MacOS – Running some processes and not others over VPN

firewallmacosNetworksoftware-recommendationvpn

I'm looking to secure some apps on macOS using an OpenVPN connection.
I want the apps not to work when the VPN isn't active.
I can't necessarily track which servers the apps are trying to access, so manually specifying routes either from the server or client end is prohibitive. I also don't want all traffic going over the VPN.

So here's what I have so far:

Something needs to work at the application layer to 'capture' all traffic from an application.
Something else needs to work at the network layer to take all of that traffic and push it over the VPN.

And then I need a way to specify which apps and which interface, and be sure that if that interface is down or disconnected, no traffic flows.

So far I think this might be doable with pf (I found Murus, a GUI front-end), except that it doesn't seem to deal with applications per-se, but rather networks and ports, which as stated above is problematic.

Then there's Little Snitch, which deals with applications but is a binary go/no-go decision maker, rather than directing some traffic here and some traffic there.

That said, I did find a not-well-documented feature where it seems like you can create a rule for a process in Little Snitch, and give it access to pf. So perhaps there's a way to write a pf rule that then directs that traffic over the VPN.

Open to suggestions.

Best Answer

This feature is available from Private Internet Access. They call it their Desktop Application Split Tunneling Feature. It is a complex enough feature that I would not expect it to be supported by free software.

Related Solutions

Reasons to prefer Little Snitch over the built-in firewall

Little Snitch offers three features that aren't available in MacOS' built-in ipfw firewall. (It does this by loading a custom kernel module.)

Little Snitch allows you to block outgoing connections; the MacOS firewall only blocks incoming connections. Handy if you're running some untrusted program and aren't sure what it's going to do, or if you want to disable a program for updating itself, or if you want to prevent access to a specific resource. Also, I suspect many people use Little Snitch to block pirated software from checking their license.
Little Snitch lets you configure the firewall per application, not just address or port. Ie: you can configure it so one web browser can access a web site but not another.
Little Snitch also monitors network traffic on a per-application basis. It's easy on MacOS to see how much bandwidth you're using but much harder to see which program is using that bandwidth. The Little Snitch shows network usage for each application, albeit in a limited way.

That being said, I don't think Little Snitch is "must have" software; these features are fairly esoteric. There are also several alternatives: TCPBlock and glowworm for the firewall and Rubbernet (now defunct) for the monitoring.

2016 Update: MacOS now has the per-application monitoring built into Activity Monitor.

How to selectively route traffic for one specified IP adddress through the VPN tunnel (not all traffic)

Step 1, create two plain text files named ip-up and ip-down in /etc/ppp and make the two files executable:

$ sudo touch /etc/ppp/ip-{up,down}
$ sudo chmod +x /etc/ppp/ip-{up,down}

Step 2, modify the file ip-up, add the following:

#!/bin/sh
export PATH="/bin:/sbin:/usr/sbin:/usr/bin"

OLDGW=`netstat -nr | grep '^default' | grep -v 'ppp' | sed 's/default *\([0-9\.]*\) .*/\1/'`

if [ ! -e /tmp/pptp_oldgw ]; then
    echo "${OLDGW}" > /tmp/pptp_oldgw
fi

dscacheutil -flushcache
route add 10.4.0.0/24 "${OLDGW}"

Step 3, modify the ip-down, add the following:

#!/bin/sh
export PATH="/bin:/sbin:/usr/sbin:/usr/bin"

if [ ! -e /tmp/pptp_oldgw ]; then
        exit 0
fi

ODLGW=`cat /tmp/pptp_oldgw`

route delete 10.4.0.0/24 "${OLDGW}"
rm /tmp/pptp_oldgw

Related Question