IKEv2 · FortiGate SSL-VPN · macOS

Every gateway.
One menu bar.

Sluice connects your Mac to the networks you look after — the office, the data center, a client — at the same time. Each tunnel carries only its own networks and resolves its own names.

Download free trial See pricing

14 days free, no account. macOS 15 or later · Apple silicon and Intel · Notarized by Apple

Works with FortiGate IKEv2 FortiGate SSL-VPN Standard IKEv2 gateways EAP-MSCHAPv2 · PSK · certificates

Built for people who look after several networks

Not a VPN service. A client for the gateways you already run.

Several tunnels at once

The office, a data center and a client network, side by side. No limit on how many are up.

utun8 · Head office · 10.20.0.0/16 ppp0 · Data center · 172.18.0.0/20 utun9 · Client · 10.10.10.0/24

Split tunnel by the gateway

Only the networks the gateway announces go through the tunnel. Everything else stays on your own connection.

DNS that follows the tunnel

Company names go to company DNS; the rest to yours.

corp.example → 10.20.0.53 dc.example → 172.18.0.2 everything else → your network

IKEv2, your way

Pre-shared key or gateway certificate, custom phase 1 and 2 proposals, PFS, NAT traversal.

AES256-SHA256ECP384PFS 20EAP-MSCHAPv2

FortiGate SSL-VPN

User name and password, one-time passwords and realms. The gateway's certificate is pinned once you confirm it.

Stays connected

Reconnects after sleep and when a tunnel drops, notices a tunnel that stopped carrying traffic, and tells you why a connection failed — in plain words.

  1. Gateway stopped answering
  2. Reconnecting (1/3)…
  3. Connected again

How it works

Sluice is a small native app with a helper. The tunnels themselves are made by the same open-source engines that many gateways run.

  1. On your MacSluice appMenu bar and window. Keeps your profiles; passwords stay in the Keychain.
  2. Runs as rootHelperApproved once in System Settings. Starts and stops tunnels and applies DNS.
  3. Open sourceEnginesstrongSwan for IKEv2, openfortivpn for FortiGate SSL-VPN, built from published sources.
  4. Your networkGatewayFortiGate, VyOS or another IKEv2 gateway decides who connects and which networks they reach.

Routes and DNS from the gateway

When a tunnel comes up, Sluice reads what the gateway assigned: an address, the networks behind it, DNS servers and domains. Only those networks go through the tunnel, and only names in those domains go to its DNS. Add domains or servers in the profile when the gateway sends none.

Watching the tunnel

Sluice watches every tunnel and checks that IKEv2 tunnels still carry traffic. When a tunnel drops, the gateway stops answering or the Mac wakes from sleep, it reconnects — up to three attempts — and tells you what happened.

License without lock-in

Before a new tunnel starts, Sluice checks its license with our server. Tunnels that are up are never cut off, and a license keeps working for two weeks if the server cannot be reached.

Running in three minutes

  1. 01Download and openDrag Sluice to Applications. It lives in the menu bar.
  2. 02Allow the helperOne switch in System Settings lets the helper create tunnels.
  3. 03Add a profileGateway address and user name from your administrator. Flip the switch.

Your traffic never touches our servers

Sluice talks only to your gateways. Profiles stay on your Mac, passwords in its Keychain. No analytics, no logs of where you connect.

Proven open engines

Tunnels are built by strongSwan and openfortivpn, compiled from published sources with a pinned OpenSSL.

strongSwan 6.1.0openfortivpn 1.24.1OpenSSL 3.5.9
How the engines are built →

Try Sluice for 14 days

Everything works during the trial. Tunnels that are up are never cut off by the license.

Download for macOS Buy a license

Questions

Is Sluice a VPN service?
No. It is a client: it connects your Mac to VPN gateways your company or you already run. Your traffic goes to your gateways, never through our servers.
Which gateways does it work with?
FortiGate with IKEv2 or SSL-VPN, and IKEv2 gateways such as VyOS or strongSwan that use EAP-MSCHAPv2 with a pre-shared key or a gateway certificate.
Which sign-in methods are supported?
User name and password (EAP-MSCHAPv2 for IKEv2), one-time passwords and realms for SSL-VPN. Single sign-on (SAML) and client certificates are not supported yet.
Where are my passwords kept?
In your Mac's Keychain. Profiles are stored on your Mac; Sluice sends credentials only to your gateway.
Do I need administrator rights?
Only once, to allow Sluice's helper in System Settings. After that, connecting and disconnecting needs no password.
Can I use it next to other VPN clients?
Yes, as long as they do not route the same networks. Sluice's IKEv2 engine runs only while an IKEv2 tunnel is up, so it does not hold the IPsec ports when you are not using it.
Will Sluice support WireGuard or OpenVPN?
WireGuard is next on our list. OpenVPN we will add if enough people need it — tell us if you do. These are plans, not promises, and there are no fixed dates.
Which Macs are supported?
macOS 15 or later, on Apple silicon and Intel.
What happens when the trial ends?
New connections need a license. Your profiles stay, and nothing that is connected is cut off.
How do I get help?
See Support or write to support@sluicevpn.app.