How to exclude apps from the VPN on Android
GhostMesh's Android client routes traffic per-app, not just per-device. Some apps are excluded by default for stability or region reasons, some are pinned inside the tunnel because they need it, and the rest follow your own choices.
Quick answer
Go to your VPN connection settings on Android and add an app to the exclusion list to keep it off the tunnel. Google Play Store/Services stay excluded automatically for stability, and core messengers stay pinned inside the tunnel even if you try to exclude them, because they need the protected path to work reliably.
Three categories of app routing
GhostMesh's Android client doesn't treat every app the same way by default — the routing decision depends on what the app is and how well it tolerates running through a VPN interface.
| Category | Behavior | Why |
|---|---|---|
| Pinned messengers (WhatsApp, Signal, Telegram clients, WeChat, Discord) | Always kept inside the tunnel, even in Proxy mode | These either ignore the system HTTP proxy entirely or are noticeably more stable when both sockets and DNS stay on the protected path |
| Critical system packages (Google Play Store, Play Services) | Always excluded, regardless of your settings | Forcing these through the VPN interface causes instability on some devices/ROMs |
| Everything else | Follows your own exclusion choices, plus a default bypass list for local/regional apps in Proxy mode | You decide what needs the tunnel and what should use the direct network |
How to add or remove an app from the exclusion list
Split tunneling is configured from the GhostMesh Android app's connection settings.
Checklist
- ✓Open GhostMesh on Android and go to the VPN connection settings.
- ✓Find the app exclusion / split tunneling list.
- ✓Add the app you want to keep off the tunnel, or remove one you want tunneled again.
- ✓Reconnect for the change to take effect.
Why some apps can't be excluded
A small set of apps are pinned inside the tunnel regardless of your exclusion list — this is intentional, not a bug. Messengers that either bypass the system proxy or become unreliable outside the protected path are kept tunneled so they keep working, even if a stale exclusion preference is still present.
FAQ
Why can't I exclude WhatsApp or Signal from the VPN?
Those messengers are pinned inside the tunnel by design because they either ignore the system HTTP proxy entirely or are noticeably less stable outside the protected path. Any stale exclusion preference for them is ignored.
Why is Google Play Store already excluded from my VPN?
Play Store and Play Services are excluded automatically on all configurations, because forcing them through the VPN interface causes instability on some devices and Android builds.
Does GhostMesh have a default bypass list for local banking or delivery apps?
In Proxy mode, yes — a curated default list of regional apps (banking, marketplaces, ride-hailing, government services) bypasses the tunnel out of the box. You can still add or remove individual apps yourself.