NordVPN split tunneling on Mac

NordVPN supports split tunneling on Windows, Android and Linux. On macOS it doesn't, and that hasn't changed in years. Neither does ExpressVPN, Surfshark, or most of the big providers. If you searched for this, you probably already found that out the annoying way.

Why it's missing

Doing this properly on modern macOS means shipping a Network Extension system extension that inspects every connection and decides where it goes, per app. It's a significant build, it needs entitlements from Apple, and the App Store versions of these clients have extra sandboxing constraints on top. Providers have consistently prioritised other platforms.

What actually works

Use your NordVPN account without the NordVPN app

This is the part most people don't realise: NordVPN gives you WireGuard credentials for your own account. Any WireGuard client can connect to their servers with them, which means a per-app tool on your Mac can use the Nord subscription you're already paying for, while their app stays closed.

VPNonly does this in one step: generate an access token at my.nordaccount.com → Manual configuration → Access token, paste it in once, and it fetches your key and picks servers for you. Then you flip a switch next to any app.

Inspect how it works

VPNonly's current privileged engine source is public. The repository's root-level command-line scripts are a historical prototype, not the engine shipped in the app; they assume a fixed tunnel interface and replace PF's main ruleset, so they are not recommended on a current Mac.

Or route everything and exclude apps

If you'd rather have the whole Mac tunneled with a few exceptions, SplitTunnel.app takes that approach and works with any VPN including Nord. Different model, subscription pricing.

Is using Nord outside their app allowed?

Yes. NordVPN publishes manual configuration instructions and issues WireGuard credentials for exactly this purpose — routers, Linux boxes, and third-party clients. You're using the subscription you pay for, on your own device.

Don't run both at once

Whatever you choose, keep NordVPN's whole-Mac connection disconnected while a per-app tool is running. It changes the route underneath every app, which makes the promise that unselected apps stay on your normal connection impossible.

Get VPNonly for Mac — $19

The app’s exact privileged engine source is public and MIT licensed.