A macOS menu bar app that automatically routes specific domains and services around your VPN, ensuring they use your regular internet connection.
Corporate VPNs often route all traffic through the tunnel, which can cause issues:
- Performance: Streaming and messaging apps become slow or buffer constantly
- Broken features: Chromecast, AirPlay, and location-based features fail
- Unnecessary load: Non-business traffic clogs the VPN tunnel
- Privacy: Personal services don't need to go through corporate infrastructure
VPN Bypass intelligently routes selected services directly to the internet while keeping business traffic secure through VPN.
- 🎯 Menu bar app - Quick access to status and controls
- 🔧 Pre-configured services - Telegram, YouTube, WhatsApp, Spotify, Tailscale, and more
- 🌐 Custom domains - Add any domain you want to bypass
- 🔄 Auto-apply - Routes are applied automatically when VPN connects
- 📋 Hosts file management - Optional DNS bypass via
/etc/hosts - 🪵 Activity logs - See what's happening in real-time
- 🔍 Extended VPN Detection - Supports GlobalProtect, Cisco, Fortinet, Zscaler, Cloudflare WARP, and more
- 📶 Network Monitoring - Detects VPN and network changes automatically
- 🔔 Notifications - Alerts when VPN connects/disconnects and routes are applied
- ✅ Route Verification - Ping tests to verify routes are actually working
- 💾 Import/Export Config - Backup and restore your domains and services
- 🚀 Launch at Login - Start automatically when you log in
- 🔄 Auto DNS Refresh - Periodically re-resolves domains and updates routes
# Add the tap (first time only)
brew tap geiserx/tap
# Install VPN Bypass
brew install --cask vpn-bypassOr install directly from the repository:
brew install --cask --no-quarantine https://raw.githubusercontent.com/GeiserX/vpn-macos-bypass/main/Casks/vpn-bypass.rbDownload the latest .dmg from Releases, open it, and drag VPN Bypass to your Applications folder.
# Clone the repository
git clone https://github.com/GeiserX/vpn-macos-bypass.git
cd vpn-macos-bypass
# Build and create release DMG
make release
# Or just build and run
make runOpen Package.swift in Xcode and run the project.
Click the shield icon in the menu bar to:
- See VPN connection status and type
- View active bypass routes
- Quick-add domains to bypass
- Refresh or clear routes
- Verify routes are working
Click the gear icon to access settings:
Domains Tab
- Add custom domains to bypass
- Enable/disable individual domains
- See resolved IPs
Services Tab
- Toggle pre-configured services
- Each service includes known domains and IP ranges
General Tab
- Launch at Login toggle
- Auto-apply routes when VPN connects
- Manage
/etc/hostsentries - Enable route verification after apply
- Notification preferences (connect, disconnect, routes, failures)
- Import/Export configuration backup
- Network status display (VPN type, interface, gateway, WiFi SSID)
Logs Tab
- View recent activity
- Debug connection issues
| VPN Client | Detection | Status |
|---|---|---|
| GlobalProtect | ✅ Full | Supported |
| Cisco AnyConnect | ✅ Full | Supported |
| OpenVPN | ✅ Full | Supported |
| WireGuard | ✅ Full | Supported |
| Fortinet FortiClient | ✅ Full | New in v1.1 |
| Zscaler | ✅ Full | New in v1.1 |
| Cloudflare WARP | ✅ Full | New in v1.1 |
| Pulse Secure | ✅ Full | New in v1.1 |
| Tailscale (exit node) | ✅ Full | Supported |
| Tailscale (mesh only) | ❌ Not VPN | Expected |
| Service | Domains | Status |
|---|---|---|
| Telegram | telegram.org, t.me, etc. | Enabled by default |
| Tailscale | login.tailscale.com, etc. | Enabled by default |
| YouTube | youtube.com, googlevideo.com, etc. | Disabled |
| whatsapp.com, web.whatsapp.com | Disabled | |
| Spotify | spotify.com, scdn.co | Disabled |
| Slack | slack.com, slack-edge.com | Disabled |
| Discord | discord.com, discordcdn.com | Disabled |
| Twitch | twitch.tv, twitchcdn.net | Disabled |
- VPN Detection: Monitors network interfaces and running processes to detect VPN type
- Gateway Detection: Identifies your local gateway (Wi-Fi/Ethernet router)
- Route Management: Adds host routes to send specific traffic through local gateway instead of VPN
- Route Verification: Optionally pings routes to verify they're working
- DNS Bypass: Optionally adds entries to
/etc/hoststo bypass VPN DNS
The app intelligently detects corporate VPNs while avoiding false positives:
| Interface Type | IP Range | Detection |
|---|---|---|
| Corporate VPN (GlobalProtect, Cisco, etc.) | 10.x.x.x, 172.16-31.x.x |
✅ Detected as VPN |
| Cloudflare WARP | 100.96-111.x.x |
✅ Detected as VPN |
| Tailscale (mesh networking) | 100.64-127.x.x |
❌ Not detected* |
| Tailscale (exit node active) | 100.64-127.x.x |
✅ Detected as VPN |
*Tailscale in normal mode only routes traffic to other Tailscale devices. It's not a "full VPN" because your regular internet traffic still goes through your normal connection. The app only considers Tailscale as a VPN when you're using an exit node (routing all traffic through another Tailscale device).
The detection also requires:
- The interface must have the
UPflag (actually connected, not just configured) - The interface must have an IPv4 address in a VPN range
- macOS 13.0 (Ventura) or later
- Admin privileges (for route management and hosts file)
The app requires:
- Network access: To detect VPN connections and resolve domains
- Admin privileges: To add routes and modify
/etc/hosts(prompted when needed) - Notifications: Optional, for VPN status alerts (prompted on first launch)
- Check if VPN is actually connected (look for utun interface)
- Verify local gateway is detected in Settings → General
- Check Logs tab for errors
- Use "Verify Routes" button to test connectivity
The app will prompt for admin password when modifying /etc/hosts. If you deny, disable this feature in Settings → General.
Some VPNs force DNS through the tunnel. The hosts file entries help bypass this, but you may also need to:
- Disable "Route all DNS through VPN" in your VPN client
- Use a local DNS resolver
If routes are applied but verification fails:
- The destination host may be blocking ping (ICMP)
- Try accessing the service directly - it may still work
- Check if the service is actually accessible from your network
Contributions are welcome! Here's how you can help:
- Report bugs - Open an issue with details
- Suggest features - Use the feature request template
- Submit PRs - Fork, create a branch, and submit a pull request
Please read the issue templates before submitting.
This project is licensed under the GPL-3.0 License.
