Skip to content

MultihomingGuard Support

Support for MultihomingGuard for macOS: LAN first, Wi-Fi only as fallback. As soon as a wired connection – Ethernet, a dock or an iPhone over USB – is verified to work, Wi-Fi is switched off; when the cable goes away, Wi-Fi returns within a second.

Documents

The following pages belong to this support address.

Report a problem and review reports

Support requests and bug reports go through the public issue list in the feichti01/support repository. MultihomingGuard reports carry the label multihomingguard. The list is a short English extract of the publicly shareable items and not a complete status source.

MultihomingGuard is maintained by one person in their spare time. You will normally hear back within seven days.

What a report should contain

  • macOS version and chip (Apple menu > About This Mac).
  • MultihomingGuard version: shown in the app's menu right under the name ("Version 2.0.0 (79)").
  • Which network adapters are involved: built-in Wi-Fi, the Mac's Ethernet port, USB, Thunderbolt or dock adapters, iPhone over USB (vendor and model).
  • What you expected and what happened instead.
  • The output of Diagnostics in the app's menu: the button puts the background service's last decisions on the clipboard; paste the text into the report. Nothing is sent automatically.

Do not post passwords, Wi-Fi keys, internal host names or network addresses of your employer in issues. The diagnostics contain local adapter and DNS addresses; review the text before pasting.

Distribution and source code

MultihomingGuard is not distributed through the Mac App Store. It ships as a signed installer package (.pkg) notarized by Apple that you install yourself by double-click. The package installs the menu-bar app, the background service and launch at login; macOS asks for administrator rights once for that, as it does for any installer package. In day-to-day use the app never asks for a password. The software is released under the MIT licence; the source repository is currently not public.

MultihomingGuard requires macOS 13 Ventura or later. Only the latest version receives fixes.

How the app works

  • Two parts. A background service (LaunchDaemon with root privileges, because macOS only lets root switch network services) makes every decision. The menu-bar app only shows what the service decided; you can quit it at any time and the guard keeps running.
  • Cables are verified, not just detected. A wired connection counts as working only when link, a valid IPv4 or IPv6 address with a gateway are present and the wired network's DNS server answers over exactly that adapter. Until then Wi-Fi stays on ("verifying cable").
  • Service order. The service arranges the network service order so wired comes before Wi-Fi and flushes the DNS cache on every switch.
  • Event driven. The service reacts to macOS change notifications within under a second; there is no polling every few seconds.
  • "Wi-Fi off" means Wi-Fi without an address. The service sets the Wi-Fi service's IPv4 and IPv6 to "Off", so nothing travels over Wi-Fi any more. The Wi-Fi radio stays on, so unlocking with Apple Watch, AirDrop, Handoff, Sidecar and Universal Control keep working. The previous configuration is saved and restored when the cable goes away.
  • Manually disabled Wi-Fi is respected until you turn it back on or the cable situation changes.
  • iPhone over USB counts as a wired path. While a real LAN is active as well, the iPhone is parked so no mobile data is used – can be switched off under ⚙ in the menu.
  • Wi-Fi name. While Wi-Fi is active, the menu shows network name, band and channel. macOS requires the Location permission "while using the app" for the name; without it only the name is missing.
  • Offline is called offline. With no cable connected and no address on Wi-Fi, the menu reports "No connection" with its own orange symbol – not "Wi-Fi active". Its shape also differs from Wi-Fi you switched off yourself, so the menu bar can tell the two apart in a single colour.
  • A VPN is shown, not touched. While a VPN tunnel is up, the menu shows "VPN active" with the tunnel device – vendor-independent, recognised by a tunnel interface carrying a routable address. It changes nothing about the protection, and the tunnel itself is never modified.
  • Protect company DNS while a VPN is active (gear menu, on by default). A device on the cable – typically an iPhone – can announce its own name service, which macOS puts ahead of the company VPN's; internal addresses then cannot be resolved. The app proves it first: it asks for the name over the affected link and only steps in when the name really goes unanswered. It then switches off IPv6 of that one connection and restores it as soon as the VPN is disconnected.
  • Pause with an administrator login. The guard can be paused for a limited time: a hidden area (hold ⌥ while opening the menu), where macOS itself asks for an administrator's name and password. Every pause expires on its own and is logged. An administrator can stop the service in any case – the pause is the orderly way, not a hurdle.