Guides

Torrents through the VPN on a Mac, and nothing else

The usual advice is to connect your VPN before you open qBittorrent. It works, but your whole Mac goes through the VPN with it: video calls get worse, your bank sees a foreign address and starts asking questions, and every other download runs at whatever speed the VPN server manages that day.

It can also fail the wrong way. If the VPN drops and its app has no kill switch turned on, the torrent client carries on over your normal connection, unless you've bound it to the VPN's network interface yourself.

VPNonly does it the other way round. Your Mac stays on its normal connection, and only the torrent app goes through the VPN.

What you need

• A Mac with Apple silicon.
• A VPN account that speaks WireGuard. NordVPN works with just an access token; Mullvad, Proton, IVPN, AirVPN or your own server work with the config file they give you. Details per provider.
• A torrent app that runs as a normal Mac app, like qBittorrent or Transmission.

Setting it up

1. Install VPNonly and connect your provider. Pick a server.
2. Find your torrent app in the list and switch it on. It closes and reopens once. That's macOS, not a bug: an app's network identity is fixed the moment it opens.
3. Click Check. VPNonly asks the internet which address the app is really using and shows it next to your Mac's own. The two should differ.

Nothing else on the Mac changes. Your browser, your calls and every other app keep using your normal connection.

When the tunnel drops

The torrent app is blocked until the tunnel is back. It never quietly falls back to your normal connection, so there's no interface to bind and no separate kill switch to remember. VPNonly reconnects the tunnel on its own after a network change, and the torrent app picks its peers back up by itself.

Worth knowing

• IPv6. Apps on the VPN can't use IPv6 while they're switched on, so the torrent app talks to peers over IPv4 only. It also means nothing leaks out over IPv6.
• DNS. Connections are tunneled, but DNS lookups still go through your normal resolver. Your ISP can see which tracker names the app looks up, though not the traffic itself.
• Port forwarding. VPNonly doesn't set up port forwarding. Without a forwarded port, other peers can't start connections to you. Downloading works normally; seeding tends to be slower.
• Switching. Moving the app in or out of the VPN drops its open connections. It reconnects to peers on its own, so it's fine to do mid-download.

On the rules

A VPN changes the address other peers see. It doesn't change what's legal to download where you live. This page describes what the software does; what you use it for is your call.

Get VPNonly for Mac — $19

The app’s exact privileged engine source is public and MIT licensed.