beta Native for Apple Silicon · macOS 15+

Split your traffic. Not your attention.

TanRoute keeps all your VPNs connected at once and sends every site down the path you chose — VPN, direct, or nowhere. Set it once. Forget it.

Coming soon to MacHow it works ↓

free while in beta · bring your own VPN · no account

this macvpn:nlvpn:ukdirectvpn:workblock
profile · home● on · 148 conns
bank+.mybank.com · gov.example→ direct
streamingnetflix.com · bbc.co.uk→ vpn:uk
work+.corp · 10.10.0.0/16→ vpn:work
callszoom.us · facetime→ direct
junkads · trackers · 48,210 rules→ block
everything else→ vpn:nl
›
the problem

A VPN is a switch. Your life isn’t binary.

// typical vpn app

All traffic, one tunnel.

On: the bank blocks you, calls lag. Off: no shows, no work network. Toggle, forget, repeat.

*            → vpn
✕ bank.com     blocked: vpn ip
✕ zoom.us      +180 ms
// tanroute

Every site, its own path.

Each request is matched against your routes and sent where it belongs. DNS included. Nothing leaks around it.

bank.com     → direct     ✓ 12 ms
netflix.com  → vpn:uk     ✓ 61 ms
zoom.us      → direct     ✓ 18 ms
how it works

Three primitives. Infinite setups.

01 / tunnels

Connect every VPN.

Paste a share link or drop a config. All tunnels stay up at the same time.

✓ vless://… → xray-main
✓ awg.conf → amnezia
✓ office.ovpn → work
02 / routes

Describe where sites go.

Domains, suffixes, keywords, subnets. Pick a target: a tunnel, direct, or block.

+.mybank.com → direct
netflix.com  → vpn:uk
10.10.0.0/16 → vpn:work
03 / profiles

Switch in < 1 second.

Ordered sets of routes plus “everything else”. Flip them from the menu bar.

● home
○ travel
○ work
use cases

From the kitchen table to the server room.

#01direct

Bank sees you at home

Banks and gov sites that block VPN IPs stay on your local line.

#02vpn:uk

Shows from anywhere

Only the streaming service exits in the country you need.

#03vpn:home

Travel without lockouts

Home services via home VPN; local maps and taxis see you locally.

#04direct

Calls & games, low ping

Real-time traffic takes the shortest path.

#05lan

Home network stays home

Printers, speakers, TVs and NAS never enter a tunnel.

#06block

Block the junk

Trackers, ad domains, sites you want off the family Mac.

#07vpn:work

Work VPN, work only

Corporate domains and subnets through the corporate tunnel.

#08×5 tunnels

All client VPNs at once

WireGuard, AmneziaWG, OpenVPN, Reality — side by side.

route check

Ask where a site goes. Get a straight answer.

Type any domain or IP. TanRoute shows the route and rule that match, the tunnel chain, and which DNS answered — then proves it with a real request.

git.corp
route■ work · rule +.corp
sent tovpn:work
chainwork ← corp-proxy
dns10.10.0.53 via vpn:work
resolves to10.10.4.17
real traffic✓ matches prediction
specs

Built like infrastructure. Feels like an app.

Protocols
Everything the core speaks, plus external OpenVPN on its own interface.
VLESS/RealityVMessTrojanShadowsocksHysteria2TUICWireGuardAmneziaWGOpenVPN
9 protocols
DNS follows the route
Each route resolves through its own servers, over its own tunnel. System DNS is captured — no leaks.
0 leaks
Profile switch
Hot reload of the routing core, connections with changed targets are closed.
< 1 s
Recovery
Sleep, wake, Wi-Fi change, reboot — health checks and reconnects without you.
≤ 10 s
Big rule lists
Prefix-tree matching, import .txt/.list, searchable tables.
100,000+ rules
Runs headless
A launchd helper keeps routing alive when the app is closed — even before login.
always on
Per-tunnel local port
Expose any tunnel as an HTTP/SOCKS port on 127.0.0.1, independent of rules.
mixed · http · socks
privacy

The best telemetry is none.

TanRoute isn’t a VPN provider. It routes the VPNs you already use, entirely on your Mac.

0

servers of ours

Traffic only goes where you send it.

0

accounts

No sign-up, no email, no login.

0

analytics

No usage pings. Not even anonymous.

1

keychain

Your Mac’s. Secrets never hit plain files.

install

Up and routing in two minutes.

The beta isn’t notarized yet, so macOS asks you to confirm it once.

DownloadOpen TanRoute.dmg, drag the app to Applications.
~30 s
Allow it onceSystem Settings → Privacy & Security → Open Anyway.
~15 s
Install the helperAdmin password, one time. The helper only accepts our signed app.
~10 s
Add a tunnel, pick a profilePaste a link or drop a file. Start from a template.
~60 s

TanRoute beta

macOS 15 Sequoia+ · Apple Silicon (arm64) · free while in beta

Coming soon
faq

Questions.

Is TanRoute a VPN?

No. It ships without servers. You bring tunnels from a provider, your employer or your own server; TanRoute routes between them.

Do I need to understand networking?

No. Templates cover the common setups: “everything through a VPN, except…” and “only these sites through a VPN”. The advanced options are there when you want them.

Why does it need admin rights?

Creating a TUN interface and capturing DNS requires root. That lives in a small helper with a narrow, typed interface that only talks to the signed TanRoute app.

What happens when a tunnel goes down?

By default, traffic for that route is blocked instead of leaking to your normal connection, and the menu bar icon shows a degraded state.

Intel Macs?

Not supported. TanRoute is arm64-only and requires macOS 15 or later.