# MugVPN

> MugVPN is a free, open-source (MIT) macOS menu-bar client for OpenVPN profiles that keeps several VPN connections up at the same time, each with its own tunnel (utun), routes and split DNS. macOS 13+, Apple silicon and Intel, 22 languages.

## What it does
- Several simultaneous OpenVPN connections (OpenVPN Connect on macOS allows one); conflict warnings when two connections collide.
- Split DNS per connection (the domains a server pushes, or ones you list for its DNS); a connection's own DNS servers for listed domains or all names; "don't change DNS".
- Kill switch per connection (macOS PF): if a connection carrying all traffic drops, the user's TCP and UDP traffic outside the VPN stays blocked until reconnect or "Unblock Internet".
- Leak protection while a connection carries all traffic: no IPv6 and no DNS outside the VPN; leak check warns about routes or DNS around the tunnel (TunnelVision).
- Connections window: create, edit (form or text), duplicate, rename, delete; import .ovpn, Tunnelblick .tblk, URL, OpenVPN Access Server.
- Sign-in: passwords in the Keychain, OTP challenges, web/SSO, PKCS#12, HTTP proxies; a warning before a client certificate expires.
- On the road: reconnects after sleep and on network changes (another Wi-Fi, router or lease); captive-portal sign-in from the menu, lifting a kill switch's block for two minutes.
- For admins and scripts: persistent connections at boot with their own kill switch (settings beside the profile); command line with exit codes and JSON (connect, disconnect, reconnect, status, list, --wait); diagnostics archive without keys or passwords; opens at login if asked.

## Compared with other clients (as their docs say, 2026-10-10)
- OpenVPN Connect 3.8 (macOS): one connection at a time; Seamless Tunnel; captive portal detection; free, proprietary.
- Tunnelblick 9: several connections ("for experts only"); no documented split DNS; kill switch turns off all network services and is not advised with several VPNs; openvpn runs as root; free, GPL.
- Viscosity 1.13: several connections, split DNS, connection editor; no built-in kill switch; US$16.
- MugVPN: several connections with split DNS each; per-connection kill switch that blocks only traffic outside the tunnels; IPv6/DNS kept inside the VPN; leak check incl. TunnelVision; collision warnings; openvpn without root; editor; captive-portal sign-in; CLI with exit codes and JSON; free, MIT.

## Security
- openvpn runs without root: a small helper does what needs root after checking each request; profiles that would run programs or load code are refused.

## Links
- Source and README: https://github.com/tanderbold/MugVPN (raw: https://raw.githubusercontent.com/tanderbold/MugVPN/main/README.md)
- FAQ: https://tanderbold.github.io/MugVPN/faq.html
- Current version: 0.2.6. Install: `brew install --cask tanderbold/tap/mugvpn`, or the DMG from https://github.com/tanderbold/MugVPN/releases/latest (signed with a Developer ID and notarized)
- Build: tools/build-openvpn.sh then MUGVPN_ARCH=native tools/build.sh
- License: MIT. "OpenVPN" is a trademark of OpenVPN Inc.; MugVPN is not affiliated with it.