NordVPN's apps have split tunneling on Windows, Android and Android TV; Linux gets a port and subnet allowlist instead. The Mac app doesn't have it, in either the App Store or the website version, and Nord hasn't announced it. Most other big providers now do, so if you're on Nord, you've probably found that out the annoying way.
Doing this properly on modern macOS means shipping a Network Extension system extension that inspects every connection and decides where it goes, per app. It's a significant build, it needs entitlements from Apple, and App Store versions have extra sandboxing constraints on top. Nord has put its split tunneling on other platforms first.
This is the part most people don't realise: your Nord account has its own WireGuard (NordLynx) key, and an access token from your Nord Account can fetch it. Nord's own open-source Linux app gets its key the same way. With it, any WireGuard client can connect to Nord's servers, which means a per-app tool on your Mac can use the Nord subscription you're already paying for, while their app stays closed.
VPNonly does this in one step: generate an access token at my.nordaccount.com → Manual configuration → Access token, paste it in once, and it fetches your key and picks servers for you. Then you flip a switch next to any app.
VPNonly's current privileged engine source is public. If you'd rather stay in the terminal, the same repository has a free command-line version you can install with Homebrew, and it works with NordVPN.
SplitTunnel.app runs alongside a VPN client you already use and sets each app to VPN, direct or blocked. It says it works with any VPN, though its guides focus on corporate ones and don't mention Nord. Subscription pricing.
Not officially. Nord documents access tokens, and manual setup for OpenVPN and IKEv2, but not fetching the WireGuard key for use outside its apps. You're using the subscription you pay for, on your own device, the same way Nord's own Linux app does. But because Nord doesn't document this, it could change, and VPNonly's Nord setup would stop working until it was updated.
Whatever you choose, keep NordVPN's whole-Mac connection disconnected while a per-app tool is running. It changes the route underneath every app, which makes the promise that unselected apps stay on your normal connection impossible.
The app’s exact privileged engine source is public and MIT licensed.