SplitPipe Download

Split the pipe.
Route each app.

SplitPipe for macOS sends each app's traffic where you choose: into a specific VPN, straight out over Wi-Fi around it, or nowhere at all.

Download for macOS Read the docs
Version 0.1.0. Requires macOS 26 or later.
SplitPipe's Apps window on a MacBook Air: Opera, Telegram and Yandex Music go Direct, Slack and Jira go through WireGuard “Work”, Safari, Xcode and Spotify use Default, and 1C:Enterprise waits for OpenVPN Office.
  • Telegram
    Direct

    Out through Wi-Fi, around the VPN.

  • Slack
    WireGuard “Work”

    Into the work tunnel, and only that one.

  • Safari
    Default

    Wherever macOS sends traffic now.

  • Steam
    Block

    No network at all.

One pipe in. A route per app out.

A VPN normally takes all of your Mac's traffic. SplitPipe looks at every new connection and sends it through the route you picked for that app.

  1. Intercept

    A macOS network extension sees each new connection and knows which app opened it, including WebKit and helper processes.

  2. Decide

    SplitPipe finds the app's rule. If that route is down, the rule's fallback decides: block, default route, or another VPN.

  3. Send

    The connection leaves through that route's interface: the right VPN tunnel, or Wi-Fi and Ethernet around it.

Routing that holds when a VPN drops

Rules follow the role of a route, not an interface name, so they survive reconnects, network changes and sleep.

A rule per app

One menu per app: Default, Direct, any of your VPNs, or Block. Changing a rule drops the app's old connections, so the new route applies at once.

The route menu for Telegram: Default, Direct over Wi-Fi on en1, Amnezia VPN on utun4, WireGuard “Work” on utun6, OpenVPN Office shown as disconnected, and Block.

Every VPN is a route

AmneziaVPN, WireGuard, OpenVPN and macOS VPN services are found on their own. Send one app through the work VPN and another through yours.

Amnezia VPNWireGuard “Work”

Temporary routes

Switch an app for a while. When the time is up, its rule comes back on its own.

15 min1 hourUntil the app quitsUntil the VPN disconnects

When a route goes down

Each rule says what happens if its VPN disconnects. Try it for Slack on WireGuard “Work”:

Slack gets no network until WireGuard “Work” is back. Nothing leaves through another route.

IP lists

Subnets from a file or a URL get their own route. URLs refresh daily, and the first list that matches wins.

# office.txt
10.20.0.0/16
192.0.2.7
2001:db8::/32   ; IPv6 works too

New apps

Get a notification when an app goes online for the first time, with buttons for Default, Direct or a VPN. Or give every new app a route right away.

Command-line programs

curl, git, ssh and Homebrew tools get rules by path, so they keep their route after an upgrade.

Works with your VPN's kill switch

A kill switch blocks everything outside the tunnel, so nothing leaks when the VPN drops. It also blocks the apps you send Direct. SplitPipe's helper opens one narrow gap in it, for SplitPipe alone.

  • Direct apps keep working while the kill switch is on.
  • Everything else stays behind the VPN.
  • The gap comes back after sleep, network changes and reconnects.
  • Diagnostics shows whether the bypass is in effect.

How SplitPipe works with a kill switch

A metal toggle switch, the kill switch.
VPN tunnel passes SplitPipe Direct passes The rest is blocked

See where traffic really goes

A live feed of connections, traffic by route and app, and checks that lead to the fix.

The Connections feed: time, app, address and host, protocol, the route each connection took, and traffic.

Live connections

Every connection with its app, address, protocol, the route it really took and its traffic. Connections that go around SplitPipe are flagged as bypassing it.

The SplitPipe menu in the menu bar: status, connected VPNs, the active app's route and the list of rules.

Switch routes without opening a window

  • Menu bar

    Status, connected VPNs, the frontmost app's route and all your rules, one click away.

  • Widget and Control Center

    Status, VPNs, problems and today's traffic on the desktop, and a SplitPipe toggle in Control Center.

  • Shortcuts and links

    Shortcuts actions and splitpipe:// links turn SplitPipe on and off or set an app's route, for good or for a while.

  • Hotkeys

    Toggle SplitPipe, or open the route menu for the frontmost app right at the pointer.

Install SplitPipe

Move SplitPipe to Applications and open it. It asks for three system permissions, one at a time, then sets itself up.

Download SplitPipe 0.1.0 Installation guide
System
macOS 26 Tahoe or later
Permissions
Network extension, proxy configuration, background helper
VPN clients
AmneziaVPN, WireGuard, OpenVPN and Network Extension VPNs
Languages
English and Russian, following the system language
Uninstall
One button in Settings removes the extension, the helper and its pf rules