LockPlus 2.0.0

LockPlus 2.0.0

LockPlus has been rebuilt from scratch as a native macOS app. Same idea, a WireGuard and OpenVPN client with a kill
switch, now built on Apple's Network Extension: no root helper, no firewall rules, and a kill switch that macOS
itself enforces.

I built LockPlus because I needed one Mac client for WireGuard and OpenVPN and found none I liked: none with a real
kill switch for both protocols and a UI I'd want to look at every day. LockPlus 2 is that app done properly.

How it is built. I direct the work, decide and am accountable; most of the code is written by AI coding agents
(Claude). Every security-relevant change went through dedicated AI security review passes, published with their
fixes in docs/reviews/. About 880 automated tests
and end-to-end runs on macOS 26 and 27 virtual machines verify it, with documented results. An AI review is not a
human audit: independent review and issues are welcome.

Highlights

• Native app. SwiftUI and AppKit, in the menu bar and a main window. The tunnel runs in a system extension that
  you approve once in System Settings. No administrator password to connect, no background daemon.
• Kill switch enforced by macOS. With the kill switch on, macOS blocks every packet outside the tunnel, also while
  the tunnel reconnects. "Disconnect and Restore Internet" always gets you back online.
• WireGuard and OpenVPN in one app, with OpenVPN sign-in by password, static challenge (one-time code) and
  dynamic challenge (CRV1), including a new code on reconnect.
• Auto-connect on networks you don't trust (Wi-Fi and/or Ethernet) with a trusted-networks list. It works through
  macOS's on-demand rules, also while LockPlus isn't running.
• Pause Protection for a set time, for hotel and café sign-in pages; it resumes by itself.
• DNS verification: "DNS through tunnel (verified)", or what is wrong.
• Honest status everywhere: Protected, Not protected, Blocked, Paused, Sign-in needed, each with its own icon.
  "Protected" only when macOS says the tunnel is connected.
• Menu bar with live rates, a status header with a rate graph, one-click switching.
• Import with a report (.conf, .ovpn, zip, the WireGuard app's export) and a built-in editor with checks.
• Diagnostics (routes, DNS, tunnel checks) and an export with secrets removed.
• English and German.
• A new app icon for macOS 26: the familiar padlock, now adaptive: off-white in Light, navy in Dark, plus Clear and Tinted.

Upgrading from LockPlus 1.x / WireGuide+

LockPlus 2 is a new app; LockPlus 1 can't update itself to it. The way over is LockPlus 1.2.0, the last version of
LockPlus 1: it shows what LockPlus 2 will copy, and Move to LockPlus 2 now disconnects, removes the old background
helper (one administrator password prompt), downloads LockPlus 2 and checks its signature before opening the installer.
Later keeps LockPlus 1 working, with a banner to move when you're ready. On first launch LockPlus 2 copies your
profiles and settings; your 1.x files are never changed.

Check your version first (LockPlus or WireGuide+ › About):

You have	How you get 1.2.0
1.0.65 – 1.1.0	The in-app update offers 1.2.0, verifies it and shows the downloaded zip in Finder. Open it and drag LockPlus to Applications (Replace).
1.0.28 – 1.0.62 (WireGuide+ 1.0.28 – 1.0.56, LockPlus 1.0.57 – 1.0.62)	The in-app update offers 1.2.0 and shows the downloaded DMG in Finder. Open it and drag LockPlus to Applications. WireGuide+ users: the new app is called LockPlus and sits next to WireGuide+; quit WireGuide+ first.
1.0.63 – 1.0.64	The in-app update can't check 1.2.0's signature and opens the releases page instead. If the in-app update fails, download the DMG (lockplus-v1.2.0-darwin-arm64.dmg) and drag LockPlus to Applications.
1.0.0 – 1.0.27 (WireGuide+)	The update check of most of these versions looks at the original WireGuide project, so it may not offer 1.2.0 (1.0.0 even offers "WireGuide 0.6.1": that is a different app, don't install it). If yours doesn't offer 1.2.0, download manually: with macOS 26 and Apple silicon, take LockPlus 2 directly; otherwise the 1.2.0 DMG.

No 1.x version replaces the app by itself: every update ends with you opening the download and dragging LockPlus to
Applications. Then open the new LockPlus once.

Requirements. LockPlus 2 needs macOS 26 and Apple silicon.

• On macOS 13 – 15, update to 1.2.0 and choose Later: LockPlus 2 won't start on your system, and 1.2.0 keeps
  working.
• LockPlus has been Apple-silicon-only since 1.0.23. On an Intel Mac neither 1.2.0 nor 2.0 runs; WireGuide+ 1.0.22 was
  the last Intel build.

Homebrew. brew upgrade --cask lockplus, then quit and reopen LockPlus (Homebrew doesn't relaunch it). The old
wireguide-plus cask is renamed to lockplus, so brew upgrade moves you over. If you used LockPlus 1.x, open it
once before the cask moves to LockPlus 2, so its helper is removed.

WireGuide+ background helper. WireGuide+ 1.0.1 – 1.0.56 installed a background helper of its own
(io.github.steiale.wireguide-plus.helper). If you came from WireGuide+, check for it after moving and remove it in
Terminal (disconnect and quit WireGuide+ first):

sudo launchctl bootout system/io.github.steiale.wireguide-plus.helper 2>/dev/null
sudo rm -f /Library/LaunchDaemons/io.github.steiale.wireguide-plus.helper.plist \
           /Library/PrivilegedHelperTools/io.github.steiale.wireguide-plus.helper

Then you can move WireGuide+ to the Trash.

What is copied from LockPlus 1.x

• All WireGuard and OpenVPN profiles, each checked by the new importer (the report lists anything that changed or
  isn't supported);
• the kill switch setting per profile (route protection for split tunnels) and DNS through the tunnel;
• Wi-Fi auto-connect: the auto-connect profile, untrusted-network setting and trusted networks;
• connection history;
• saved OpenVPN user names, and saved passwords if you allow it (one keychain prompt per item);
• language, appearance (Light, Dark or System), log level, menu bar icon style, and "open at login" (offered, never
  switched on silently).

Not copied: per-network profile choices (a different profile per Wi-Fi; not supported yet). LockPlus 1's files are never changed; you can re-run the import later from
Settings › Advanced › Import from Old LockPlus….

Known limitations

• Crash window. If LockPlus's tunnel process crashes with the kill switch on, macOS lets traffic through for under
  2 seconds (1.3 to 1.7 s measured on macOS 26 and 27) before it restarts the tunnel. For the auto-connect profile, the running app restarts it within about
  1.5 seconds; without the app, the Mac stays online until the next network change.
• Switching profiles is a short unprotected moment (LockPlus runs one tunnel at a time).
• One active tunnel at a time. LockPlus 1 could run several WireGuard tunnels at once.
• No separate DNS protection switch: with the kill switch on, DNS goes through the tunnel.
• Split tunnels get route protection, not a full kill switch.
• OpenVPN: no TAP, plugins or web (SSO) sign-in; outdated ciphers (BF-CBC, DES, 3DES) and auth MD5 aren't
  supported (AES-CBC works, with a "Legacy encryption" note).
• macOS always lets some system traffic bypass VPNs (network setup such as DHCP, captive-network sign-in, and by
  default Apple push notifications and cellular services).
• A VPN server reachable only through a secondary interface (a local VM or Docker network) can't be used.

System requirements

• macOS 26 (Tahoe) or later
• Apple silicon (Intel Macs aren't supported)

Checksums

File	SHA-256
LockPlus.dmg	28096c8fee5ae917031282e75cc09a732892e91086acd632df5a2221193ae583
LockPlus-2.0.0.zip	1cb993fc1a57ef5fb7ad8f45d93ff9a20830d341f6a69156f7a8ebc21580b1d4
0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch	bab08174b1b711219e0c79933a38911734997bfd6d202386f2fc390b3858e4c2

Both artifacts are signed with Developer ID (team M53GHX9FAY) and notarized by Apple; the zip also carries the
Sparkle EdDSA signature in the update feed.

Open source notices

LockPlus is MIT-licensed; source: https://github.com/steiale/lockplus. It includes OpenVPN 3 (MPL-2.0), OpenSSL
(Apache-2.0), wireguard-go and WireGuardKit (MIT), Sparkle (MIT), ZIPFoundation (MIT), LZ4 (BSD-2-Clause) and Asio
(Boost Software License).

Source of modified MPL files: this release ships OpenVPN 3 release/3.11.8 with one local change (a data race on
process-wide settings). The patch is attached to this release
(0001-LockPlus-ClientOptions-can-leave-openvpn3-s-process-.patch) and is in the source repository under
native/Vendor/patches/openvpn3/.

---