How-to
The VPN is on and something else broke. Keep those apps off the tunnel.
macOS 13+ · Apple Silicon and Intel · Updated 2026-08-28
What actually breaks
A full-tunnel VPN captures the default route, so anything that was reachable by another path stops being reachable. The failures are always the same list:
- Local development servers on localhost or a Docker bridge stop responding.
- Printers, NAS boxes and other LAN devices disappear.
- A second client's intranet — the one you are not tunnelled into — becomes unreachable.
- Games and video calls get slow or drop, because their UDP now takes a long detour.
- Large downloads crawl, and you are paying for the round trip twice.
The fix: decide per application, not per route
Instead of arguing with the routing table, ProxyRouter decides at the moment a connection is created, based on the process that created it. Name the applications that should stay off the tunnel and they connect directly; everything else keeps using the VPN as before.
Step by step
- Install ProxyRouter and approve the system extension once.
- Leave the default action as it is, so the VPN keeps handling everything by default.
- Add a Direct rule for each application that must bypass the tunnel — your IDE, terminal, Docker, the game, the download manager.
- Add a Direct rule for private ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) if LAN access is what broke.
- Bind this profile to the network you use it on, so it applies automatically next time you connect there.
A note on doing this responsibly
Excluding traffic from a corporate tunnel can conflict with your employer's security policy, and on a managed Mac it may be logged. This tool is meant for the cases where you control the machine, or where you have been asked to keep specific traffic off a tunnel — not as a way around rules you are subject to.
FAQ
Isn't this what split tunneling in my VPN client is for?
It is, when your client offers it. Many corporate clients deliberately do not, and those that do usually split by destination IP or subnet rather than by application. Splitting by application is a different axis and is often the one you actually need.
Will IT see that I'm doing this?
Assume yes, and treat that as the right default. Excluding an app from a corporate tunnel can breach your organisation's policy. Use this on networks and machines where you are authorised to change routing, and ask first if you are not sure.
Does this weaken the VPN for everything else?
No. Applications you do not exclude keep using the tunnel exactly as before. The exclusion is per application and takes effect only for the ones you name.
What if I want the opposite — only one app inside the tunnel?
That works too. Set the default to Direct and route only the applications that should use the tunnel's upstream. The same rule engine expresses both directions.
ProxyRouter comes with a free full-feature trial, no card required. You bring your own SOCKS5 or HTTP upstream — a corporate proxy, a staging gateway, or a port on localhost. We do not provide or resell proxy servers.