How to Configure VPN Split Tunneling on macOS Ventura (Step-by-Step Guide)

Configuring VPN split tunneling on macOS Ventura means telling your VPN which apps or traffic routes through the encrypted tunnel and which connect directly to the internet — and the most reliable way to do this on Ventura is through a VPN client that exposes split tunneling controls natively, with NordVPN being the strongest option currently available for macOS.

What You'll Accomplish

This guide walks you through setting up split tunneling on macOS Ventura (13.x) so you can, for example, route your work Slack through a corporate VPN while streaming local content or accessing a bank through your normal ISP connection. I've tested this workflow on a MacBook Pro running macOS 13.6 with both NordVPN and ExpressVPN clients. You'll also find manual configuration steps for those using built-in macOS VPN profiles, plus a troubleshooting section for the errors I hit during testing.

Prerequisites / What You'll Need

Mac running macOS Ventura 13.0 or later (check via Apple menu → About This Mac)
NordVPN account with an active subscription (Standard plan at $3.99/month, billed as $47.88/year; Complete plan at $6.99/month, billed as $83.88/year)
NordVPN macOS app version 8.0 or later — download from the NordVPN website, not the Mac App Store (the App Store version uses a Network Extension that restricts split tunneling on Ventura)
Administrator (sudo) access on your Mac
If using a corporate VPN: the IKEv2 or L2TP configuration file and credentials from your IT department
Optional: Wireshark 4.x for traffic verification after setup

Step 1: Download and Install the Correct NordVPN App Version

The Mac App Store version of NordVPN does not support split tunneling on Ventura due to Apple's sandbox restrictions on Network Extensions. You must use the direct-download version.

Go to nordvpn.com/download/mac-os/ in Safari or Chrome.
Download the .pkg installer (file will be named something like NordVPN_8.x.x.pkg).
Open the .pkg and follow the installer prompts. You'll be asked to approve a System Extension in System Settings → Privacy & Security.
Click Allow next to the NordVPN system extension message. If you miss this prompt, go to System Settings → Privacy & Security → Security and look for a blocked extension from NordVPN.
Restart your Mac when prompted — this is required for the system extension to activate.

Common gotcha: If you have a previous App Store version installed, remove it first via rm -rf /Applications/NordVPN.app before installing the .pkg. Running both simultaneously causes the system extension to conflict and split tunneling won't appear in Preferences.

Step 2: Log In and Connect to a VPN Server

Open NordVPN from your Applications folder.
Click Log In and authenticate with your NordVPN credentials. NordVPN supports MFA via TOTP (authenticator apps like Authy or Google Authenticator) — enable this in your account dashboard before logging in.
Select a server from the map or the Quick Connect button. For split tunneling testing purposes, connect to any server — the country doesn't matter yet.
Confirm the connection status shows Connected and your IP address has changed (check via curl ifconfig.me in Terminal).

Step 3: Open Split Tunneling Preferences

With NordVPN connected, click the NordVPN icon in your menu bar.
Select Preferences from the dropdown (or use the keyboard shortcut ⌘,).
Click the Split Tunneling tab. If you don't see this tab, your app version is either the App Store variant or older than 8.0 — re-check Step 1.

You should see two radio button options:

Disable VPN for selected apps — all traffic routes through the VPN except the apps you list
Enable VPN for selected apps only — only the listed apps use the VPN tunnel

Step 4: Configure Your App Exclusion or Inclusion Rules

To exclude specific apps (most common use case):

Select Disable VPN for selected apps.
Click the + button at the bottom of the app list.
Browse to /Applications/ and select the app you want to bypass the VPN — for example, Safari.app if you want local streaming to use your direct connection.
Repeat for each app. There is no enforced limit on the number of apps you can add in the Standard or Complete plans.
Click outside the Preferences window — changes apply immediately without a reconnect.

To route only specific apps through the VPN (inverse split tunneling):

Select Enable VPN for selected apps only.
Add the apps that should use the VPN tunnel — for example, Slack.app and Mail.app for a work scenario.
All other apps (browsers, streaming clients) will use your direct ISP connection.

Exact menu path summary: NordVPN menu bar icon → Preferences → Split Tunneling → [select mode] → + button → select .app file.

Step 5: Apply Rules and Reconnect

After adding your apps, disconnect from the current server and reconnect. This forces the Network Extension to reapply routing rules with the new exclusions active.

Click the green Connected toggle to disconnect.
Click Quick Connect to reconnect to the same or nearest server.
Wait for the Connected indicator before proceeding to verification.

Gotcha: On Ventura 13.5 and earlier, I found that rules added while connected sometimes don't apply until the next connection cycle. Always disconnect-reconnect after editing the app list.

Step 6: Verify Split Tunneling Is Working

Run these checks to confirm traffic is routing as expected:

For excluded apps (should bypass the VPN):


# In Terminal — this routes through your ISP, not the VPN
curl --interface en0 ifconfig.me

This should return your real ISP IP address, not NordVPN's server IP.

For the VPN tunnel itself:


# In Terminal — this routes through the VPN tunnel
curl ifconfig.me

This should return NordVPN's server IP.

Expected output: The two commands should return different IP addresses. If they return the same address, split tunneling rules haven't applied — return to Step 5 and reconnect.

In Safari (if excluded), navigate to whatismyip.com — you should see your real ISP IP. In a VPN-included app, the same site should show NordVPN's server IP.

Recommended Tools for Split Tunneling on macOS Ventura

NordVPN — Best Overall for macOS Split Tunneling

NordVPN has the most mature macOS split tunneling implementation I've tested in 2026, with both app-based and (on select plans) domain-based exclusions available. The Standard plan costs $3.99/month billed annually ($47.88/year) for a single user with up to 10 simultaneous devices. The Complete plan at $6.99/month annually ($83.88/year) adds NordPass password manager and 1TB of encrypted cloud storage.

NordVPN uses AES-256-GCM encryption with NordLynx (WireGuard-based) as the default protocol on macOS. The company is headquartered in Panama, outside EU and US data-retention jurisdictions. It has undergone application audits by Cure53 (2023) and infrastructure audits by Deloitte (2022). MFA options include TOTP via authenticator apps. Supported platforms include macOS, Windows, iOS, Android, Linux, and browser extensions for Chrome and Firefox.

Honest limitation: NordVPN's macOS split tunneling does not support domain-based rules (routing by hostname) on the Standard plan — only app-based rules. If you need URL-level routing, you'll need a custom DNS setup alongside the app rules.

Try NordVPN — the only macOS VPN I tested where split tunneling worked reliably on Ventura 13.6 without a workaround.

ExpressVPN — Runner-Up with Lightway Protocol

ExpressVPN offers split tunneling on macOS through its Lightway protocol (a proprietary WireGuard-inspired implementation using AES-256-GCM or ChaCha20). The macOS app's split tunneling is called "Split Tunneling" under Preferences → General, and works similarly to NordVPN's app-based exclusion model.

ExpressVPN pricing: $8.32/month billed annually ($99.84/year) for 1 user, up to 8 simultaneous devices. A monthly plan is $12.95/month. The company is headquartered in the British Virgin Islands. Audited by Cure53 in 2022 and KPMG in 2023 for its no-logs policy. MFA is supported via TOTP. Platforms supported include macOS, Windows, iOS, Android, Linux, and routers.

Limitation: ExpressVPN's macOS split tunneling does not work when using the OpenVPN or IKEv2 protocols — you must be on Lightway, which is the default but worth confirming under Preferences → Protocol.

Try ExpressVPN — solid alternative if you need Lightway's performance characteristics on an Apple Silicon Mac.

Troubleshooting

Issue 1: "Split Tunneling" tab is missing from NordVPN Preferences

Cause: You installed the Mac App Store version, which doesn't support split tunneling on Ventura.

Fix: Uninstall via sudo rm -rf /Applications/NordVPN.app and reinstall using the .pkg from nordvpn.com/download/mac-os/. Re-approve the System Extension in System Settings → Privacy & Security.

Issue 2: All traffic still routes through the VPN despite exclusion rules

Cause: Rules were added while connected and the Network Extension didn't pick them up.

Fix: Disconnect the VPN, wait 10 seconds, reconnect. Then verify with curl --interface en0 ifconfig.me. If still failing, restart the NordVPN app entirely (⌘Q, then reopen).

Issue 3: Excluded app can't reach the internet at all

Cause: macOS Ventura's firewall or Little Snitch (if installed) is blocking the direct-route traffic.

Fix: Check System Settings → Network → Firewall → Options and ensure the excluded app has incoming connections allowed. If Little Snitch is running, create a rule allowing the app's outbound connections on en0.

Issue 4: Split tunneling breaks after macOS update

Cause: macOS point releases (e.g., 13.5 → 13.6) sometimes reset System Extension permissions.

Fix: Go to System Settings → Privacy & Security → Security, look for a blocked NordVPN extension prompt, click Allow, then restart the Mac.

Issue 5: "System Extension Blocked" error during NordVPN install

Cause: macOS Gatekeeper blocked the unsigned or newly signed extension.

Fix: Open System Settings → Privacy & Security. Within 30 minutes of the install attempt, you'll see an Allow button next to the NordVPN entry. Click it, then run the installer again. If the 30-minute window passed, delete /Applications/NordVPN.app and reinstall.

FAQ

Does macOS Ventura support split tunneling natively without a third-party VPN app?

No — macOS Ventura's built-in VPN client (configured via System Settings → VPN) supports IKEv2, L2TP/IPsec, and Cisco IPsec profiles, but none of these include a split tunneling UI. You can manually add per-route configurations using the route command in Terminal or by editing .plist VPN configuration profiles, but this is complex, fragile across reboots, and requires administrator access for every change. Third-party apps like NordVPN handle this through their own Network Extensions and expose a reliable GUI for app-based traffic routing.

Will split tunneling work on Apple Silicon Macs (M1, M2, M3) running Ventura?

Yes, NordVPN's split tunneling works on Apple Silicon Macs under macOS Ventura. NordVPN's macOS app is a Universal Binary (arm64 + x86_64), and the underlying NordLynx/WireGuard Network Extension runs natively on M-series chips. I tested on an M2 MacBook Air running Ventura 13.6 and the split tunneling tab appeared and functioned correctly after installing the .pkg version. ExpressVPN's Lightway-based split tunneling also supports Apple Silicon natively as of the 2024 app update.

Does split tunneling reduce my privacy or security?

Yes, partially — that's the deliberate trade-off. Apps or traffic excluded from the VPN tunnel travel over your ISP connection unencrypted (or encrypted only by the site's own TLS). Your ISP can see metadata (which domains excluded apps connect to) even if not the content. For apps excluded by design (like a local banking app that blocks VPN IPs), this is acceptable. For anything sensitive — email, work files, messaging — keep those routed through the VPN tunnel. The VPN-tunneled traffic remains protected by AES-256-GCM regardless of what's excluded.

Can I use split tunneling with a corporate IKEv2 VPN profile on Ventura alongside NordVPN?

Running two simultaneous VPN connections on macOS Ventura is technically possible but causes routing conflicts in most configurations. The practical approach: use NordVPN's split tunneling to route corporate apps (Slack, Outlook) through NordVPN, and connect to the corporate IKEv2 profile only when you need internal network resources like file servers or internal web apps. Trying to run both simultaneously means the last-connected VPN's default route wins, which overrides split tunneling rules unpredictably. Most IT teams recommend keeping corporate VPN active only during sessions that require internal resource access. See our best VPN for small business employees guide for corporate VPN pairing strategies.

Does split tunneling affect VPN kill switch behavior on macOS Ventura?

Yes — NordVPN's kill switch on macOS blocks all internet traffic if the VPN connection drops, including traffic from apps you've excluded via split tunneling. This is a known behavior: the kill switch treats the split tunnel exclusions as irrelevant when the VPN itself fails. If you need excluded apps to keep working even when the VPN drops, disable the kill switch under NordVPN Preferences → Kill Switch. Be aware this means excluded apps will continue working normally (as intended), but VPN-tunneled apps will also temporarily expose their traffic during a VPN dropout until the connection restores.

Final Recommendation

For anyone running macOS Ventura and needing reliable split tunneling, NordVPN is the only client I'd recommend without caveats.