Per-App Routing: Route the Right Apps Through VPN

8 min · Updated July 13, 2026

Per-app routing removes the all-or-nothing VPN tradeoff: you decide exactly which apps tunnel through the VPN and which use your regular connection. This guide covers planning your routing rules, setting them up on macOS, Android, and iPhone (Windows routes by domain and IP instead), and verifying the result with a leak test. It also covers multi tunneling, which gives each app its own country at the same time.

How per-app routing works

Every app on your device gets one of three rules:

Route through VPN: the app uses a VPN server, in a country you choose
Bypass: the app connects directly with your real IP
Default: the app follows your main VPN connection

Multi tunneling (included in every plan) extends this: instead of one shared tunnel, each app can run through its own tunnel to a different country simultaneously. Streaming through the US, banking on your home IP, and work apps through a third country, all at once, on one device.

Step 1: List apps that need a foreign IP

Note the apps that need to appear in a specific country:

Streaming services with regional catalogs or rights (Netflix, BBC iPlayer, DAZN)
Games with region-locked servers or content
News sites blocked in your current location
Work tools reachable only from your home country

These get a Route through VPN rule with a country assigned.

Step 2: List apps that need your real IP

Equally important are the apps that should bypass the VPN:

Banking and financial apps. Foreign logins often trigger fraud flags and account locks.
Local delivery services. They need your real location for availability and delivery estimates.
Latency-sensitive games. A direct connection is usually faster to nearby servers.
Corporate VPN clients. Your employer’s VPN should manage its own connection.

These get the Bypass rule.

Step 3: Set up routing on Windows

On Windows, rules target domains and IP addresses rather than individual programs. Open the Per App tab, add a rule, enter the site (like example.com) or IP range, and pick its country. Traffic to that destination takes the tunnel no matter which program opens it.

This works well when the thing you want to move is a website or service. If you need to move a whole program, that’s available on macOS, Android, and iPhone.

Step 4: Set up routing on macOS

Open OmnixVPN → Settings → Per-App Routing. Installed apps from /Applications are listed; toggle each between VPN and Bypass, or click Add App to select one manually in Finder.

Some sandboxed macOS apps send traffic through helper processes. If an app ignores its routing rule, find its helpers in Activity Monitor and add those to the same rule.

Step 5: Set up routing on Android

Open OmnixVPN → Settings → Per-App Routing. All installed apps appear automatically; assign each a rule the same way. On iOS, pick apps through the built-in App Store search instead.

Step 6: Assign a country per app with multi tunneling

On a Pro or Family plan, go to Settings → Routing → Multi Tunneling and enable it. For each app, choose a specific country, Direct, or Default. Tunnels run in parallel, so there’s no switching: Netflix can hold a US IP while your bank sees your real one in the same minute.

Step 7: Test and save your configuration

Testing matters: a misconfigured rule leaves you either exposed or locked out of a service.

Routed apps: open a browser assigned to a foreign server and visit an IP checker; it should show the assigned country. Streaming apps should show that country’s catalog.
Bypass apps: log into your banking app normally; any location it shows should be your real one.
DNS: run a test at dnsleaktest.com while routing is active. Your ISP’s resolvers should not appear.

When everything checks out, save the configuration as a named profile (for example “Daily”, “Travel”, “Streaming”) so you can switch setups in one tap. Rules persist across reconnects and reboots.

Common mistakes

Adding a launcher instead of the real executable, or forgetting helper processes. Check Task Manager or Activity Monitor.
Routing banking apps through a foreign country. That’s the fastest way to a fraud lock.
Setting everything to Bypass, which quietly disables your protection.
Never re-testing. App updates can change how an app sends traffic, so verify after major updates.

Frequently asked questions

What’s the difference between per-app routing and multi tunneling?

Per-app routing decides whether each app uses the VPN or your direct connection. Multi tunneling, included in every plan, goes further: each app can run through its own tunnel to a different country, all active simultaneously on one device.

Can I route one browser through the VPN and another directly?

Yes. Each browser is a separate app in the routing list, so Chrome can use a US server while Firefox stays on your direct connection. It’s a practical way to separate geo-sensitive browsing from banking and local services.

What happens to apps I don’t configure?

Unconfigured apps follow the Default rule, which routes them through your main VPN connection. You can flip the default to Bypass so only explicitly configured apps use the VPN; just remember that leaves every other app unprotected.

Does routing apps through different countries slow things down?

Tunnels run in parallel rather than in sequence, so apps don’t queue behind each other. Each app’s speed depends mainly on the distance and load of the server it’s assigned, the same factors as an ordinary single VPN connection.