Running several WireGuard tunnels at once on a Mac

On a Mac, Paart can keep several WireGuard connections up together, each carrying its own routes. Here is what that does, and what it rests on.

The problem this solves

You need a server at one customer while you are working on the network of another, and you would rather not lose your own local network in the process.

With one tunnel at a time, that is three disconnections and three reconnections. Every switch costs a handshake, and anything you had open on the first network drops.

What a Mac can do

On a Mac, Paart can hold several WireGuard connections up at the same time. Each one stays a separate tunnel with its own peer, its own keys and its own routes — they do not merge, and they do not take turns.

In practice that means you can reach the first customer’s server, the second customer’s firewall and your own local machines without touching a switch between them.

Each tunnel keeps its own routes

What travels through a given tunnel is decided by that connection’s AllowedIPs, exactly as it would be on its own. A connection that carries 10.20.0.0/16 takes the traffic for that range and nothing else; another carrying 192.168.50.0/24 takes its own.

This is why several tunnels can coexist without fighting: they are not competing for all of your traffic, they are each claiming a part of it. Two connections that both ask for 0.0.0.0/0 are a different matter — one of them will win, because only one route can be the default.

See DNS, routing and split tunnelling for how to read and set those ranges.

What this rests on

That is how macOS behaves today rather than something Apple guarantees: nothing in the API commits to it, and a later version of the system could change it.

We say this plainly because it matters if you are about to build a way of working on it. The behaviour has been observed across sessions, and it is what the system does now — but observed behaviour is not a contract, and there would be no notice and no one to ask if it changed.

On iPhone and iPad

One connection is active at a time. This is not a Paart limitation and no client can work around it: the system grants a single active VPN configuration on iOS and iPadOS.

Switching between connections still works, and on-demand rules can do the switching for you based on the network you are on.