Turnout connects your Mac to WireGuard servers the way wg-quick does, in a native app.

Turnout reads the .conf files you already use with wg-quick and applies them the way wg-quick does on macOS, step for step, with the same system tools.

PreUp PostUp PreDown PostDown

Hooks run, with %i replaced by the tunnel's utun interface and %I by its name. An administrator approves a file's hooks before they can run; how that works.

AllowedIPs

Routed into the tunnel, most specific first. A full tunnel uses 0.0.0.0/1 and 128.0.0.0/1, and the IPv6 halves, instead of replacing your default route, and the server's address stays on your physical gateway so it never routes into its own tunnel.

Table

auto and main route as above; off leaves the routing table to you.

DNS

Servers and search domains are set on your network services while the tunnel is up, and your own settings come back when it goes down.

MTU

As written, or worked out the way wg-quick does it: the exit interface's MTU minus 80.

Two lines wg-quick's format does not have. They start with #@, which wg-quick reads as a comment, so the same file still works with wg-quick up.

[Interface]
PrivateKey = …
Address = 10.8.0.2/32
DNS = 10.8.0.1
#@ BindInterface = en0
#@ Route = 192.168.0.0/16 dev en0

[Peer]
PublicKey = …
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = vpn.example.com:51820

You can also change a connected tunnel's exit interface from its path in the main window. Turnout disconnects, saves the change and connects again.

When gateways, interfaces or links change, or the Mac wakes from sleep, Turnout puts the tunnel's routes through your physical network back on the current gateways, works out the automatic MTU again and re-applies DNS.

If the interface a tunnel is bound to goes away and comes back, the tunnel binds to it again and handshakes again. If it disappears for good, the route to the server becomes a blackhole, so handshakes cannot slip into the tunnel itself, and routes that skip the tunnel wait until the interface returns.

Some networks block or slow down UDP, which WireGuard travels on: hotel and guest Wi-Fi, some offices, some carriers. Switch a peer to Phantun, and Turnout sends WireGuard's packets inside a TCP connection to a Phantun server, which hands them to your WireGuard server.

[Peer]
PublicKey = …
Endpoint = vpn.example.com:51820
#@ Phantun = 4567

That one line is a comment to wg-quick, so the same file still connects over UDP anywhere else. Phantun runs on a Linux host in front of your WireGuard server, and Server Setup… gives you its commands, with Docker or Phantun's release binary, already filled in with the tunnel's ports and MTU. Nothing else runs on your Mac: Turnout handles Phantun's TCP itself.

The path draws the TCP connection as a sleeve around the cable and, when something does not answer, says which side to check. When a UDP tunnel gets no answer, Use Phantun… on its path switches it over. Phantun gets through networks that block or slow down UDP; it does not get past firewalls that inspect traffic for real web connections.

Phantun is an open-source project by Datong Sun. What a tunnel through Phantun does to your Mac.

Give a tunnel a schedule, a list of Wi-Fi networks, or both.

When a scheduled window starts, Turnout connects the tunnel, and when it ends, disconnects it. When the Mac joins one of the listed networks, the tunnel connects; when it leaves, the tunnel disconnects. In between, what you do by hand sticks, and changing a rule never connects or disconnects anything on its own.

#@ Schedule = Mon-Fri 09:00-18:00
#@ OnWiFi = Office

The rules are lines in the config file, set up from the tunnel's page. Turnout acts on them while it is open, so it offers Open at Login. A Wi-Fi rule needs Location access, because macOS counts the name of a Wi-Fi network as location; Turnout asks for it when you set up the rule, never at launch.

Edit a tunnel as a form or as text, and switch between the two at any time.

Changes rewrite only the lines they touch, so your comments and ordering stay where you put them. Problems are listed with their line numbers, and Save waits until there are none. A new tunnel comes with a fresh key pair.

Drop .conf files or a .zip on the window, choose File › Import from File…, or paste a copied configuration with File › New Tunnel from Clipboard…. The zip the official WireGuard app exports opens as a batch: review every tunnel, leave some out, and import the rest at once.

File › Export Tunnels… goes the other way: one zip with a .conf per tunnel, laid out the way the official app writes and imports it. A tunnel's own Export… saves just its file.

Turnout lives in the menu bar. Connect and disconnect tunnels from there, and open the window only when you want the details.

Tunnels run in Turnout's background service, so they keep running when the app is closed. Measured with the window open, the app uses about 0.5% of the CPU while idle and 2–4% while it draws live traffic. Statistics are only fetched while the menu or a window is open, and once a minute if you ask to hear when a server stops answering.

Notifications tell you when a schedule or Wi-Fi rule connected or disconnected a tunnel, when a tunnel failed or stopped without being asked to, and the day before your trial ends. Each kind has its own switch, and the one about a silent server is off until you want it.

Its menus and windows speak English, 繁體中文, 日本語, Español and 한국어, following your Mac's language.

Every change Turnout makes to routes and DNS is written down before it is made.

If the Mac crashes or loses power with a tunnel up, the background service undoes what was left at its next start, and connects no tunnel until that is done. Turnout › Repair Network Settings… does the same whenever you ask.

Uninstalling takes one path, whether you start it from the app, from the installer or from a shell script you can read first. It disconnects every tunnel, restores routes and DNS, takes the background service out of Login Items, and deletes the app, its logs and its preferences. Saved tunnels stay unless you choose to delete them too. Uninstalling from the app also frees the Mac's place on your license. What each way removes

• No kill switch yet. Turnout does not block traffic outside the tunnel. While a tunnel is down, your Mac uses its normal network.
• Not a VPN provider. Bring your own server, or a config from your provider or your network administrator.
• No NetworkExtension. Tunnels run in Turnout's own background service, which is what lets hooks run and routes stay yours. They do not appear under System Settings › VPN.