Tunl

Tunl is a native macOS client for the WireGuard® VPN protocol, built around the failure nothing else catches: a tunnel that says connected while nothing is actually getting through.

A dropped peer, a server whose upstream went down, an endpoint that moved — WireGuard itself does not notice any of it, and neither does the menu-bar icon. Tunl watches the handshake and the byte counters, says plainly when the tunnel has stalled, and can re-resolve the endpoint and repair it on its own. That watchdog runs inside the tunnel, so it keeps working with the app closed.

What it does

• Reconnects automatically across Wi-Fi and Ethernet changes, sleep and wake, and dropped links — and stays down on the Wi-Fi networks you mark as trusted.
• Keeps a history of what happened to each tunnel: connects, stalls, repairs, network changes. When something goes wrong there is finally something to look at.
• Kill switch — nothing leaves your Mac unless the tunnel is carrying it, with the local network left reachable so printers and drives keep working.
• Split tunneling — route chosen destinations around the tunnel.
• Easy to set up — import a .conf, drag one onto the window, paste a configuration, or import from a QR-code image. No config yet? Tunl generates a key pair and shows you the public key to send to whoever runs the server.

Built on Apple's Network Extension framework and the audited WireGuardKit library, so it is fully sandboxed — no root access, no background daemons, no command-line setup. There are no accounts, no analytics, and no telemetry: Tunl collects nothing and talks only to the VPN server you configure.

Bring your own WireGuard server, or any provider that gives you a .conf file.

See the privacy policy or visit the support page for help.