How to VPN only a single application? Say you only want to route the traffic of a single application through a VPN.

(Because the application lacks proper encryption support or the remote service is only available on a cooperate network.)

Other stuff like web-browsing should go through the normal data connection.

How to configure this on a recent Android device (>= Android 4.0)?

Concrete motivation: Unfortunately, quite a few VoIP gateway providers do not provide encryption of data (voice and signaling) - thus using a VPN is necessary (at least when connected via WLAN). One provider (sipgate.de) even provides its own VPN (and no other SIP/RTP encryption methods).
The free and open-source OpenVPN for Android app supports this.

In the profile configuration dialog, there is an 'allowed apps' tab that allows you to select a list of apps that is either excluded or excluded from using the established VPN:


'VPN is used for all apps but exclude selected'
'VPN is used for only for selected apps' (sic)


The list then contains all available apps that can be selected/deselected.

This doesn't require a rooted device. For example, it works fine on a Nexus 5x device with stock Android 8.1.

A simple test is to install another broswer like Firefox, include just one of Chrome and Firefox in the list and then switch around browsers and visit https://wtfismyip.com in both.

One pitfall is when you are on a dual-stack IPv4+IPv6 network but the VPN is IPv4 only. In that case, the 'Bypass VPN for local networks' in the 'Routing' tab needs to be disabled. Otherwise, IPv6 traffic travels unencrypted besides the VPN.