DHCP & DNS gateway
Start with selected-device bypass routing, take over LAN DHCP when you are ready, or serve an isolated downstream network.
Explore gateway modesOpen source · macOS 13+
Turn your Mac into a
whole-home gateway.
OpenSurge is a Surge-style macOS gateway and control plane powered by mihomo. Route phones, TVs, consoles, and other devices through one observable, recoverable network path.
Free and open source · Apple Silicon and Intel · unsigned packages
ONE MAC · MANY DEVICES · INDEPENDENT ROUTES
Gateway readyTUN activeDevices observed
3network topologies
1auditable control plane
IPv4+ experimental IPv6
GPL3.0-only
NETWORK CONTROL, NOT APP SETTINGS
Proxy the household at the gateway layer
Devices such as game consoles and TVs cannot run the same proxy client as a Mac. OpenSurge moves routing policy to the Mac gateway so downstream devices use ordinary IP networking.
Per-device routing
Give a phone, TV, PS5, or VR headset a dedicated selector while keeping local and private traffic direct.
See device policymihomo control plane
Import compatible proxies and rules while OpenSurge retains ownership of gateway-critical DNS, TUN, and recovery state.
Understand the architectureSTART SMALL, SCALE DELIBERATELY
One product, three honest network topologies
The setup changes with the network you actually control. OpenSurge explains the operational impact before it changes DHCP, routes, or advertisements.
Recommended first
Bypass-router mode
Keep router DHCP. Manually point selected stable devices at the Mac.
Automatic onboarding
LAN DHCP takeover
Disable router DHCP and let OpenSurge provide device network settings.
Cleanest boundary
Isolated downstream LAN
Use a separate AP, SSID, VLAN, or interface behind the Mac.
ONE ENGINE, DEVICE-SCOPED POLICY
A PS5 can choose a region while the TV chooses a streaming route
OpenSurge compiles stable device identity into source-scoped mihomo rules. Mac-local mode stays independent, and the connection view shows the outbound chain that traffic actually used.
Read the PS5 gateway guideWIND ROSE · EXPERIMENTAL IPV6
Two ingress paths. One policy model.
IPv4 and Mac-local traffic use mihomo TUN. Experimental downstream IPv6 uses RA/SLAAC/RDNSS plus a macOS BPF broker and the project-patched mihomo userspace packet path—without claiming the packets entered utun.
Explore the IPv6 architecture
BUILT FOR NETWORKS THAT MUST RECOVER
Validation is part of the product story
Unit tests protect business rules. Virtual LAN labs exercise DHCP, DNS, TUN, NAT, rollback, and topology-specific IPv6 paths. Public claims stay bounded by the evidence that was actually collected.
Inspect the Virtual Lab01Unit & configuration tests
02Virtual host-network lab
03Topology-specific device evidence
Start with the problem you want to solve
Make the Mac the network control point.
Start with one device, verify the path, and expand only when the topology is ready.