TorGuard split tunneling on Mac

TorGuard's config generator gives you standard WireGuard configs, so you can put a single Mac app on TorGuard while the rest of your Mac stays on its normal connection. There's one catch, and it's big enough that TorGuard isn't on our list of providers that work cleanly: TorGuard's WireGuard configs expire after 12 to 24 hours. TorGuard's own app renews them for you; a config file you import anywhere else doesn't get renewed.

So with VPNonly, expect to generate and import a fresh config about once a day. If the app you routed suddenly has no connection, that's the reason.

Get a WireGuard config from TorGuard

1. Sign in and open TorGuard's config generator. WireGuard is included in the Standard, Pro and Ultimate plans.
2. Set the tunnel type to WireGuard and pick a server.
3. Enter your VPN username. This isn't your website login; you'll find it under Manage Credentials.
4. Leave the key fields empty so the generator creates them, and generate. You get one .conf for that server.

Put one app on it with VPNonly

1. Install VPNonly and open the ⋯ menu → Import WireGuard config….
2. Choose the .conf. When it stops connecting, generate a new one and import it the same way.
3. Search for an app, flip its switch. It relaunches once, then it's on the VPN and nothing else is.

Documented from TorGuard's config generator and support articles (September 2026), including the expiry notice in their WireGuard setup guide. Not separately tested on our hardware.

Get VPNonly for Mac — $19

The app’s exact privileged engine source is public and MIT licensed.

Other providers

NordVPN · Mullvad · Proton VPN · Surfshark · IVPN · AirVPN · Windscribe · AzireVPN · OVPN · ExpressVPN · your own server. Or see which Mac VPNs have split tunneling, provider by provider.