A VPN is easy to picture as a switch: on means protected, off means not. In practice there's a third state that most people never notice — the moments in between, when the VPN is on but the tunnel isn't actually up. Your phone doesn't pause while that happens. Apps keep syncing, messages keep arriving, and all of it goes out over whatever network you're on.
Two features exist to deal with this properly. The kill switch makes sure nothing slips out during those gaps. Split tunneling does almost the opposite: it lets you choose a few apps that shouldn't go through the VPN at all. Used together, they give you protection that's both complete and practical. Here's how each one works, and how to decide what goes where.
The gap nobody sees
A VPN tunnel isn't a permanent pipe. It has to be rebuilt whenever the path underneath it changes, and on a phone that happens constantly:
- You walk out of Wi-Fi range and your phone switches to mobile data — or walks back in and switches again.
- The signal drops in a lift, a car park, or a building with thick walls, and comes back a moment later.
- The network itself hiccups — a busy café router, a hotel network that drops idle connections, a mobile network handing you between towers.
- Your phone wakes up after a long sleep and everything reconnects at once.
Each time, there's a window — usually a few seconds — between the old connection going away and the new tunnel being ready. During that window, apps that are trying to reach the internet don't wait politely. They reconnect over whatever is available, unprotected. Messaging apps check for new messages, email syncs, your browser reloads a tab, and background services report in. On your home network that's rarely a big deal. On an unfamiliar network — the kind we wrote about in our public Wi-Fi guide — it's exactly the exposure you turned the VPN on to avoid.
What the kill switch does
A kill switch closes that window. When it's on and the tunnel drops unexpectedly, Vela blocks all traffic from your phone until the tunnel is back. Nothing goes out unprotected, because nothing goes out at all. As soon as the connection is rebuilt, traffic flows again through the tunnel, and apps carry on as if nothing happened.
It's the difference between 'protected most of the time' and 'protected the whole time'. Most days you won't notice it working. That's the point.
In Vela, the kill switch is free on every plan, including Free. It's off by default, because we'd rather you turn it on knowing what it does than be surprised by it. To switch it on, open the Security screen from Vela's Home screen and turn on Kill Switch. While you're connected, it reads 'Active — internet blocked if VPN drops'.
When you'll notice it — and why that's good news
Occasionally the tunnel takes longer to come back — a weak signal, a network that's slow to hand out an address, a captive portal page on hotel Wi-Fi. With the kill switch on, you'll have no internet for that stretch, and Vela will tell you why: while it reconnects you'll see 'Kill switch active · traffic blocked', and the quick-settings tile shows 'Blocked by kill switch'.
That pause is the kill switch working as designed. It's the moment your phone would otherwise have been talking in the open. In almost every case the tunnel returns on its own within moments and everything resumes.
If it doesn't — say you're on a network that won't let the tunnel connect at all, or you need to accept a hotel's terms page first — you stay in control. Turn off the kill switch on the Security screen and your normal connection comes straight back. Once you're sorted, turn it on again.
A quick rule of thumb: if Vela says the kill switch is blocking traffic, nothing is broken. Your phone is waiting for a safe connection instead of settling for an unsafe one.
Split tunneling: choosing what skips the VPN
Sending everything through the VPN is the safest default. But a few apps genuinely work better with your real, local connection. Split tunneling lets you pick those apps and send them around the tunnel, while everything else stays protected inside it. In Vela, it's described simply as 'Choose apps that bypass the VPN'.
Here are the situations where it earns its place:
- Banking apps that dislike foreign addresses. Some banks treat a login from another country as suspicious and ask for extra verification, or block it. If your bank's app keeps doing that while you're on the VPN, letting it use your local connection can save you the trouble. The app already encrypts its own traffic.
- Local delivery, ride and government apps. Apps built for one country sometimes expect to see a local address, and may refuse to work or show the wrong region otherwise.
- IPTV and local streaming apps. Apps for a local TV service or your home internet provider's streaming often only work from inside that country or that provider's network.
- Printers, casting and home devices. Apps that talk to things on your own network — a printer, a smart TV you cast to, a camera, a router's admin app — can struggle to find them when their traffic is sent out through a tunnel first.
Vela also offers 'Auto-exclude incompatible apps', which keeps the Play Store, Google services and similar system apps outside the tunnel, where they tend to behave better.
What not to exclude
An excluded app travels outside the tunnel. It doesn't get the VPN's encryption or the protections that come with it, and the network you're on can see where it connects. So be deliberate. As a rule, keep these inside the VPN:
- Your browser. It's where you open links from messages, sign in to accounts and visit sites you've never seen before. It's the app that benefits most from protection.
- Messaging and email. Even when the content is encrypted, who you contact and when is sensitive. Keep that pattern inside the tunnel.
- Anything you use on public Wi-Fi. If you'd use it in a café or an airport, it belongs in the VPN.
- Apps you're excluding 'just to see'. If an app works fine through the VPN, leave it there. Exclude only to solve a real problem.
A useful test: if you can't name the problem an exclusion fixes, you probably don't need it. And revisit your list now and then; an app you excluded months ago for a reason you've forgotten is still travelling unprotected.
How to set it up in Vela
- Open the Security screen from Vela's Home screen and turn on Split Tunneling.
- Tap Manage Apps. Checked apps bypass the VPN tunnel; the Bypassed tab shows everything you've excluded so far.
- Reconnect the VPN for the changes to take effect.
Three everyday situations
It helps to see how the two features play out on an ordinary day.
The morning commute. You leave home with Vela connected over your Wi-Fi. At the door your phone drops to mobile data, then picks up a café's Wi-Fi on the way, then loses it again. Each change means a new tunnel. With the kill switch on, the messages and emails that sync during those switches wait a moment and then go through the tunnel. Without it, some of them go out on whichever network happened to be there.
The hotel check-in. You join the hotel Wi-Fi and nothing loads, because the network wants you to accept its terms first and the tunnel can't connect until you do. Vela tells you the kill switch is blocking traffic. Turn the kill switch off, accept the terms page, reconnect, and turn the kill switch back on. It takes a minute, and from then on your stay is covered.
Working from home. You keep Vela on all day, but your bank's app keeps asking you to verify your identity, and the printer app can't find the printer. You add both to split tunneling, reconnect, and they behave normally — while your browser, messages and everything else stay inside the tunnel.
Which is free, and which is Premium
The kill switch is included on every Vela plan, Free included — we think closing the reconnect gap is basic protection, not an upgrade. Split tunneling is a Premium feature, alongside unlimited data, all server locations and up to 5 devices; you can see the full list on our pricing page. On the Free plan you'll see Split Tunneling in the Security screen marked as Premium.
Both features are about the same thing, really: making the VPN fit your day rather than the other way round. The kill switch makes sure protection doesn't quietly lapse when the network changes. Split tunneling makes sure protection doesn't get in the way of the few apps that need your real connection. And if you want to understand what a VPN provider does with the traffic that does go through the tunnel, our guide to what no-logs really means is the next thing to read.
Protected the whole time, not most of it
Vela's kill switch is free on every plan — turn it on once and nothing leaks while the tunnel reconnects. Premium adds split tunneling, so the apps that need your real connection can have it.