Exclude applications from Mozilla VPN protection

Revision Information
  • Revision id: 251539
  • Created:
  • Creator: Artist
  • Comment: more minor changes and consistent spelling of terminology
  • Reviewed: Yes
  • Reviewed:
  • Reviewed by: Fabi.L
  • Is approved? Yes
  • Is current revision? No
  • Ready for localization: No
Revision Source
Revision Content

Mozilla VPN has a Split tunneling feature that lets you choose the apps you want to protect with the VPN, while allowing other apps to connect directly to the Internet without protection.

Note: Split tunneling is not available via iOS.

How to exclude apps from VPN protection

To exclude applications from VPN protection, you need to change the app permissions settings:

Note: Mozilla VPN must be off to edit app permissions.
  1. Open Mozilla VPN and go to Settings (the gear vpn settings icon icon).
  2. Tap (or click) Network settings.
  3. Select App permissions.
  4. Make sure that the switch next to Protect all Apps with VPN is off.
  5. Under Exclude Apps from VPN Protection, select the apps whose data you don't want to go through the VPN tunnel.

On Linux, Split tunneling is only supported if the following two conditions are met:

  1. Control groups version 1 is mounted somewhere (should be the case for any Debian-based distro).
  2. The user is running a desktop environment based on GTK. This should include GNOME, MATE, Unity and Cinnamon (notably missing are KDE and XFCE).

Common questions

Why would I want to exclude certain applications?

Excluding some applications may speed up your browsing.

My excluded app cannot connect to the Internet

Some excluded apps need to be restarted once Mozilla VPN is turned on.

I can’t add Microsoft Store apps to the list of excluded apps

Microsoft store apps (non-win32 aka UWP apps) are not supported.

My app is not on the list

You can scroll to the bottom of the list and add the missing application manually.

I can’t see the app permissions menu in the settings on Linux

On Linux, the Split tunneling feature is only available if the following two conditions are met:

  • The net_cls control group has been mounted somewhere. On Ubuntu, this should be something like /sys/fs/cgroup/net_cls.
  • The user is running a GTK-based desktop environment. Specifically, we look at the value of the XDG_CURRENT_DESKTOP environment variable, and expect to find one of GNOME, MATE, Unity or X-Cinnamon in there.

Related articles

Learn more: