TailSplit

Your Mac.
Your routing rules.

A macOS menu bar app for domain and IP rules. Keep direct traffic on your network, send selected connections through a proxy exit, and reach your Tailnet when configured.

Get TailSplit Read the docs
Routing concept One connection, one matching route.
Rules choose the route A connection from your Mac reaches TailSplit rules. It can go directly over the current network, through the selected proxy exit, or to a configured and authorized Tailnet destination. Your Mac Your rules Direct Current network Proxy Selected exit Tailnet Authorized peers

A domain on your proxy list uses the selected exit. The rule’s DNS follows that exit too.

Illustration only. No connection is made and no network settings change.

Starts in your menu bar, disconnected. You decide when to connect.

Keep the route
in your hands.

Domain lists, IP ranges, and GFWList rules live in a YAML configuration you can open from the menu bar.

Use an application’s HTTP/SOCKS proxy settings, or enable TUN routing for captured system traffic. Both modes use the same routing rules.

In rule mode, connections are matched in this order:

  1. Configured Tailnet destinations

    MagicDNS names, configured Tailnet domains, and Tailnet addresses use the embedded Tailscale connection.

  2. Your direct exceptions

    Direct domains, GFWList exceptions, and direct IP ranges stay on your network.

  3. Your proxy rules

    Proxy IP ranges, proxy domains, and GFWList proxy matches use the selected exit.

  4. The remaining traffic

    Other private destinations go direct. Everything else follows your configured default.

DNS is part of the route. Proxy-domain lookups use the proxy exit; Tailnet names use the appropriate Tailnet resolver.

From download
to menu bar.

Open-source on GitHub. Download the macOS app, or install the macOS/Linux CLI. Releases support Apple Silicon and Intel Macs, plus Linux amd64 and arm64 with Debian packages.

Download TailSplit

macOS 14 or later. Each release includes checksums and signing receipts.

Install with one command.

The installer detects your platform, verifies SHA-256, and installs the app on macOS or the CLI on Linux. It preserves your configuration and device state.

curl -fsSL https://tailsplit.idy.dev/install.sh | sh

For a user-local CLI, add sh -s -- --cli --no-sudo after the pipe. See the installer options.

  1. Open TailSplit.

    Install the macOS app from its distribution package and open it normally. It appears in the menu bar without connecting automatically.

  2. Allow the network service.

    The first connection opens the bundled macOS package installer. An administrator authorizes the privileged background service, which handles the TUN and DNS in both connection modes.

  3. Review your rules. Connect.

    Open the YAML from the menu, set your Tailnet and exit, and review the routing rules. Authorize your device when needed, then start the proxy connection.

Application proxy

Opt individual apps into the local HTTP/SOCKS proxy. A narrow DNS TUN route is created; the system proxy, default traffic route, and system DNS stay as they are.

System routing

Enable tun.enabled in YAML to add system-traffic routing and DNS interception. Rules apply to connections captured by the TUN.

A little context
before connecting.

Building the macOS app?

With Go 1.26.2 or later, Python 3.11+, and Xcode Command Line Tools, run this from a TailSplit checkout:

make app

This creates an ad-hoc development build. Developer ID signing and notarization use the separate documented release process.

What happens when an exit is unavailable?

Global mode sends captured traffic through the selected exit and keeps the running TUN in place if that exit goes offline. It blocks those connections until the exit recovers.

This protection depends on TailSplit and its TUN remaining active. Disconnecting, quitting, or a background-service crash removes the TUN and temporary DNS, restoring system networking. It is not a persistent system-wide firewall kill switch.

Why does application proxy mode need permission?

Both connection modes create a TUN for the app’s DNS service. Application proxy mode adds only its narrow DNS route; enabling system routing adds the broader traffic routes. The privileged service performs this work, and the macOS installer handles the administrator password.

Does signing in start the proxy?

No. Signing in authorizes the embedded Tailscale device. Starting the proxy is a separate action. Opening the app and automatic connection are also separate preferences; automatic connection is off by default.

Can I choose another exit?

The exit menu lists devices your Tailnet makes available as exits. Offline or expired devices cannot be selected. Switching exits saves the choice and reconnects a running proxy while preserving your device login and routing rules. TailSplit does not silently choose another exit for you.

Need to provide a SOCKS5-backed Tailnet exit?

Meet TailRelay