Tunl

Tunl is a native macOS client for the WireGuard® VPN protocol. It needs a WireGuard server of your own, or a provider that hands you a .conf file; Tunl is the client end.

It exists because of one failure. A tunnel reports connected while nothing gets through: a peer drops, a server's upstream dies, an endpoint moves house. WireGuard doesn't notice, and neither does the menu-bar icon.

Tunl watches the handshake and the byte counters. When a tunnel stalls it says so, and it can re-resolve the endpoint and bring the thing back on its own. That watchdog lives inside the tunnel itself, so it keeps working while the app is closed.

What it does

• Reconnects when the network changes or the Mac wakes up. Stays down on Wi-Fi networks you mark as trusted, so the VPN isn't in the way at home.
• Keeps a history of what happened to each tunnel. When something goes wrong, there is something to look at.
• Kill switch: blocks all traffic outside the tunnel. Printers and network drives keep working. Between joining a network and the tunnel starting, macOS sends a little of its own traffic; no sandboxed app can stop that.
• Split tunneling by address range or by domain name. Say *.netflix.com, not an address block you had to go and look up.
• Encrypted DNS over HTTPS or TLS, so the queries inside your tunnel aren't plaintext for whoever runs the resolver.
• Connects on networks that block UDP, by carrying WireGuard inside a WebSocket. Hotel Wi-Fi, mostly. Needs a matching server.
• Import a .conf, drag one onto the window, paste it as text, or read it out of a QR code. No config yet? Tunl makes a key pair and shows you the public key to send to whoever runs the server, along with the exact lines they need to add.

Keeping tunnels, connecting them, reconnecting, trusted networks and noticing a stall are free. Repairing it unattended, the kill switch, protection on untrusted networks, encrypted DNS, the WebSocket wrapper, more than one split-tunnel rule and statistics are Premium: €1.99 a month or €14.99 a year after a 7-day trial, or €29.99 once.

It's built on Apple's Network Extension framework and the audited WireGuardKit library, so it runs sandboxed. No root access, no background daemons, no command line. No accounts and no telemetry either: Tunl talks to the VPN server you configure and to nothing else.

Don't have a server? The setup guide gets you from a bare VPS to a working tunnel, and covers locking the machine down afterwards. Using a VPN provider instead? The provider guide says where Mullvad, Proton VPN, AirVPN, IVPN, Windscribe and Surfshark hand out their .conf files, and what works with them.

See the privacy policy, or the support page if something isn't working.