Mac Client Application

Get the app onto your Mac

You can install Phantom-WG Mac on your Mac in two ways.

• Homebrew Cask (recommended) — Single command and easy updates
• Direct .dmg — arm64 for Apple Silicon, x86_64 for Intel, as separate packages.

The signed .app is placed into /Applications; on first launch macOS Gatekeeper verifies the signature. .dmg packages are available from the mac-v1.3.0 release page. Build, signing, and notarization run on GitHub Actions via mac-release.yml.

System Requirements

• macOS 14 (Sonoma) or later
• Apple Silicon (arm64) or Intel (x86_64)

Approve three system extensions

Phantom-WG Mac runs network operations through three system extensions:

• PhantomTunnel — Tunnel connection; runs Ghost Mode (wstunnel + WireGuard) or Standalone WireGuard.
• PhantomSplitTunnel — Transparent Proxy for per-app routing.
• PhantomDNSProxy — DNS Proxy that pins per-app DNS queries to the chosen network interface.

On first launch macOS asks for a separate approval for each; the main interface stays closed until all three are active.

Import a config and start your tunnel

To start a tunnel, a WireGuard .conf file is imported into the app. The mode is determined by the file's contents:

• Standalone WireGuard — A classic .conf file starts the WireGuard tunnel directly.
• Ghost Mode (wstunnel + WireGuard) — A .conf file with a [Wstunnel] section switches the app to Ghost mode; traffic is carried within a wstunnel layer.

No separate app or toggle is needed to choose between modes — the configuration decides.

Route selected apps outside the tunnel

Split-Tunneling routes the traffic of apps you add to the list outside the tunnel:

• Bypass Routing — Selected apps exit directly through your physical interface or the network interface you choose; the tunnel stays active and remaining traffic continues through the VPN.
• Strict Mode — If the selected interface becomes unreachable, flows from bypassed apps are rejected — never silently rerouted back through the tunnel.
• mDNSResponder inclusion — Adding it to the same list carries local name resolution over the selected interface too.