TunnelGuard

macOS VPN Split-Tunnel Manager — Exclude specific domains from your VPN tunnel with a clean, native macOS interface.

Download Latest macOS macOS License Build

Version 2.7.0 (Build 147) · Released 2026-03-26

Developer: Amirhossein Hosseinpour (AmirhpCom) · GitHub

Inspired by: a post on dev.to by @vavilov2212

Download & Install

Step 1: Download

Download TunnelGuard (DMG)

Or go to Releases to see all versions.

Step 2: Install from DMG

  1. Open the downloaded TunnelGuard.dmg file
  2. Drag the TunnelGuard icon into the Applications folder shortcut shown in the window
  3. Eject the DMG from Finder sidebar (optional)
  4. Open TunnelGuard from your Applications folder
  5. First launch: macOS will warn it’s from an unidentified developer — right-click the app > Open > click Open again to bypass Gatekeeper
  6. Grant admin access: Go to Settings > Admin Access > Grant Access for passwordless route commands (recommended)

Tip: If macOS blocks the app entirely, go to System Settings > Privacy & Security and click Open Anyway next to the TunnelGuard warning.

What is TunnelGuard?

When you connect to a VPN, all your traffic is routed through it — including traffic to services that work fine without it (or break because of it). TunnelGuard gives you fine-grained control over your VPN routing by letting you specify domains whose traffic should bypass the VPN and use your regular internet connection instead.

This is commonly called split tunneling. macOS doesn’t expose this natively in its VPN UI, but the underlying route command makes it possible. TunnelGuard automates it with a beautiful, persistent interface.

Features

Core

Management

Security

Interface

How It Works

TunnelGuard uses macOS’s built-in route command to add explicit routing entries:

# When you add a domain:
# 1. Resolve domain IPs
dig +short example.com A

# 2. Add a route via your local gateway (bypassing VPN)
sudo route -n add <resolved-ip> <local-gateway>

# When you remove/disable a rule:
sudo route -n delete <ip>

This tells your Mac: “For traffic to this IP, use the local gateway — not the VPN.”

Important: These routes are session-based. They reset on reboot unless TunnelGuard is set to launch at startup and apply rules on launch (both enabled by default).

Requirements

Usage Guide

Adding Your First Rule

  1. Launch TunnelGuard
  2. Click “Add Domain” in the sidebar (or press Cmd+N)
  3. Enter the domain (e.g., office.company.com) — URLs are auto-cleaned
  4. Optionally add manual IPs and a note
  5. Click “Add Rule” — TunnelGuard resolves the domain’s IPs
  6. Click “Start Whitelisting” (or press Cmd+Shift+R) to activate all enabled rules

Gateway Configuration

By default, TunnelGuard detects your local gateway automatically. If the detected value isn’t a valid IP (e.g., link#28), you’ll see a warning with options to copy the value or switch to manual mode.

Go to Settings > VPN Gateway > Manual to enter your gateway IP manually (usually 192.168.x.1).

When your network changes (VPN connect/disconnect, Wi-Fi switch), the gateway is automatically re-detected and routes are re-applied.

DNS Configuration

By default, TunnelGuard uses 8.8.8.8 (Google DNS) for resolving domains. You can specify a custom DNS server in Settings > DNS Resolution, or click “Use Gateway” to use your gateway IP as the DNS server.

Import & Export

Keyboard Shortcuts

Shortcut Action
Cmd+N Add new rule
Cmd+Shift+R Start / Stop Whitelisting
Cmd+1 Switch to Rules tab
Cmd+2 Switch to Logs tab
Cmd+3 Switch to Settings tab

Settings Reference

Setting Default Description
Gateway Mode Automatic Auto-detect or manually specify local gateway
Manual Gateway IP — Used when mode is Manual
DNS Server 8.8.8.8 DNS server for resolving domain IPs
Write to /etc/hosts Off DNS bypass via local hosts file
Theme System Dark, Light, or follow system appearance
App Presence Both Menu Bar Only, Dock Only, or Both
Launch at startup Off Register as a system LaunchAgent
Apply rules on launch On Run active rules when app opens
Admin Access Not granted Passwordless sudo for route commands

Building from Source

Prerequisites

xcode-select --install   # Install Command Line Tools

Clone & Build

git clone https://github.com/amirhp-com/tunnelguard.git
cd tunnelguard/source
make build

Create DMG Installer

make dmg
# Output: dist/TunnelGuard.dmg

Open in Xcode

open TunnelGuard.xcodeproj

Build with Cmd+B or Product > Build.

Log Files

TunnelGuard writes logs to:

Contributing

See CONTRIBUTING.md for guidelines.

Areas That Could Use Help

Disclaimer

TunnelGuard modifies your system’s routing table using macOS native commands. This requires administrator privileges. Improper configuration may disrupt your network connectivity.

The developer assumes no responsibility for network disruptions, security incidents, data loss, or any consequences of using this software. This tool is intended for advanced users who understand network routing.

Never use this tool to bypass security controls you are required to comply with.

Changelog

See CHANGELOG.md for full version history.

License

Copyright (C) 2026 Amirhossein Hosseinpour (Amirhp.Com)

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

See LICENSE for the full text.

Acknowledgments

Built on macOS’s native routing infrastructure using route(8) and netstat(1).

TunnelGuard — Because your VPN shouldn’t be your whole network.