was on, the problem is not your internet. The service sees a foreign IP address and closes itself off. The cure is not switching the VPN off but split tunnelling: local sites go direct, everything else goes through the tunnel. On Android in BessyConnect this takes a minute to configure; on iPhone you cannot pick per-app exceptions at all — and below is why, and what to do instead.

Why local services stop opening over a VPN

Banks, payment systems, government portals and regional marketplaces routinely restrict access from foreign IP addresses. For some it is licensing, for others fraud prevention, for others a regulatory requirement. The effect is the same: your tunnel's exit address does not match the country you normally pay from.

It shows up differently, and the symptom tells you what you are dealing with:

the page does not load or returns a blank screen — blocking by IP;
the app asks you to "reset your network settings" — the same block, phrased politely;
the site opens but login or payment fails — the bank's anti-fraud system fired, and to it a login from another country looks like an intrusion attempt;
everything is slow but does open — that is not about IP; the causes are covered in why a VPN does not work and how to fix it.

What split tunnelling is

Split tunnelling is a mode in which part of your traffic goes through the VPN and part goes directly from your provider. The device holds two routes at once and picks one per connection: your bank sees a local IP, YouTube sees a foreign one, and you switch nothing.

Without this mode the rule is all-or-nothing: VPN on, all traffic leaves the country; VPN off, it comes back. That is exactly why people flip the toggle ten times a day.

Four ways to split traffic, and which to choose

Method	Where it is configured	What it gives	Cost of getting it wrong
By application	The VPN client on Android	Bank and government apps bypass the tunnel, the browser goes through it	There is only one browser: exclude it entirely and blocked sites stop opening in it
By domain and zone (local TLDs → direct)	Routing rules in the client	Precise, works in both the browser and apps	A local service on a foreign domain (or CDN) will not be caught by the rule
By GeoIP lists	Client or router	Automatically covers thousands of local addresses	Lists go stale; a new service takes a while to appear in them
On the router	Router firmware	Once for the whole home, TV and set-top box included	Needs a router that supports it and half an hour of setup

In practice: "local TLD zones direct" plus two or three apps in the exceptions covers nearly every everyday case. Full GeoIP lists are for people who regularly pay utility bills, buy tickets and use regional portals.

Android: exceptions by app and by domain

BessyConnect on Android offers both mechanisms — you can pick apps and domains that will bypass the tunnel. The order:

Open the app's settings and find the exceptions section (split tunnelling).
Tick the apps that need a local IP: bank, government portal, marketplace, mobile operator's app.
For websites, add your local TLD zones as rules in "direct" mode.
Reconnect and check: open the bank first, then any blocked site. Both should work.

One mistake occurs more often than the rest — excluding the browser entirely. After that the bank will open in the browser, but the whole rest of the web goes direct with it, and blocked sites stop working. Exclude applications, and separate sites with domain rules. Basic setup is covered separately: how to set up a VPN on Android.

iPhone and iPad: why there is no "exclude app" button, and never will be

On iOS you cannot pick which applications bypass the VPN — this is a restriction of the system itself, not of any particular client. Per-app VPN does exist at Apple, but only for devices under MDM management, that is, corporate ones; an App Store app is not given the API for that kind of routing (Apple's VPN deployment documentation, discussions in the Apple Developer Forums). Any advice along the lines of "enable app exceptions in settings on your iPhone" runs into this.

What actually works on iPhone:

Address rules inside the tunnel. The app itself decides which connections to send direct — this works at the level of domains and IPs, not applications. That is how bank and government portal sites get handled.
Switching off for a moment. Paid the bills, turned the VPN back on. Inconvenient, but predictable.
Separation by device. Keep local services on a device without a VPN and everything else on one with it.
Wi-Fi rules. The VPN switches on automatically in unfamiliar networks and does not come up on your home one, where you pay your bills. Why that matters: security on public Wi-Fi.

Router: split the traffic once for the whole home

Configuring it on the router settles the question for the TV, the console and smart speakers, which have no VPN client of their own. The logic is the same: a list of local zones and addresses goes direct, everything else into the tunnel.

The limitation is an honest one: routing on the router does not distinguish devices inside the network. If you need one set of rules for the laptop and another for the phone, that is done on the devices themselves.

If a service complains about a VPN even when it is off

Three causes, by frequency:

Cache and cookies. The site remembered your previous session from a foreign IP. Clear the site's data and sign in again.
DNS. The system keeps reaching a foreign DNS server, and the service takes you for a foreigner. You can check this with a leak test — see DNS leaks: what they are and how to check your VPN.
The VPN profile is still in the system. On iOS, switching off in the app does not always remove the profile: Settings → General → VPN & Device Management.

Why BessyConnect suits this setup

Split tunnelling only makes sense when the main channel is stable: if the tunnel keeps dropping, you will live in the settings rather than on the internet. BessyConnect runs on VLESS + Reality — a protocol that masks traffic as an ordinary TLS connection to a real site, which makes it harder for provider equipment to identify (in detail: Reality and VLESS in plain language). The network is 100+ servers in 15+ countries, with no logs and no limit on the number of devices: one account covers both the phone with its exceptions and the router.

Download:

iPhone, iPad, Mac, Apple TV and Apple Watch — App Store
Android — Google Play
Android TV and set-top boxes — Google Play

Third-party clients with manually entered configs can do routing rules too, but there you are responsible for whose server is written into the config and what it does with your traffic. What we do and do not store: the BessyConnect review.

Frequently asked questions

Does split tunnelling reduce security? Partly: traffic that goes around the tunnel is visible to your provider as usual — which domains you opened and how much data moved. For a bank or a government portal that is acceptable; they know who you are anyway. Only keep outside the tunnel the services that genuinely need a local IP.

Why won't my bank let me in even with an exception? Most likely the app has already remembered a foreign session or is reaching a foreign DNS. Clear the app's data, check DNS and sign in again.

Can I exclude just one site rather than a whole app? Yes, if the client supports domain rules. Then that one domain goes direct while the rest of the browser goes through the VPN. On iOS this is the only available way to split.

What do I do if a service demands I "reset my network settings"? That is a polite way of saying "you have a foreign IP". Resetting settings will not help — the traffic to that service needs to go direct.

Does split tunnelling work on Android TV? On a TV the set of apps is smaller and local services usually do not conflict with the VPN. If there is a conflict, it is easier to split the traffic on the router.

Sign In