I'm looking to secure some apps on macOS using an OpenVPN connection. I want the apps not to work when the VPN isn't active. I can't necessarily track which servers the apps are trying to access, so manually specifying routes either from the server or client end is prohibitive. I also don't want all traffic going over the VPN.

So here's what I have so far:

  1. Something needs to work at the application layer to 'capture' all traffic from an application.
  2. Something else needs to work at the network layer to take all of that traffic and push it over the VPN.

And then I need a way to specify which apps and which interface, and be sure that if that interface is down or disconnected, no traffic flows.

So far I think this might be doable with pf (I found Murus, a GUI front-end), except that it doesn't seem to deal with applications per-se, but rather networks and ports, which as stated above is problematic.

Then there's Little Snitch, which deals with applications but is a binary go/no-go decision maker, rather than directing some traffic here and some traffic there.

That said, I did find a not-well-documented feature where it seems like you can create a rule for a process in Little Snitch, and give it access to pf. So perhaps there's a way to write a pf rule that then directs that traffic over the VPN.

Open to suggestions.

  • How is your situation different than having a split-tunnel VPN configured?
    – bmike
    Aug 1, 2020 at 1:11
  • 1
    @bmike A standard split-tunnel configuration uses standard routing protocols to route traffic based on the destination network. It would not, for example, allow you to send all Safari traffic over the VPN while allowing all Firefox traffic to bypass the VPN.
    – Old Pro
    Aug 1, 2020 at 3:10
  • Since you mention LittleSnitch, I assume you're looking for a macOS solutions? Please clarify in your question. On iOS, there would be per-app VPN which might do what you want.
    – not2savvy
    Aug 1, 2020 at 13:59
  • Yep, macOS, @not2savvy
    – Harv
    Aug 1, 2020 at 19:40

1 Answer 1


This feature is available from Private Internet Access. They call it their Desktop Application Split Tunneling Feature. It is a complex enough feature that I would not expect it to be supported by free software.

  • 1
    It’s available on every single VPN product. It’s how the VPN is configured to pass what traffic through what gateway. OpenVPN is one of the most popular open source VPN platforms put there and is very much capable of split tunneling.
    – Allan
    Aug 1, 2020 at 3:00
  • 1
    @Allan Please post an answer explaining how to do what the OP wants using OpenVPN and I will delete mine, because I hate recommending commercial products. But AFAIK, no free software is available that will force only certain specified applications to send all their traffic over the VPN, deny them internet access if the VPN is down, and at the same time allow other applications to send traffic to the same destinations without using the VPN. I believe this is what the OP wants.
    – Old Pro
    Aug 1, 2020 at 3:12
  • Commercial products are fine.
    – Harv
    Aug 1, 2020 at 7:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .