How to put one Mac app on your VPN, not the whole Mac

The short answer

macOS does have a per-app VPN, but it is for managed Macs: an organisation sets it up through device management, and there is no switch for it in System Settings. On your own Mac, your options are:

1. Your VPN app's split tunnelling, if it has it.
2. Your VPN provider's SOCKS5 proxy, in the app's own proxy setting.
3. A WireGuard file turned into a local proxy with wireproxy.
4. A virtual machine with the VPN inside it.
5. A per-app proxy tool, for apps with no proxy setting.

Your VPN app's split tunnelling

Some VPN apps for the Mac can split traffic by app. Look in your app's settings for “split tunnelling”. They work differently: some let you take chosen apps out of the VPN, others put only chosen apps in.

Check the limits. It only works with that provider's servers, and the details vary: Mullvad's macOS split tunnelling, for example, needs macOS 13 or later and can't exclude Safari or other WebKit browsers. The VPN app is also still running as a VPN, which can stop Tailscale or a work VPN from working (see Tailscale and a VPN at the same time).

Your provider's SOCKS5 proxy (free with many plans)

Many VPN providers publish SOCKS5 server details for customers. They are usually in the account area of the provider's website rather than in the VPN app, often with a separate username and password. Put them in the app's own proxy setting (in Firefox: Network Settings → Manual proxy configuration → SOCKS v5).

Some providers only offer their SOCKS5 proxy from inside their VPN tunnel, so the VPN app has to be connected anyway. Check your provider's help pages. Your provider's terms decide how you can use its servers.

A WireGuard file as a local proxy (free)

If your provider gives you WireGuard configuration files, the open-source wireproxy runs that connection as an ordinary program and offers it to your Mac as a SOCKS5 proxy. It doesn't add a network interface or change your Mac's routing, and it needs no admin rights. A minimal config:

WGConfig = /Users/you/vpn/provider.conf

[Socks5]
BindAddress = 127.0.0.1:25344

Start it with wireproxy -c ~/vpn/wireproxy.conf, then point the app's SOCKS5 setting at 127.0.0.1, port 25344. Only apps you point at it use the VPN.

A virtual machine

Run the app inside a virtual machine (UTM is free) and connect the VPN inside it. It is heavy, but everything the app does, including DNS and UDP, stays inside the VM's VPN.

A per-app proxy for apps with no proxy setting

Your provider's SOCKS5 and wireproxy both need an app with a proxy setting. Reroute takes the same SOCKS5 proxy, from your provider or from wireproxy, and applies it to any Mac app you choose. The VPN app can stay closed, and everything else stays on your normal connection.

• Keep a work app on the VPN without putting your whole Mac on it.
• Check how your own site or app behaves from another region, while everything else stays local.
• Keep one app on a VPN server and leave video calls and downloads on your home broadband.

Reroute isn't a VPN and doesn't include any servers. It carries a routed app's TCP connections; UDP is refused by default (or sent direct if you choose), and plain DNS lookups stay on your normal connection. If you need every packet an app sends inside the VPN, use the VPN app's split tunnelling or a virtual machine instead.

Questions people ask

More guides