TunnelX Split-Tunneling Manager for Windows: Quick Look

Most Windows VPN clients give you a blunt choice: everything through the tunnel, or nothing. Commercial split-tunneling, when it exists, usually works at the IP or domain level — fine for routing a streaming site, useless for picking which specific applications use the tunnel and which stay on your local network. And if you use more than one VPN protocol (say WireGuard for one server and V2Ray for another), you’re looking at multiple clients. TunnelX takes a different approach — it splits traffic at the process level, and it supports five different tunnel protocols under one interface.

App-Level Granularity vs Commercial Split Tunneling

So what makes TunnelX different from the split-tunneling feature built into NordVPN or Surfshark? The core difference is app-level granularity. Commercial VPNs let you route specific IP ranges or domain names through the tunnel. But TunnelX lets you pick individual Windows processes. You decide exactly which .exe files use the tunnel — Thunderbird for email over WireGuard, qBittorrent over V2Ray, while Chrome, Steam, and everything else stays on your normal internet connection.

Five Protocols Under One Client

And the protocol support is another strong point. So one client handles L2TP/IPsec, V2Ray/Xray, SOCKS5/HTTP Proxy, OpenVPN, and WireGuard. That means no switching between three different apps depending on which protocol your provider uses. I tested this with a WireGuard config from my provider — if you’re new to WireGuard, our WireGuard setup guide walks through getting a profile ready. Created a new profile, pointed it to the .conf file, selected three apps in the list, and connected. The whole setup took under two minutes, including the app selection step.

Connection Health Check That Verifies

But one feature that caught my attention: the connection health check. TunnelX runs actual TCP probes to google.com and cloudflare.com through the tunnel SOCKS path before it ever shows “connected” on the dashboard. If those probes fail — say the proxy is expired or the endpoint is unreachable — the dashboard stays disconnected. And I’ve seen enough commercial VPN apps claim “connected” while my traffic goes nowhere that this feels like basic honesty most tools skip. Still, the dashboard also shows live per-host latency during the verify step, and once connected it displays your exit IP and country flag, all fetched through the tunnel so the lookup itself doesn’t leak your real address. The country lookup pulls from three fallback APIs (ip-api.com, ipwho.is, ipapi.co), all routed through the tunnel, and the flag image comes from flagcdn.com. These are on-demand lookups initiated by the app, not analytics sent to the maintainer — the privacy doc covers this explicitly.

Current Limitations

But TunnelX has real limitations. So first, it’s Windows-only, 64-bit only — no macOS, no Linux, no mobile support. Second, it needs Administrator privileges every time you run it, because route management and packet interception on Windows require elevation. Third, OpenVPN support requires a separate OpenVPN Community installation; the app doesn’t bundle it. And the project is young — about two months old at 286 stars on GitHub. Still, the community is small and you’re depending on one maintainer for updates and fixes.

I also ran into a minor friction point during testing: the app list sometimes misses Windows Store (MSIX) apps and WebView2-based processes unless you keep the app open and refresh the list manually. And the README documents this, but it’s worth knowing if you use Store apps regularly.

Verdict

Bottom line: TunnelX fills a gap that most VPN tools ignore. So if you’re a Windows user who needs real process-level split-tunneling across multiple protocols, it’s the cleanest option I’ve found — and it’s free. But pair it with a WireGuard VPN provider for the tunnel endpoint, and you get a setup that beats most commercial split-tunneling features for control and flexibility. For a comparison of how commercial VPNs handle split tunneling, see our NordVPN vs Surfshark comparison. Just keep in mind it’s a young project maintained by one developer.