macOS · Per-app proxy
Your browser on the corporate proxy, your terminal on a staging gateway, a client’s tool on their network, games and localhost direct — all at the same time, on one Mac. Pick apps by their icon; the apps themselves need no proxy settings. UDP and QUIC are really proxied, not dropped.
Each app gets its own upstream, and they all run at once. Your rules, connection traces and traffic content stay on your Mac; you stay in control of every upstream.
Sound familiar?
Your server zone, operations network and customer intranet each depend on a different VPN. Keep the VPN clients connected and automatically route your IDE, terminal, browser and admin tools to their assigned local proxy ports — no more disconnecting and switching.
The macOS system proxy affects every app, while a full-tunnel VPN can also capture local services and traffic for other intranets. Assign only the apps that need this route; everything else stays direct or uses another one.
Proxifier on macOS won't forward UDP over SOCKS5, and QUIC is left to luck. Here UDP ASSOCIATE is actually implemented, and QUIC has three explicit states.
Office Wi-Fi, home cable and a phone hotspot each need their own rules. Bind a profile to a network and it switches back on its own.
Coming from Proxifier? See the side-by-side comparison →
More guides: How to use a SOCKS5 proxy on macOS· Proxy the terminal, git and npm· Block an app from the internet· When an app ignores the system proxy
What it does
Send your IDE to the server-zone port, terminal to operations and browser to a customer intranet. Configure the rules once; every upstream works at the same time.
SOCKS5 UDP ASSOCIATE forwarding — something Proxifier simply can't do. QUIC gets three states: proxy, fall back to TCP, or direct.
Expand any connection to see exactly why it took that path. A dry-run tester tells you which rule matches — without sending a packet.
Wi-Fi by SSID; wired by gateway MAC + subnet — so 'office cable' and 'home cable' are told apart. Bind a profile to a network and it switches back on its own.
proxyrouterctl on the command line, URL Scheme, App Intents — and a built-in MCP server so Claude and other LLMs manage your rules directly.
Beyond Direct and Proxy there is a third action: Block. Give an app a block rule and its connections are closed outright — not throttled, cut off. Useful for stopping a program from phoning home, or temporarily severing an app you do not trust.
fake-IP DNS, loopback protection, localhost guards — the defaults you'd only get right after being burned are already configured.
Rule-trace explainer
Every live connection expands into the exact chain of rules it walked — matched, skipped, and why. The dry-run tester answers the same question before a single packet leaves your machine.
Dry-run · no packet sent
$ proxyrouterctl route add --app Chrome --proxy jp-socks
✓ rule 03 Chrome · QUIC → SOCKS5 · JP
$ proxyrouterctl test --app Chrome --host example.com
→ match rule 03 · proxy SOCKS5 · JP · no packet sent
# or just ask Claude, over MCP
→ "route Chrome's QUIC through the Japan node" doneCLI + MCP
proxyrouterctl ships with zero third-party dependencies. The built-in MCP server exposes the same automation surface the UI uses, so an LLM can read your connections and reshape your rules in plain language.
Honest comparison
| Capability | ProxyRouter | Proxifier |
|---|---|---|
| Per-app routing (real icons) | Yes | Process names |
| SOCKS5 UDP / QUIC proxy | Yes | No |
| Rule-trace explainer + dry run | Yes | No |
| Auto network-env switching | Wi-Fi + wired | Limited |
| CLI + MCP (LLM control) | Yes | No |
| Block an app from the network | Yes | Separate firewall |
| fake-IP DNS + loop guards | Yes | Manual |
Good to know
No. It is a traffic router, not a proxy service. Bring your own SOCKS5 or HTTP upstream.
No. Choose the app and route in ProxyRouter; the target app does not need its own proxy settings.
Yes. Give it a Block rule and its connections are closed immediately. Blocked attempts are labelled and counted in the Activity view, so you can still see where the app was trying to go.
No. Routing, rule evaluation and license checks happen locally. Traffic goes only to destinations you configure.
macOS 13 or later, on both Apple Silicon and Intel Macs.
Still unsure? Contact us or read the system requirements.
Why you can trust it
Signed with an Apple Developer ID certificate (Mei Yang, Team ID MLBB37VST8) and notarized by Apple. Verify it yourself: run spctl -a -vvv -t install ProxyRouter.dmg — it should report accepted and Notarized Developer ID.
Routing by process has to happen at the system network layer, and macOS offers exactly one way to do that (Network Extension). It sees the destination, port and originating process of each connection — the facts needed to pick a route. Rule evaluation and connection traces stay on your Mac and are never uploaded.
Click "Remove system extension" in Settings, then drag ProxyRouter to the Trash. Your network settings return to what they were, and no background daemon is left behind.
They coexist. The most common setup is to point ProxyRouter at a local client like Clash as its upstream. Running two full transparent proxies at once will fight, so keep the other tool in "local port" mode. Little Snitch is a filtering extension and runs alongside fine.
No. We do not provide, host or resell any proxy or VPN endpoint, and no server of ours is involved in your connections. Every upstream is one you configure yourself — a corporate proxy, a staging gateway, or a port on localhost.
Current release 1.0.0 (build 9), for macOS 13 or later on Apple Silicon and Intel. Updates arrive in-app through Sparkle, and every update is signature-checked before it is applied.
Pricing
Every plan is the full app — nothing is held back during the trial. When a trial or subscription ends, only proxying stops; your config is never touched.
$1.99/ month
$7.99/ year
$19.99one-time
Every plan starts with the same free full-feature trial — no card required. Checkout is securely processed by Creem, our merchant of record.