Mullvad's own macOS app has split tunneling, but it's exclude-only: your whole Mac joins the VPN and you pick apps to leave out. If that's the model you want, it's included with your subscription — use it.
If you want the opposite — your Mac stays on its normal connection and one app joins the tunnel — Mullvad hands out standard WireGuard configs you can point a per-app tool at.
.conf files that all share it.If Mullvad's own app is installed too: disconnect and quit it before you switch apps on in VPNonly, or uninstall it. Its background service keeps running after the app quits, and when Mullvad disconnects it can turn off the Mac's packet filter, which holds VPNonly's rules as well. VPNonly notices within a minute, turns it back on and re-applies its rules, but a whole-Mac VPN and a per-app one taking turns with the same firewall is not worth the surprise. The config file you imported works without the app.
Tested 1 September 2026: imported the full zip, chose Singapore, and VPNonly's own check showed a Mullvad exit address with the Mac's normal address unchanged. Mullvad enforces strict cryptokey routing, which needs VPNonly 1.9.16 or later — earlier versions connect but carry no traffic.
The app’s exact privileged engine source is public and MIT licensed.
NordVPN · Proton VPN · Surfshark · IVPN · AirVPN · Windscribe · TorGuard · AzireVPN · OVPN · ExpressVPN · your own server. Or see which Mac VPNs have split tunneling, provider by provider.