Send each app down its own lane.
TunnelBahn is a native macOS VPN client that routes only the apps and destinations you choose through your tunnel. Everything else keeps using your normal connection.
macOS 14 or later. The first public build is on its way.
What it does
Per-app routing
Pick the apps that use the VPN. The rest bypass it, using Apple's Network Extension per-app routing.
Destination rules
Tunnel or exclude specific IP ranges and domains, in full-tunnel or per-app mode.
Your own server
Bring any WireGuard configuration. TunnelBahn has no accounts and sends no telemetry.
Built for macOS
Menu bar controls, live per-app traffic, built-in speed test. Signed and notarized by Apple.
Pricing
- WireGuard profiles
- Per-app split tunneling and full tunnel
- Destination IP and domain rules
- Speed test, logs, backup and restore
- Everything in Free
- SSH transport
- WireGuard over TCP (WebSocket/TLS) for UDP-blocked networks
- Country IP lists, refreshed automatically
- Export profiles to the Android app
Every download includes a 14-day Pro trial. No payment details needed.
Requirements
macOS 14 Sonoma or later, on Apple silicon or Intel. On first launch, macOS asks you to allow TunnelBahn's two network extensions in System Settings.