DHCP & DNS gateway
Start with selected-device bypass routing, take over LAN DHCP when you are ready, or serve an isolated downstream network.
Explore gateway modesOpen source · macOS 13+
Turn your Mac into a
whole-home gateway.
OpenSurge is a Surge-style macOS gateway and control plane powered by mihomo. Route phones, TVs, consoles, and other devices through one observable, recoverable network path.
Open source · GitHub · Apple Silicon and Intel
ONE MAC · MANY DEVICES · INDEPENDENT ROUTES
Gateway readyTUN activeDevices observed
3network topologies
1auditable control plane
IPv4 / IPv6experimental
GPL3.0-only
NETWORK CONTROL, NOT APP SETTINGS
Proxy the household at the gateway layer
Devices such as game consoles and TVs cannot run the same proxy client as a Mac. OpenSurge moves routing policy to the Mac gateway so downstream devices use ordinary IP networking.
Per-device routing
Give a phone, TV, PS5, or VR headset a dedicated selector while keeping local and private traffic direct.
See device policymihomo control plane
Import compatible proxies and rules while OpenSurge retains ownership of gateway-critical DNS, TUN, and recovery state.
Understand the architectureSTART SMALL, SCALE DELIBERATELY
One product, three clearly distinguished network topologies
The setup changes with the network you actually control. All three topologies start with IPv4 and can optionally enable experimental IPv6 takeover. OpenSurge explains the operational impact before it changes DHCP, routes, or advertisements.
Recommended first
Bypass-router mode
Keep router DHCP. Manually point selected stable devices at the Mac.
Optional IPv6 takeover
Automatic onboarding
LAN DHCP takeover
Disable router DHCP and let OpenSurge provide device network settings.
Optional IPv6 takeover
Cleanest boundary
Isolated downstream LAN
Use a separate AP, SSID, VLAN, or interface behind the Mac.
Optional IPv6 takeover
ONE ENGINE, DEVICE-SCOPED POLICY
A PS5 can choose a region while the TV chooses a streaming route
OpenSurge compiles stable device identity into source-scoped mihomo rules. Mac-local mode stays independent, and the connection view shows the outbound chain that traffic actually used.
Read the PS5 gateway guideWIND ROSE · EXPERIMENTAL IPV6
Two ingress paths. One policy model.
IPv4 and Mac-local traffic use mihomo TUN. Experimental downstream IPv6 uses RA/SLAAC/RDNSS plus a macOS BPF broker and the project-patched mihomo userspace packet path—without claiming the packets entered utun.
Explore the IPv6 architecture
BUILT FOR NETWORKS THAT MUST RECOVER
Validation is part of the product story
Unit tests protect business rules. Virtual LAN labs exercise DHCP, DNS, TUN, NAT, rollback, and topology-specific IPv6 paths. Public claims stay bounded by the evidence that was actually collected.
Inspect the Virtual Lab01Unit & configuration tests
02Virtual host-network lab
03Topology-specific device evidence
Start with the problem you want to solve
Guide
Use a Mac as a router
Onboard one device without redesigning the LAN.
GuideRoute a PS5 through the Mac
Give a console its own observable egress.
GuideRoute Claude Code by device
Reuse one service template while choosing each device's exit.
GuideUse a Pixel VPN exit
Add a phone-side HTTP or SOCKS5 path as a mihomo outbound.
GuideTake over LAN DHCP safely
Prepare the offline recovery path before automatic onboarding.
DocsRoute traffic from the Mac
Separate local Rule, Global, and Direct from system-proxy coordination.
DocsImport a mihomo configuration
Keep nodes and rules while OpenSurge owns gateway-critical fields.
DocsInstall and verify
Check the unsigned package and complete a careful first run.
JournalInside Wind Rose
Why v0.2 adds a second transparent ingress path.
Make the Mac the network control point.
Start with one device, verify the path, and expand only when the topology is ready.