tailroute-cli — Automatic Tailscale + VPN coexistence for macOS.
brew install shrwnsan/tap/tailroute-cli
sudo tailroute installThat's it. The daemon runs automatically in the background.
Menu bar app (same engine, native UI, free during early access):
brew install --cask shrwnsan/tap/tailrouteOr let the installer do both steps for you:
curl -fsSL https://raw.githubusercontent.com/shrwnsan/tailroute-cli/main/install.sh | bashThe script still installs through Homebrew's formula, so checksums stay enforced — it just drives brew and the daemon install in one go.
When you have both Tailscale and a VPN (NordVPN, ProtonVPN, etc.) connected:
- DNS fix: MagicDNS breaks your internet → tailroute toggles it automatically
- Mesh access: VPN blocks Tailscale IPs → use the built-in SOCKS5 proxy to reach peers
Tested against Mullvad and NordVPN; the daemon classifies routing changes from any VPN that takes the default route (corporate clients included). Current matrix and notes live on the homepage. If your VPN behaves differently, report it — reports feed the compatibility notes.
The daemon re-asserts its MagicDNS decision once RECONCILE_REASSERT_SECONDS (default 60) have passed since the last apply, so out-of-band DNS changes self-heal within about a minute on both the event and safety-net paths. Values below POLL_SECONDS (60) cannot make the safety-net poll faster; invalid values fall back to the default. Override via the daemon's launchd EnvironmentVariables — the plist is rewritten on reinstall/upgrade, so re-apply after those. Steady-state re-asserts log at debug; set DEBUG=1 via the daemon's launchd EnvironmentVariables to see them.
tailroute status # Check daemon and network state
tailroute --help # See all commandsReach Tailscale peers through VPN:
tailroute proxy auth # First-time: authorize with Tailscale
tailroute proxy start # Start proxy on 127.0.0.1:1055
tailroute proxy-config ssh # Generate SSH config helpers- macOS 15+ (Sequoia or later)
- Tailscale (
brew install tailscale) - A VPN that uses
utuninterface
- Homepage — install, security, limitations
- tailroute manual — the full man page
- BUILD.md — Build from source
- CONTRIBUTING.md — Development guidelines
"tailroute" is a more popular name than expected — a few unrelated projects answer to it, and none of them is this one. This is the macOS daemon that keeps your VPN and your Tailscale mesh out of each other's way. If brew install shrwnsan/tap/tailroute-cli brought you here, you're in the right place — and this project is not affiliated with any of the others.