Your network.
Your control.

VayuSetu is a VPN client, encrypted-DNS app and Safari ad blocker for iPhone and Mac. It does not sell VPN service and runs no servers of its own. You bring a WireGuard or IKEv2 server, choose the encrypted DNS resolver you trust, and VayuSetu combines those protections with evidence-based status.

• No accounts, analytics or tracking. Profiles, keys and settings stay on your device; credentials use the system Keychain.
• VPN, encrypted DNS and Safari ad blocking can run alone or together.
• A green state requires observed evidence; the app explains what each check saw and what it cannot prove.

The current public release is VayuSetu for Mac 1.0 build 17: a Developer ID signed, notarized DMG for macOS 14 or later on Apple silicon or Intel. The iPhone app is submitted to App Review and its release path is waiting on Apple’s organization-account requirement for VPN apps.

1. Open the DMG and drag VayuSetu into Applications.
2. Approve the network extensions in System Settings when macOS asks.
3. Enable the chosen VayuSetu Safari extensions in Safari Settings → Extensions.
4. Add a VPN profile, DNS resolver, or both, then press the power button.

The release page includes a SHA-256 checksum. Verify the DMG with shasum -a 256 before opening it.

Home combines VPN, DNS and Adblock. Choose VPN + DNS, VPN only, DNS only or Adblock only. The home screen also shows the session timer, live upload and download speed, and a seven-day chart of DNS requests handled and blocked.

• VPN tunnels traffic through your own WireGuard or IKEv2 server.
• DNS uses an encrypted resolver and can filter lookups.
• Adblock feeds six Safari content blockers split into Ads, Privacy, Security, Social, Annoyances and Custom.

Import a WireGuard file, pasted configuration or QR code on iPhone; configure WireGuard manually; or add an IKEv2/IPsec server through Apple’s native adapter. Several profiles can be kept, with an optional backup profile. OpenVPN is not supported.

• DNS-over-HTTPS and DNS-over-TLS upstreams, a short cache, CNAME-chain checks and a fallback resolver.
• Light, Balanced and Strict filtering modes cover ads, trackers, fingerprinting, telemetry, scams, ransomware, malicious sites, mining scripts, social buttons and cookie banners.
• Preset lists include HaGeZi, OISD, AdGuard DNS filter, StevenBlack, Dan Pollock and EasyList. Custom URLs, imported files and custom allow/block rules are supported.
• An allow rule always beats a block rule, so Website Exceptions can turn filtering off for a whole site.

Run Available Checks reports tunnel health, recent WireGuard handshakes, public IPv4 and IPv6, DNS reachability, resolution through the selected resolver and a known blocked-domain check. It says what was observed and what an app cannot prove, such as the absence of leaks from another app. Speed, connection-quality and traffic views are available.

Privacy Lock supports strict routing, connect on demand, automatic reconnect and an optional dual-stack requirement. It is not an absolute kill switch because Apple keeps system exceptions.

The Mac Network page is a Little Snitch-like connection decision surface implemented as a separate macOS content-filter system extension. It sees the app, signer, parent process, destination, port and protocol, but does not read traffic contents.

• Ask me pauses a new connection and shows a card with Block, Allow, scope and duration.
• Passive mode never asks; your rules and lists still apply.
• Block all allows only rules and allow lists.
• Rules can target apps, domains, wildcards, exact addresses, CIDR blocks, ports and direction; groups can be switched, scheduled or expired.
• A map groups recent connections by app or country. Country positions are estimates from an embedded database; map tiles come from Apple Maps.
• Traffic charts are off by default because counting bytes can slow heavy transfers.

The same lists feed six Safari content blockers. The Mac menu bar exposes VPN, encrypted DNS, Adblock and network-filter status. Mac URL actions include vayusetu://protection/dns/on, vayusetu://network/profile/Work and vayusetu://network/mode/passive. iPhone Shortcuts and Siri can switch DNS-only, VPN and ad blocking.

Dynamic Island notifications, widgets and Control Center controls are iPhone features. The Mac app uses the URL actions instead.

VayuSetu has no accounts, analytics, tracking or servers. It contacts only services needed by your selected configuration or an action you request: your VPN server, chosen DNS resolver, enabled filter-list sources, a public-IP check, Cloudflare speed-test servers, optional RIPEstat ownership lookup and the adblock test hosts.

• Credentials live in the Keychain. Logs and traffic history are optional, local and clearable.
• Backups are encrypted with a password you choose.
• DNS-only mode and ad blocking work without a VPN server.
• Safari content blockers work only in Safari; DNS filtering covers other apps that use system DNS.

• It is not a VPN provider; you need your own server for the VPN part.
• A running tunnel is evidence, not proof. Another VPN, filter or app that ignores system DNS can change the result.
• The Mac network filter is not a packet inspector and has not been validated against every heavy real-world traffic pattern.
• OpenVPN is not supported. Certificate-based IKEv2 is not available on Mac.
• Country locations are estimates. Recent DNS lookups cannot identify the requesting app.
• VayuSetu has not received an independent security audit, and every network transition has not yet been validated.

The Mac and iPhone apps share the store, tunnel controller, profile and DNS code, filter engine and checks while keeping platform-specific screens and packet-tunnel extensions. WireGuard uses the official WireGuard Apple adapter and wireguard-go; IKEv2 uses Apple’s native adapter.

The DNS runtime runs inside the tunnel, speaks DNS-over-HTTPS or DNS-over-TLS, caches briefly, checks CNAME chains and can fall back to another encrypted resolver. Enabled lists compile into a compact snapshot used by the tunnel and six Safari extensions. The Mac filter uses NEFilterDataProvider and a private XPC connection restricted to VayuSetu by code-signature checks.

The source is published for review but is proprietary. VayuSetu includes WireGuard Apple adapter and wireguard-go under their own licenses, the Public Suffix List and filter lists credited in the app. The repository contains iOS, macOS, shared core, extensions and architecture/security documentation.