Workflow
A local per-app proxy: server VPN, intranet VPN and a proxy on one Mac, all at the same time
ProxyRouter is a local per-app proxy router that runs on your own Mac: the rules apply on the machine, and you decide per application which VPN, which proxy, Direct or Block it uses. No more shutting down other VPNs or flipping the system proxy just to change a path.
macOS 13+ · Apple Silicon and Intel · Updated 2026-10-19
A typical working day
You are an ops, backend or contract engineer. One Mac has to reach all of this at once:
- The server-room VPN (WireGuard or OpenVPN), so the terminal can SSH in to read logs and deploy.
- A client's or your company's intranet VPN, with Git, Jira, databases and staging environments behind it.
- A local proxy (Clash, sing-box, a corporate gateway) so the browser, AI tools and package managers can reach the internet.
- A NAS and a printer on the LAN, plus local services that no tunnel should touch.
Why they keep fighting
It is not a bug in any one VPN client. macOS has one default route and one system proxy switch. Whichever client claimed the default route last carries everything that no more specific route covers. So you end up doing the same dance every day: turn one on, turn another off, flip the system proxy, reconnect SSH.
The fix: local per-app routing, with all paths staying up
ProxyRouter decides at the moment a connection is created, based on the application that created it. On the Apps page each application can be given a proxy upstream, one of your own VPN tunnels, a direct connection, or a Block. So several paths stay up together and every app uses its own.
A common layout:
- Terminal → the server-room VPN tunnel (SSH, rsync, kubectl).
- Database client, Git client → the client's intranet VPN tunnel.
- Browser, AI tools, package managers → the local proxy upstream.
- Slack, system updates, LAN apps → Direct.
- An app that should stay offline → Block; the blocked attempts are still listed.
Step by step
- Install ProxyRouter and approve the system extension once.
- Connect your VPN clients as you normally do, several at once is fine, and leave their settings alone. Once connected they appear on the Proxy page under "VPN tunnels (detected automatically)".
- On the Proxy page add your SOCKS5 or HTTP upstreams (a local Clash port, a corporate gateway).
- On the Apps page choose a path for each application: a proxy, a VPN tunnel, Direct, or Block.
- Check the Activity page: every connection shows which path it took and which rule matched.
- Bind the profile to the network you work on (office, home, hotspot) and it applies automatically next time.
What it does not do
- One application uses one path at a time. If a single app must reach resources in two different VPNs, a rule cannot pick both.
- An app pinned to a VPN reaches only what that VPN routes. If the VPN pushes internal routes only (a common split setup), that app's connections to public addresses fail immediately instead of falling back to the open network. Give apps that need the internet a proxy instead.
- When a VPN drops, connections pinned to it fail rather than quietly taking another path. That is deliberate. Reconnect the VPN and the rule works again unchanged.
- ProxyRouter is a local routing manager: it does not provide VPNs or proxies, it only chooses the path. You bring the VPN clients and the upstreams.
A note on doing this responsibly
Being connected to several companies' or clients' networks at once can conflict with their security policies. Do this only on machines and networks you are authorised to use this way, and ask their IT first if you are not sure.
FAQ
Can a Mac really use two VPNs at the same time?
Two VPN clients can be connected at once, but macOS has one default route, so whichever client claimed it last carries everything that is not covered by a more specific route. The connections do not fail by themselves; they simply all end up on the wrong tunnel. Choosing the tunnel per application is what removes the conflict.
What happens to an app pinned to a VPN when that VPN disconnects?
Its connections fail. ProxyRouter fails closed: it does not fall back to your open network, so a dropped tunnel cannot silently send that app's traffic out the wrong way. Reconnect the VPN and the app works again without touching the rule.
My VPN only pushes internal routes. Can a pinned app still reach the internet?
Not through that tunnel. An app pinned to a split VPN reaches the networks that VPN routes (for example 10.0.8.0/24) and public addresses fail immediately instead of leaking. If that app also needs the internet, pick a proxy for it instead, or use a VPN that carries the default route.
Does ProxyRouter provide the VPNs or proxies?
No. You bring the VPN clients and the SOCKS5 or HTTP upstreams you already use. ProxyRouter only decides, per application, which of them each connection takes.
ProxyRouter comes with a free full-feature trial, no card required. You bring your own VPNs and SOCKS5 or HTTP upstreams. We do not provide or resell proxy servers or VPNs.