Meaning one: traffic that skips the tunnel
This is split tunnelling, and it is a normal setting in most clients. You nominate applications or destinations that should use your ordinary connection while everything else goes through the VPN.
People use it for banking apps that flag foreign addresses, for local network devices like a printer or a NAS that become unreachable through a tunnel, and for anything latency-sensitive they do not need protected.
The cost is that anything you exclude is exposed exactly as it would be with no VPN at all. It is a deliberate hole, which is fine when you chose it and bad when you forgot you did. All four providers we cover offer split tunnelling.
Meaning two: getting past a block on VPNs
Streaming services, banks and some governments detect and block VPN traffic. "Bypass" here means defeating that detection, and the mechanism is obfuscation: disguising VPN traffic so it looks like ordinary HTTPS.
Detection works in two ways. Address-based blocking maintains lists of known VPN server ranges — this is what streaming services mostly do, and providers counter it by rotating addresses. Protocol-based blocking inspects traffic patterns to identify a VPN handshake regardless of address — this is what national firewalls do, and only obfuscation counters it.
Of the providers we cover, Proton VPN ships a dedicated Stealth mode and NordVPN offers obfuscated servers with its NordWhisper protocol. PureVPN and FastestVPN rely on protocol choice alone, which is weaker against active inspection.
- Address-based blocking: countered by the provider rotating server addresses
- Protocol-based inspection: countered only by obfuscation
- Account-based checks: not countered by anything, because they identify you, not your traffic
Why the ambiguity matters practically
Searching for how to "bypass VPN blocks" and finding an article about split tunnelling will send you in exactly the wrong direction, and vice versa. The two settings live in different parts of the client and solve unrelated problems.
If your goal is that one app should not use the VPN, you want split tunnelling. If your goal is that a site should stop detecting the VPN, you want obfuscation, a different server, or to accept that the site has won.
Avoid
- Enabling split tunnelling to fix a streaming block — it does the opposite of what you need
- Excluding a browser from the tunnel and forgetting; everything in it is then unprotected
- Expecting obfuscation to help with a service that identifies you by your account
The third meaning, which nobody advertises
Network administrators use "VPN bypass" to mean detecting and blocking employees using a VPN to get around a workplace filter. Deep packet inspection identifies the tunnel and the firewall drops it.
This is worth knowing because it is the same technology described from the other side. The obfuscation your provider sells is designed against exactly the inspection your employer bought. On a device your employer administers, they have easier options than inspection anyway.