Support

Tunl is a native macOS client for the WireGuard® VPN protocol. Import a standard WireGuard configuration and connect from the menu bar or the main window. It reconnects on its own when the network changes or the Mac wakes.

How do I add a tunnel?

Open Tunl, choose Import, and pick your .conf file. It's the same format the official WireGuard apps use, and what most servers and providers hand out, so there is nothing to fill in by hand.

If you don't have one, choose New Tunnel instead. Tunl generates a key pair and shows you both your public key and the exact lines the server's administrator needs to add. If that administrator is you, the setup guide covers the server side.

Why does macOS ask for permission the first time I connect?

The first time you connect a tunnel, macOS shows a system prompt asking you to approve a VPN configuration. This is standard for any app that uses Apple's Network Extension framework, which is what Tunl relies on to create the tunnel. Approving it lets Tunl manage the WireGuard connection; it does not grant the app any broader access to your Mac.

Does Tunl collect any data?

No. Tunl has no analytics, telemetry, crash reporting, or accounts. If the app ever crashes, macOS may offer to share the crash report with Apple through its own opt-in mechanism. That report goes to Apple rather than through the app, and reaches the developer through App Store Connect. The privacy policy has the details.

Can I automate Tunl?

Yes. Tunl registers a tunl:// URL scheme, so anything that can open a URL can drive it: Shortcuts, Raycast, Alfred, Keyboard Maestro, or a shell script. There are also native Shortcuts actions if you'd rather not type URLs at all.

open "tunl://connect?name=Home%20VPN"
open "tunl://toggle?name=Work"
open "tunl://disconnect"

The name is optional when you have a single tunnel, or while one is connected. Only those three actions exist: a link can connect, disconnect, or toggle a tunnel you already configured, and nothing else.

My tunnel connects but nothing loads

This is the case Tunl was built for. Open the tunnel and look at History: if it says the tunnel stalled, the connection is up but no traffic is crossing it, usually because the peer went away or the server's address moved. Tunl can repair that on its own; Reconnect now does it immediately.

If it keeps happening, Settings has a Diagnostics report. It leaves out your tunnel names, endpoints and keys, and you see the whole thing before anything is copied, so it's safe to paste into an email.

Connected, no stall reported, and still nothing loads

Then the tunnel is doing its job and the problem is on the server. Run wg show there. If your peer has no recent handshake, the server's UDP port is closed at the provider's firewall or a key is wrong. If the handshake is fresh but only the received counter grows, the server is not forwarding: check that the PostUp forwarding and masquerade lines from the setup guide ran, that IP forwarding is enabled (sysctl net.ipv4.ip_forward should print 1), and that the server's AllowedIPs for your peer matches the address in your configuration.

If addresses load but names don't, the DNS line in your configuration points at a resolver the tunnel cannot reach. Use one the server itself can see.

The WebSocket wrapper connects but carries nothing

The relay on the server must be started with --websocket-mask-frame. Tunl uses Apple's networking stack, which masks WebSocket frames as the standard requires, and wstunnel drops masked frames silently without that flag: the tunnel connects and no traffic crosses it. The setup guide has the full command; it also restricts the relay to your WireGuard port, which matters because wstunnel forwards wherever a client asks otherwise.

Cancel or refund

Apple handles every payment, so cancelling and refunds happen with Apple, not in Tunl. To cancel the subscription, open System Settings, click your name, then Media & Purchases, then Manage next to Subscriptions; you keep Premium until the end of the period you paid for. For a refund, on the subscription or the one-time lifetime unlock, use reportaproblem.apple.com. Tunl cannot issue a refund itself; the developer never sees your payment.

On a new Mac, or after reinstalling, choose Restore Purchase on the Premium sheet. It asks Apple for what you already own and unlocks it again at no charge.

Still need help?

Email [email protected] and describe the issue. Include your macOS version if it's a connection problem.