How to send one Mac app through a proxy, and leave the rest alone

The short answer

macOS has no per-app proxy setting. The proxy in System Settings applies to every app that chooses to read it, and many apps and command-line tools ignore it anyway. To put just one app on a proxy:

1. Use the app's own proxy setting, if it has one.
2. For Chrome and many apps built on it, start the app with a proxy flag.
3. For command-line tools, use proxy environment variables or proxychains-ng.
4. For any other app, use a per-app proxy tool.

The app's own proxy setting (free)

Plenty of apps that people want on a proxy have a setting for it. Firefox has its own: Settings → General → Network Settings → Settings…, then Manual proxy configuration. Many API clients, database tools, download managers and developer tools have a proxy field in their preferences too. When an app has one, it is the simplest route, and it only affects that app.

A launch flag for Chrome and similar apps (free)

Chrome and other Chromium-based browsers take a --proxy-server flag when you start them from Terminal:

open -na "Google Chrome" --args \
  --proxy-server="socks5://127.0.0.1:1080" \
  --user-data-dir="$HOME/chrome-proxy"

The separate --user-data-dir matters: without it, the new Chrome hands over to the one you already have open, which ignores the flag. You get a second Chrome with its own profile, on the proxy, while your normal one stays as it is. Many apps built on Electron accept the same flag, but not all of them.

Why the system proxy isn't per app

System Settings → Network → your connection → Details → Proxies sets a SOCKS, web (HTTP) or secure web (HTTPS) proxy for the whole Mac. Apps that read it use it; apps that don't, don't. You can't limit it to one app.

The Automatic proxy configuration option takes a PAC file, which chooses a proxy by website rather than by app. If what you really need is “these sites through the proxy, everything else direct”, a PAC file is free and does the job for the apps that honour it.

Command-line tools (free)

Most command-line tools read proxy environment variables, set for the current Terminal window only:

export https_proxy=http://proxy.example.com:8080
export all_proxy=socks5h://127.0.0.1:1080

Some take a flag instead, such as curl --proxy socks5h://127.0.0.1:1080 … or git -c http.proxy=socks5h://127.0.0.1:1080 clone …. The h in socks5h sends hostnames to the proxy, so DNS lookups happen at the far end too.

For a tool that ignores both, proxychains-ng (brew install proxychains-ng) forces its connections through a proxy. It works with tools you install yourself, such as those from Homebrew, but not with Apple's own protected tools in /usr/bin, because macOS strips the library loading it depends on.

A per-app proxy tool for everything else

Some apps have no proxy setting, or have one and ignore it for part of their traffic. A per-app proxy tool catches the app's connections at the system level, so the app doesn't have to cooperate. Proxifier is the long-standing option, at $39.95 one-time with a 31-day trial (checked on proxifier.com, 6 November 2026).

Reroute is ours. It does the common case, this app through that proxy, for £9.99 once:

1. Add your proxyOpen Proxies, click + and enter a SOCKS5, HTTP or HTTPS proxy, with a username and password if it needs one. Press Test to see the IP address and country it presents.
2. Add the appOpen Apps, click + and choose the app, then pick the proxy. All apps by this developer also covers the helper processes big apps start in the background; Only this app narrows it to one.
3. Reopen the appQuit and reopen it so its connections start again on the new route, then check the Activity view to see them going through the proxy.

Everything else on your Mac stays on your normal connection. If the proxy goes down, the routed app's connections fail instead of quietly going out direct.

What Reroute doesn't do

• It routes Mac apps you choose from Applications, not command-line tools. Use the command-line methods above for those.
• It carries TCP. A routed app's UDP is refused by default, which makes browsers fall back from QUIC to a connection through the proxy; you can let an app's UDP go direct instead.
• Hostnames go to the proxy with each connection, but plain DNS lookups stay on your normal connection.
• Local network and Tailscale addresses are never routed.
• We haven't verified Safari yet. Try your app in the 7-day trial and check the Activity view.

Questions people ask

More guides