Guides

Surfshark split tunneling on Mac

Surfshark's macOS app has split tunneling built in, called Bypasser. On macOS it's exclude-only — your Mac is on the VPN and you list apps, sites and IPs to leave out — and it needs macOS 12 or later plus a system extension you approve. If that model fits, it's included with your plan.

If you want apps to opt in instead, Surfshark also publishes manual WireGuard credentials you can use with a per-app tool.

Get a WireGuard config from Surfshark

1. Sign in to your Surfshark account and open VPN → Manual setup → Desktop or mobile → WireGuard.
2. Choose I don't have a key pair, name it, and generate a new key pair. Surfshark won't show it again, so keep the file you download.
3. Choose a location and download the .conf.

Put one app on it with VPNonly

1. Install VPNonly and open the ⋯ menu → Import WireGuard config….
2. Choose the .conf. Pick the exit country from the menu at the bottom.
3. Search for an app, flip its switch. It relaunches once, then it's on the VPN and nothing else is.

Documented from Surfshark's own manual-WireGuard guides for macOS. Their configs are standard WireGuard, which the import handles; not separately tested on our hardware.

Get VPNonly for Mac — $19

The app’s exact privileged engine source is public and MIT licensed.

Other providers

NordVPN · Mullvad · Proton VPN · IVPN · AirVPN · Windscribe · TorGuard · AzireVPN · OVPN · ExpressVPN · your own server. Or see which Mac VPNs have split tunneling, provider by provider.