Split tunneling means part of the traffic goes through the VPN and part goes direct. In Avocado VPN it works this way by default: Sber, Gosuslugi, Wildberries, 1C and other Russian services open past the VPN, everything else goes through it. No need to switch the VPN off for your bank.
The rules list arrives with the subscription and updates with it. When the app sees an address from the list, it sends it direct, from your usual Russian address. In Amnezia, or in Happ without a subscription, such exceptions are added by hand, app by app — with us they are already set up.
The bank sees a sign-in from the server’s foreign address, and fraud protection treats it as suspicious: it asks for confirmation, declines the payment or says outright “turn off the VPN”. With split tunneling the bank sees your usual address, and there are no questions.
Since August 2026 Sber, VTB, Alfa-Bank and other banks have moved their websites to certificates from the Russian Ministry of Digital Development. Chrome, Safari and Edge do not know them and say “connection is not secure”. The VPN has nothing to do with it: open the site in Yandex Browser, use the bank’s app or install the certificates from gosuslugi.ru/crt.
Then you need the reverse path: a Russian address for the bank and government services. The paid subscription has a connection through Russia for this — pick it in the app when you need the bank, and go back to Auto when you are done.
If a Russian service still opens through the VPN, message support — the rules list keeps growing.
It is the rule by which the VPN decides which traffic to send through itself and which to send direct. With Avocado VPN, Russian services go direct and everything else goes through the VPN.
With Avocado VPN, yes — no need to switch it off: banks on the rules list open direct, from your usual address.
With us you do not need to: Russian services already bypass the VPN by the subscription rules. If you turned on a “selected apps only” mode in the app, turn it off — it overrides our rules.