MugVPN FAQ: multiple OpenVPN connections on a Mac

Yes — that is what MugVPN is for. Every connection runs its own openvpn with its own utun interface, routes and DNS. Connect the office VPN, a client's VPN and your home lab together; each has its own submenu. If two connections want the same thing (both take all traffic, overlapping routes), MugVPN warns you.

When a server names its domains (dns … resolve-domains, or with the per-connection switch also the old dhcp-option DOMAIN), only those names go to that VPN's DNS; everything else resolves as before. You can also send just the domains you list to the server's DNS (when it pushes none of its own), or set a connection's own DNS servers for domains you list. Several connections can each answer for their own domains; only one can take all names.

Yes. Per connection (switch it on in the connection's Options), a kill switch blocks your TCP and UDP traffic outside the VPN (with the macOS packet filter, PF) if a connection that carries all traffic drops unexpectedly, until you reconnect it or choose Unblock Internet in the menu (name lookups through the Mac's resolver still go out, so the VPN can find its server again; a persistent connection's kill switch blocks every other protocol too). While such a connection is up, IPv6 and DNS outside the VPN are blocked. After connecting, and on every network change, a leak check warns if the default route, a public network or DNS goes around the tunnel — including routes a rogue DHCP server pushes (TunnelVision).

OpenVPN Connect on macOS keeps one connection at a time. Tunnelblick and Viscosity can run several, but Tunnelblick documents no split DNS and advises against its kill switch with several VPNs, and Viscosity has no built-in kill switch. MugVPN is made for several at once: split DNS per connection, a kill switch per connection that blocks only traffic outside the tunnels, IPv6 and DNS kept inside the VPN, a leak check (TunnelVision included), warnings when connections collide, openvpn without root, a connection editor, captive-portal sign-in and a scriptable command line. It is free and open source (MIT) and imports Tunnelblick configurations. See the comparison table.

Standard OpenVPN 2.x client profiles (.ovpn, .conf), with inline or separate certificates and keys, tls-auth, tls-crypt, tls-crypt-v2, PKCS#12, passwords, OTP, web sign-in and proxies. For safety, options that would run programs or load code (up/down scripts, plug-ins) are refused, with the line that caused it. Your own scripts beside the profile (<name>_up.sh …) run as you.

Something has to be root to create tunnels, routes and DNS — but not openvpn itself. In MugVPN each tunnel's openvpn runs unprivileged, and a small helper does what needs root after checking each request. Profiles are checked before they run.

With Homebrew: brew install --cask tanderbold/tap/mugvpn. Or from the latest release: a DMG signed with an Apple Developer ID and notarized by Apple, with its SHA-256 beside it. Open it, drag MugVPN to Applications, and allow its helper when macOS asks on the first connection. You can also build it from source.

Yes. When a network asks for a sign-in page first, MugVPN offers Sign in to This Network… in its menu; if the kill switch is blocking the Internet, the block is lifted for two minutes so the page can load. When you move to another network, the tunnels reconnect at once.

Yes: MugVPN --command connect|disconnect|reconnect|status|list answers once the command is done, with exit codes and JSON output; --wait waits until the connection is up (or down). See the README.

Yes. Tunnelblick .tblk folders and standard .ovpn files (Viscosity exports them) import directly, with the keys and certificates they name; profiles from a URL or an OpenVPN Access Server too.

Yes. It is free and open source under the MIT License, with no account, no tracking and no paid tier.

macOS 13 Ventura or later, on Apple silicon and Intel Macs. The interface is in 22 languages.