Exclude applications from Mozilla VPN protection

Mozilla VPN has a Split tunneling feature that lets you choose the apps you want to protect with the VPN, while allowing other apps to connect directly to the Internet without protection.

Note: Split tunneling is not available for macOS and iOS devices.

How to exclude apps from VPN protection

To exclude applications from VPN protection, you need to change the app permissions settings:

Note: Mozilla VPN must be off to edit app permissions.
  1. Open Mozilla VPN and go to Settings (the gear vpn settings icon icon).
  2. Tap (or click) Network settings.
  3. Select App permissions.
  4. Make sure that the switch next to Protect all Apps with VPN is off.
  5. Under Exclude Apps from VPN Protection, select the apps whose data you don't want to go through the VPN tunnel.

On Linux, Split tunneling is only supported if the following two conditions are met:

  1. Control groups version 1 is mounted somewhere (should be the case for any Debian-based distro).
  2. The user is running a desktop environment based on GTK. This should include GNOME, MATE, Unity and Cinnamon (notably missing are KDE and XFCE).

Common questions

Why would I want to exclude certain applications?

Using a VPN can impact the performance of certain online games and streaming apps, as the added routing can slow down your internet connection. Additionally, some banking apps may not allow connections through a VPN for security reasons.

My excluded app cannot connect to the Internet

Some excluded apps need to be restarted once Mozilla VPN is turned on.

I can’t add Microsoft Store apps to the list of excluded apps

Microsoft store apps (non-win32 aka UWP apps) are not supported.

My app is not on the list

You can scroll to the bottom of the list and add the missing application manually.

I can’t see the app permissions menu in the settings on Linux

On Linux, the Split tunneling feature is only available if the following two conditions are met:

  • The net_cls control group has been mounted somewhere. On Ubuntu, this should be something like /sys/fs/cgroup/net_cls.
  • The user is running a GTK-based desktop environment. Specifically, we look at the value of the XDG_CURRENT_DESKTOP environment variable, and expect to find one of GNOME, MATE, Unity or X-Cinnamon in there.

Related articles

Learn more:

Was this article helpful?

Please wait...

These fine people helped write this article:

Illustration of hands


Grow and share your expertise with others. Answer questions and improve our knowledge base.

Learn More