Where did the goat end up?
The exit check compares the address your chosen apps use with everyone else's. If they match, you'll see a warning, not a shrug.
Per-app VPN
Only the goats you pick go up the mountain.
Flip a switch next to an app and only that app uses the tunnel. Your banking app, your printer and Tuesday's Zoom call stay on the road they know, at full speed.
Browsers and Electron apps come with a flock of helper processes. Keçiyol herds the whole flock, so nothing strays out the side door.
Goats are famously picky eaters. Be picky about your apps.
Bypass DPI · no VPN server
Your ISP reads labels. Goats eat labels.
Filters that block sites by name read the hostname from the first message your app sends. Keçiyol sends that first message in pieces, so discord.com arrives as disc and ord.com and the filter never gets a match.
- Split TLS record
- Fragment the handshake
- Block QUIC, fall back to TCP
No subscription, no server, no slower ping. Your apps connect directly, like they always did, minus the bouncer.
Encrypted DNS
Ask for directions in a whisper.
Before an app connects, it asks where a site lives. Normally it asks out loud, and your ISP can answer with a fake address. Keçiyol sends the question sealed, over HTTPS, to Cloudflare, Google or Quad9, and fixes addresses the app already cached.
The ISP still hears something. It hears a goat chewing.
Bring your own VPN
It doesn't want your subscription. It wants your config file.
Keçiyol isn't a VPN company and doesn't run servers. Sign in with NordVPN or Mullvad, or drop in any WireGuard .conf or OpenVPN .ovpn from your provider or your own server.
- NordVPN
- Mullvad
- WireGuard
- OpenVPN
- Bypass DPI
It's a goat. Of course it eats paper.
Always on
Stubborn as a goat. On purpose.
If the tunnel drops, macOS rebuilds it. If a checked app needs the network while Keçiyol isn't even open, the tunnel starts on its own. Disconnect is the only thing that stops it.
The rest of the herd
Small app, careful details.
Secrets stay in the barn.
Access tokens, account numbers and VPN passwords live in the macOS Keychain. Removing a profile removes them too.
Lives in the menu bar.
No Dock icon, no window to manage. Drop a config file on the menu to import it.
Local stays local.
Your printer, your NAS and AirPlay keep working. Local network traffic never goes up the mountain.
Read before climbing
Goats are good climbers, not magicians.
Bypass DPI isn't a VPN. Sites still see your real IP address, and your traffic isn't encrypted any more than it already was.
It beats hostname filters, not IP blocks. If your ISP blocks a server's address outright, you need the VPN mode.
Every network is different. If one method stalls, try the other. Fragmenting the handshake adds a little delay to new connections.
The VPN modes need a VPN. Keçiyol connects to servers you already have, from a provider or your own.
Questions from the pasture
FAQ
How much does it cost?
$19.99, paid once. No subscription. You only pay a VPN provider if you use the VPN modes; Bypass DPI needs nothing else.
Why a goat?
In Turkish, keçi yolu is the shortcut goats find while everyone else sits in traffic. That's the whole app: a different path for the apps that need one, and the main road for everything else.
How do I say it?
ke-CHI-yol. The ç sounds like the "ch" in "cheese", which goats also enjoy.
Do I need a VPN subscription?
Only for the VPN modes. Use NordVPN, Mullvad, or any WireGuard or OpenVPN config. Bypass DPI needs no server or subscription.
Which Macs does it run on?
macOS 14 Sonoma or later, on Apple silicon and Intel. The exit check's tunnel side needs macOS 15.
Will my other apps slow down?
No. Apps you didn't check never touch the tunnel, so they keep your normal speed and address.
Pick a path.
$19.99once
One-time purchase. No subscription. Goats don't do monthly.
- Per-app VPN
- Bypass DPI
- Encrypted DNS
- Always on
- Exit check