Tunl

Tunl is a native macOS client for the WireGuard® VPN protocol.

It exists because of one failure. A tunnel reports connected while nothing gets through: a peer drops, a server's upstream dies, an endpoint moves house. WireGuard doesn't notice, and neither does the menu-bar icon.

Tunl watches the handshake and the byte counters. When a tunnel stalls it says so, and it can re-resolve the endpoint and bring the thing back on its own. That watchdog lives inside the tunnel itself, so it keeps working while the app is closed.

What it does

• Reconnects when the network changes or the Mac wakes up. Stays down on Wi-Fi networks you mark as trusted, so the VPN isn't in the way at home.
• Keeps a history of what happened to each tunnel. When something goes wrong, there is something to look at.
• Kill switch: nothing leaves the Mac unless the tunnel is carrying it. Printers and network drives keep working.
• Split tunneling by address range or by domain name. Say *.netflix.com, not an address block you had to go and look up.
• Encrypted DNS over HTTPS or TLS, so the queries inside your tunnel aren't plaintext for whoever runs the resolver.
• Connects on networks that block UDP, by carrying WireGuard inside a WebSocket. Hotel Wi-Fi, mostly. Needs a matching server.
• Import a .conf, drag one onto the window, paste it as text, or read it out of a QR code. No config yet? Tunl makes a key pair and shows you the public key to send to whoever runs the server, along with the exact lines they need to add.

It's built on Apple's Network Extension framework and the audited WireGuardKit library, so it runs sandboxed. No root access, no background daemons, no command line. No accounts and no telemetry either: Tunl talks to the VPN server you configure and to nothing else.

Bring your own WireGuard server, or any provider that hands you a .conf file. Don't have a server? The setup guide gets you from a bare VPS to a working tunnel, and covers locking the machine down afterwards.

See the privacy policy, or the support page if something isn't working.