Wi-Fi off when you're wired. Back on when you're not.

A tiny native macOS menu-bar app that turns Wi-Fi off the moment a wired LAN link goes up, and back on when you unplug — edge-based, wake-aware, per-interface, and no admin rights needed by default (the optional Connection Protection installs a root helper — see below).

brew install --cask roypadina/tap/languard

Wired link goes up → indicator flips to LAN and Wi-Fi powers off · link goes down → back to Wi-Fi.

Why

Features

How LanGuard compares

Install

Usage

How it works

Is it safe?

FAQ

Uninstall

Reporting a bug

Contributing

Support

License

Why

macOS keeps Wi-Fi on even when you're docked over Ethernet — wasting an IP lease, adding a second default route, sometimes sending traffic out the wrong interface, and leaving an extra radio exposed. LanGuard switches Wi-Fi off the instant a wired link is active and switches it back on when the cable's gone. It only acts on plug/unplug transitions, so if you manually flip Wi-Fi back on while docked, it stays on until you next unplug.

🔌 Edge-based Acts only on wired plug/unplug transitions — your manual Wi-Fi changes are respected.

😴 Wake-aware A transition that happened while asleep is detected and corrected on wake.

🎛️ Per-interface Pick which wired adapters trigger and which Wi-Fi adapters are controlled.

🧪 Ignores virtual NICs Bridge / VPN / VM adapters (e.g. VMware vmnet) are off by default so they can't pin Wi-Fi off.

🤝 No-drop hand-over Plug in LAN: Wi-Fi stays on until the LAN reaches the internet and traffic has moved to it, then turns off.

⌨️ Switch to Wi-Fi Menu or a global shortcut (default ⌃⌥⌘L, record your own in Settings) before unplugging: Wi-Fi on, traffic moved to it with a live progress window, then — once the internet answers through it — a "safe to unplug LAN" popup (otherwise traffic stays on the LAN). Press it again while still plugged in to go back to LAN.

🔔 Notifications Each banner / popup can be switched on or off in Settings.

🧭 Configurable indicator Menu-bar shows LAN / Wi-Fi / Off — icon only, icon + label, or label only.

⏸️ Master switch Pause all automatic toggling from the menu.

🚀 Start at login Self-healing login item — re-registers if the app moves; prompts if macOS needs approval.

🔐 No admin by default Wi-Fi power via CoreWLAN, link state via SystemConfiguration, no network calls of its own. Only the optional Connection Protection installs a root helper (one admin prompt).

Menu-bar indicator (icon + label style):

Settings → Interfaces — pick which wired adapters trigger and which Wi-Fi adapters are controlled:

LanGuard BridgeChecker ToggleWifi

Price Free Paid (~$50) Free

Open source ✅ (MIT) ❌ ✅

Per-interface selection ✅ ✅ ❌

Edge-based (respects manual toggle) ✅ — —

Wake-from-sleep handling ✅ — not documented

No admin / sudo (core feature) ✅ — ❌ (needs admin)

Comparison based on each project's public docs at time of writing; verify current details on their sites. LanGuard is not notarized (ad-hoc signed) — see Is it safe?.

Requirements

macOS 14 Sonoma or later · Apple Silicon and Intel (universal binary)

brew install --cask roypadina/tap/languard

LanGuard is ad-hoc signed (not notarized). On first launch macOS blocks it: open System Settings → Privacy & Security, scroll down and click Open Anyway (right-click → Open no longer works on macOS 15+). Or clear the quarantine flag once:

xattr -dr com.apple.quarantine "/Applications/LanGuard.app"

See Is it safe? for why.

git clone https://github.com/roypadina/LanGuard.git cd LanGuard xcodebuild -workspace LanGuard.xcworkspace -scheme LanGuard -configuration Release build cp -R ~/Library/Developer/Xcode/DerivedData/LanGuard-*/Build/Products/Release/LanGuard.app /Applications/ open /Applications/LanGuard.app

The app lives in the menu bar (no Dock icon). On first launch, click Allow on the notification prompt if you want toggle banners.

Click the menu-bar icon for status, the Auto-toggle master switch, and Settings….

wired link UP ─▶ Wi-Fi OFF wired link DOWN ─▶ Wi-Fi ON (no edge) ─▶ leave Wi-Fi alone ← respects manual override

Component Role

NetworkMonitor SCDynamicStore link/IP callbacks + NSWorkspace wake notification

WiFiController CoreWLAN power on/off (no sudo)

ToggleEngine Edge state machine — dependency-injected, fully unit-tested

InterfaceCatalog Enumerate + classify Ethernet/Wi-Fi; flag virtual adapters

LoginItem SMAppService login item (self-healing)

Notifier UNUserNotificationCenter banners

See the Wiki for deeper docs, CHANGELOG.md for release history, and CLAUDE.md for the full component map.

Optional (Settings → Connection protection, off by default). LanGuard keeps a stable address that moves between LAN and Wi-Fi, so connections (agents, VPNs, downloads) survive plugging/unplugging the cable. It only applies on networks where LAN and Wi-Fi share a router. Everything it changes is one extra address plus two routes (0.0.0.0/1, 128.0.0.0/1), and copies of those two routes limited to the other connection (so apps bound to it, e.g. Tailscale, keep working) — nothing persistent; a reboot clears it. A root guardian checks every ~3 s and removes everything when the network looks wrong. When an update changes the helper, the status reads "helper update needed": click Settings → Connection protection → Update helper…. Limits: IPv4 only; needs DHCP on both LAN and Wi-Fi; don't combine with a full-tunnel VPN ("send all traffic", e.g. OpenVPN redirect-gateway) — split-tunnel VPNs (Pritunl profiles with routes, Tailscale) work. Pulling a whole dock removes its network adapter: VPN clients tied to it (e.g. Pritunl/OpenVPN) may drop and need a manual reconnect; Claude Code, browsers and most apps carry on. The first unplug on a new network is not protected yet: a network is learned once LAN and Wi-Fi are seen on the same router (or tick "Protect this network").

Panic — restore normal networking, from easiest:

for n in 0.0.0.0/1 128.0.0.0/1; do i=$(route -n get -net $n 2>/dev/null | awk '$1=="interface:"{print $2}'); case $i in en[0-9]) route -q -n delete -net $n;; esac; done; for i in $(ifconfig -l | tr ' ' '\n' | grep -E '^en[0-9]+$'); do p=$(ipconfig getifaddr $i); ifconfig $i | awk '/inet . netmask 0xffffffff/{print $2}' | while read a; do [ "$a" != "$p" ] && ifconfig $i inet $a -alias; done; done; rm -f /var/run/languard-net.state; touch /var/run/languard-net.panic

Reboot.

Re-enable afterwards from the menu (Re-enable connection protection).

Quitting LanGuard does not turn protection off (so a quit, update or relaunch doesn't cut your connections): the guardian keeps watching and the next launch takes over. While LanGuard is quit, an unplug can't move the address, so the guardian removes it within seconds — connections on it drop and networking falls back to normal. To turn protection off, use the Settings switch or panic.

Fair question — it toggles your network and launches at login. Here's the honest picture:

Wi-Fi turned back on by itself while I was docked — bug? No. LanGuard is edge-based: it acts only at the moment you plug/unplug. If you (or another app) turn Wi-Fi on while wired, LanGuard respects that until your next unplug/replug.

I'm docked but Wi-Fi stayed on. Either you turned it on manually since plugging in (see above), or that wired adapter isn't selected as a trigger in Settings (virtual adapters are off by default).

Does it work with USB-C / Thunderbolt docks and USB-Ethernet adapters? Yes — any adapter macOS reports as an Ethernet interface. You choose which ones count.

Why is my VPN / VM adapter ignored? Virtual adapters (VPN tunnels, VMware/Parallels vmnet, bridges) are off by default so they can't be mistaken for a real wired link. You can opt any of them in under Settings.

Does it need admin rights? Not for the core feature: Wi-Fi power goes through CoreWLAN and link state through SystemConfiguration, both as your normal user. Only the optional connection protection installs a root helper (one admin prompt).

macOS says it "can't verify the developer." It's not notarized yet — click Open Anyway in System Settings → Privacy & Security, or run the xattr command in Install. See Is it safe?.

brew uninstall --cask languard # if installed via Homebrew

or just drag /Applications/LanGuard.app to the Trash

defaults delete com.roy.languard # forget all settings (optional)

Also remove it under System Settings → General → Login Items if it's still listed.

Hit something odd (Wi-Fi toggling when it shouldn't, etc.)? Turn on Settings → Debug → Enable debug logging, reproduce it, then click Reveal Logs in Finder and attach ~/Library/Logs/LanGuard/languard.log to your issue. The log stays on your Mac and contains only interface names + toggle decisions (no personal data).

PRs welcome! main is protected — fork, branch, add tests, and open a PR. Good first issues are labeled here. See CONTRIBUTING.md and the Code of Conduct.

cd LanGuardPackage && swift test # pure logic, no hardware needed

Feature requests and contributions

Have an idea for LanGuard? Request a feature and say what you're trying to do; that matters more than the exact feature. Found a bug? Report it.

Tipped on Ko-fi? Add your Ko-fi name to the request and it goes to the front of my queue. It's a thank-you, not a purchase: no promise on what ships or when.

Free, open-source Mac menu-bar apps and terminal tools, all on one site: apps.roypadina.synology.me.

If LanGuard keeps your Wi-Fi and wired connection from fighting each other, you can support its development — it's optional and always appreciated.