NordVPN: exclude an application from the VPN

Analysis of official documentation, with no testing on a paid account.

If a work application fails with NordVPN, do not turn off the entire VPN: create the narrowest exception your platform allows, then check the excluded service and another service that must stay in the tunnel separately. Under Windows, Android and Android TV, the exception may be an application. In the browser extension, it targets a domain or IP address. Under Linux, the authorization list covers ports or sub-networks. NordVPN does not announce this function on macOS or iOS.

This guide targets an independent or small team facing a bank, accounting tool, local device or application that refuses a VPN connection. Official aid NordVPN Consulted the 21 October 2026.

Choose the smallest exception

Split tunneling separates traffic: some continues through the VPN, while the rest uses the direct connection. Excluded traffic therefore no longer benefits from the tunnel’s protection. The appropriate unit depends on the problem and platform, rather than a single setting to copy everywhere.

Excluding an entire browser under Windows directly releases all its sessions, not just the site that poses a problem. If the block concerns a specific domain, the extension allows a finer exception. Conversely, an autonomous office application cannot be targeted by a domain rule in the extension.

Configure without widening the derogation

On Windows, enable split tunneling in the NordVPN app’s connection settings, choose the mode that disables the VPN for selected applications, then add the relevant executable. On Android and Android TV, the official help also describes a list of excluded applications. Close and restart the application after the change so that an existing connection does not distort the check.

In the NordVPN extension, use "Exclude VPN" to add the domain or IP address. The option of excluding sub-domains deserves a separate decision: activate it for exemple.fr extends the rule to services such as factures.exemple.fr or admin.exemple.fr. Reload the already opened tabs after the change. The vendor specifies that these destinations then see your real IP address and that their traffic no longer passes through the VPN tunnel.

On Linux, the allowlist can cover a port or a subnet. This scope is more technical: allowing a port affects all traffic that uses it, while allowing a subnet can expose several devices. Record the rule you add and the reason for it so you can remove it later without guessing.

Check the Kill Switch before concluding a breakdown

Kill Switch and split tunneling serve different purposes. The former blocks traffic when the expected protection is unavailable; the latter lets some traffic bypass the tunnel. NordVPN states that Internet Kill Switch takes priority: when the settings conflict, the excluded application may remain blocked instead of using the direct connection.

If the exception has no effect, first note the Kill Switch mode. For a limited diagnosis, change one setting at a time, repeat the failed action, and then restore the chosen policy. Do not leave the Kill Switch disabled by habit if its blocking meets a team security requirement.

Prove the rule solves the right problem

1. Before the change, record the exact action that fails, such as "validation of the payment refused after connection".
2. Add one exception: application, domain, port or sub-network depending on the platform.
3. Relaunch the application or reload the tab, then repeat the same action.
4. In another service that must remain protected, check that the VPN remains connected and that the exception has not extended.
5. Remove the rule if the symptom persists: it has not proven its usefulness.

Check that once access is restored, only the chosen application bypasses the tunnel. Check both paths: the excluded service works through the direct connection, while another activity stays under the VPN. Keep the rule’s date, scope and owner, without recording a login identifier, password or sensitive IP address in a shared note.

Let's take this case: a banking portal blocks the VPN

A freelancer uses her browser for banking, email and several online tools. Only the banking portal refuses the connection when the NordVPN extension is active. Excluding the entire browser in the Windows app would also take email and the other tools outside the tunnel.

The narrowest rule here is to use the extension alone and exclude the domain of the banking portal, without including its default subdomains. After reloading, it checks the bank connection and opens a second site that must always pass through the VPN. If the portal depends on a separate subdomain for authentication, it explicitly adds or activates the option after identifying this need.

Confirm to your bank that this configuration respects your security policy. If the establishment prohibits or contests the connection, its support remains the source to follow.

Remove other causes before reset

A printer, shared screen or broadcast device may fail because local network discovery is blocked, even if the tunneling split is properly set. The NordVPN help describes a local network invisibility setting for Windows and Android. Treat this as a local network problem, not as a reason to randomly exclude multiple applications.

For a failed tunneling split, NordVPN then proposes restarting, updating or reinstalling the application. Network reset must remain a last resort: under Windows, it can reset Wi-Fi networks, passwords, VPN settings and associated settings. Prepare the necessary access before using it.

When split tunneling is not suitable

Do not use this exception for an application that processes sensitive data if your policy requires that all its traffic go through the VPN. Also avoid a rule per port or subnet that no one can explain or monitor. On macOS and iOS, the absence of documented support excludes this path; do not present unofficial circumvention as an equivalent function.

If many applications each require an exception, the problem can come from the selected server, protocol, DNS, firewall or network used. In this case, remove the rules that have become useless and deal with the common cause rather than gradually expanding the area outside VPN.

To complete this choice, see NordVPN review, comparative NordVPN and Surfshark and the guide for prepare emergency access.