Split tunnelling (app exclusions)
Split tunnelling lets you leave specific apps outside Lumina's VPN tunnel. This page explains what that does, and what it costs you for the apps you exclude.
What it is
By default, all of your device's traffic goes through Lumina's encrypted tunnel. In Settings → App exclusions, you can pick specific apps to leave out of the tunnel instead. The picker is a plain, searchable list of the apps installed on your device; Lumina does not pre-suggest or recommend any apps to exclude.
What excluding an app actually means
Say this plainly, because it matters: an excluded app is not protected by Lumina in any way.
- It uses your device's own real IP address, not the relay's. Your network provider, and anyone else who can see the network, can see that app's traffic.
- It resolves DNS through your device's normal system resolver, outside the tunnel, not through Lumina's DNS handling.
- It may still be able to detect that a VPN is active elsewhere on the device, and may behave differently as a result. That is the app's own behaviour, not something Lumina controls.
Only exclude an app if you specifically need it to use your device's real network path. This page and the in-app picker deliberately avoid suggesting which apps that might be, since the right answer depends on what you use the app for.
Apps that share an app identity
Some apps on Android share the same underlying app identity as another app on the same device (for example, different components of the same product). Lumina always excludes those together; you cannot exclude one without the other. This comes from how Android identifies apps, not a Lumina design choice.
Changes need a reconnect
Adding or removing an excluded app does not apply to a connection that is already open. Reconnect after making a change (tap Reconnect now if the app shows it, or disconnect and connect again) for the new exclusion list to take effect.
Incompatible with "Block connections without VPN"
Android has its own device-level setting, usually called "Block connections without VPN", that blocks any traffic not going through the currently active VPN. That setting and app exclusions work against each other by design: if it is turned on for Lumina, an excluded app loses network access entirely rather than using its own real connection, because the setting does not distinguish "excluded by Lumina" from "not going through a VPN at all". If you want exclusions to work as described above, leave that setting off for Lumina. See Troubleshooting if you run into this.
Where the exclusion list is stored
Your list of excluded apps is stored on your device. It is not something this page covers further; see What we can and cannot see for Lumina's broader data posture.
Last updated 22-08-2026.