Skip to content
ANON
Get Anon
Join Mobile Beta

Anon Network Guard

Your VPN.
Connected to Anon.

A small, local companion that links Anon in Chrome to your existing VPN app. Check its connection state, with optional auto-connect.

Get Network Guard Setup guideSOCKS5 RPC test

macOS 13+ · Apple silicon & Intel · Open source

A local link

AnonIn Chrome
Network GuardOn your Mac
Your VPNYour settings
Status and optional connection requests.
Your VPN provides the tunnel.

Get the companion

Start on your Mac.

Download Network Guard, then follow the setup steps below.

macOS

Download for Mac

Apple silicon (M-series) & Intel
macOS 13+

v0.1.4 · 656.9 KiB

Release notes & SHA-256

Open the ZIP, then open Anon Network Guard Setup.

Windows

Linux

Understand the scope

Know what
is protected.

Current protection: VPN readiness, not request blocking. The wallet can wait at its opening screen, but background requests may continue. Network Guard does not yet ensure the VPN is ready before every network request, and a connected report is not proof that this browser’s traffic uses the tunnel.

The separate development RPC proxy test can route supported node requests through SOCKS5. It does not extend VPN status checks into protection for all wallet traffic.

How it works & what to audit

A deliberately small tool

Chrome starts a short-lived native process for the wallet to exchange structured messages with. There is no listening HTTP server, always-running Guard daemon, telemetry or automatic updater. The native tool has no third-party package dependencies and needs no administrator privileges to install.

With auto-connect enabled, a new wallet visit triggers a fresh local check. Anon can request a connection using your VPN’s existing settings and wait before opening the wallet page. Your VPN provides the tunnel; Network Guard provides the local status and control link.

Narrow permissions, explicit actions

The VPN protocol reports the Guard version, checks supported VPN installations and reads their reported state. With separate consent, it can request the existing connection or open a supported provider app. It does not accept arbitrary commands, server addresses or wallet transactions. Provider paths, supported versions and signature checks are fixed in source.

VPN checks and RPC data have different scopes

The VPN protocol does not send wallet keys, account addresses, VPN credentials, IP addresses or raw provider logs to the wallet. These checks make no IP-discovery request and do not proxy wallet traffic. VPN apps manage their own networking; IVPN may refresh provider information during a status check.

When you enable the development RPC proxy, Guard handles RPC URLs, headers and request bodies in memory. They may contain account addresses, RPC API keys or signed transactions. The proxy transport does not log or persist these payloads and does not need seed phrases or private keys.

Bounded checks, not a privacy guarantee

VPN messages are capped at 4 KiB and operations have deadlines. Unknown or failed checks are not treated as a connected result. Each build enrolls one exact extension identity. This does not defend against an already-compromised process running as your macOS user. DNS leaks, split tunneling, browser proxies and traffic after a VPN drops are not verified or blocked here.

Review it yourself

Inspect the allowed operations, provider verification, installation permissions and failure-path tests. These links pin the earlier 0.1.1 build-4 source, not the current 0.1.4 download. Source access is not an independent security audit or proof that a downloaded binary matches that source.

Check download hashes & signing information →

GitHub is contacted only when you download an installer or follow a source link. Do not post wallet data, credentials or raw VPN logs in public issues.

Bring your own VPN

First, set up your VPN app.

Install and sign in with your provider. Network Guard uses the app you already have.

Status & connect

Mullvad

Check the app’s connection state and, with your consent, connect using its existing settings.

Mullvad 2026.4Mullvad download & setup

Limited validation

IVPN

An existing adapter with limited validation. Review the provider limits before enabling connection requests.

IVPN 3.15.15IVPN download & setup

Open app only

NordVPN

Open the supported website-distributed app. Connection status and automatic connection are not supported.

Website appNordVPN download & setup

Open app & status · Guard 0.1.3+

Proton VPN

Recent extension builds can open Proton and read its saved WireGuard connection state. Connect in Proton’s app; Anon does not automate its connection.

Proton VPN 6.5.1 · macOS WireGuardProton VPN download & setup

Newer versions may need a Network Guard update—don’t downgrade.

Proton requires a compatible extension and Guard 0.1.3 or later for status checks. Anon refreshes status when the wallet opens and, after Open Proton VPN, checks for up to a minute. The Open button disappears when a fresh check reports connected. A status report does not verify wallet routing. The signed 0.1.4 installer includes Proton support; install it, then verify Network Guard in Anon.

These links open the provider’s website using your current connection. No provider website or download is loaded until you click.

Set it up once

A few steps.
Then you’re linked.

No administrator password.
No second browser extension.

  1. Install Network Guard

    Open the downloaded ZIP, then open Anon Network Guard Setup and choose Install / Repair. It installs for your macOS user only—no administrator password and no second browser extension.

    What to know

    Installing does not connect your VPN, grant Chrome permissions, or give access to your wallet.

  2. Allow local access in Anon

    Open the extension’s connection settings, choose your provider, then select “Allow local access” and approve Chrome’s prompt. This permission lets Anon talk to the installed Network Guard.

    What to know

    Already allowed it? Reload the extension after installing or repairing Network Guard, then retry. Another permission prompt does not repair a missing Network Guard installation.

  3. Verify Network Guard

    Anon verifies Network Guard’s version and checks the selected VPN app. A disconnected provider and an unreachable Network Guard installation are different states.

    What to know

    Network Guard supports macOS 13+. Mullvad 2026.4 requires macOS 14+. Install and sign in to the official VPN app separately; Anon does not need your VPN credentials.

  4. Choose auto-connect separately

    Only turn on “Connect when Anon opens” if you want that behavior. Linking or verifying Network Guard never enables it.

    What to know

    Turning it off, unlinking, or closing Anon does not disconnect your VPN or undo a connection already requested.

Development test · off by default

RPC nodes through your SOCKS5 proxy.

Extension development builds and Network Guard 0.1.4 Development on macOS. The production helper does not enable this pilot. It is not a feature of the signed production download above.

  1. AnonRPC request
  2. Network GuardOn your Mac
  3. SOCKS5 proxyYour Tor or proxy listener
  4. RPC nodeReturns the result

Anon passes a supported HTTP JSON-RPC request to the local Guard app. Guard sends it through the SOCKS5 proxy you choose, including the node’s hostname for resolution. If your listener runs Tor, Tor carries that connection. Anon does not install or start Tor.

If the proxy fails, this transport does not retry the request directly. Anon may try another RPC node through the same proxy. Your other browser tabs keep their existing connection.

Try a read-only check first.

  1. Start your SOCKS5 listener separately. For a local Tor listener on port 9050, use 127.0.0.1:9050.
  2. In the development extension, open Settings → Connection privacy → RPC via SOCKS5. Enter the proxy’s numeric address and port.
  3. Enter an HTTP(S) RPC URL and choose Test RPC via proxy. This asks the node for its chain ID; it does not read balances, sign or submit a transaction, save the test URL, or enable routing.
  4. Choose Enable RPC proxy, then reopen the wallet. New supported RPC calls use the proxy. Requests already sent may complete.
  5. Choose Disable to return new RPC requests to your current connection. VPN settings and the RPC proxy are separate choices.
RPC testing, not wallet-wide leak protection.

Other wallet APIs, prices, relays, images, pairing, WebSockets, mobile and dApp-page traffic are outside this pilot. A successful check proves that request used the proxy; it does not prove Tor, VPN routing or anonymity. Use a test wallet.

Proxy requirements and current limits

SOCKS5 without proxy authentication; a numeric IPv4 or IPv6 proxy address. Entering localhost selects 127.0.0.1. RPC node hostnames, including .onion names, are sent to the proxy. Even a localhost RPC URL goes through it, so localhost means the proxy’s host.

HTTPS certificate verification stays enabled. HTTP does not add TLS encryption beyond the proxy; onion services have Tor’s own transport. Redirects and cookie-authenticated RPCs are not supported. Requests are limited to 64 KiB, replies to 256 KiB, batches to 100 calls, and native requests to 45 seconds. Exceeding a limit fails the request instead of switching to a direct connection.

A VPN-plus-Tor route depends on how your operating system, VPN and Tor are configured. Guard does not establish or verify that order. Automated checks used synthetic local proxies; a live Tor acceptance test and full wallet leak testing remain separate work.

Extension 0.9.11 notes →

A little help

Help with setup.

Do I need Guard for my own VPN or mobile pairing?

No. You can run your own VPN without Network Guard, and mobile pairing does not require it. Extension 0.9.11 fixes the pairing page getting stuck while waiting for a VPN check. See the release notes for rollout details.

Choose Proton VPN when that option is available for Guard’s app-opening and status features. Other / custom VPN remains a manual choice; it does not require a Guard status check.

The RPC proxy test cannot connect

Confirm that the SOCKS5 listener is running at the entered address and port, that the RPC URL accepts HTTP JSON-RPC, and that you installed Network Guard 0.1.4 Development or newer. The production installer does not support this test. Allow Chrome’s local-helper permission when prompted, then try again.

Testing does not enable the setting. If you already enabled it, a missing helper, revoked permission or failed proxy can stop supported RPC calls. Use the RPC panel’s Disable button only when you want new RPC calls to use your current connection. Unlinking a VPN is not the RPC proxy’s off switch.

Network Guard not found, outdated, or unreachable

Open Anon Network Guard Setup → Check installation. Use Install / Repair for the same macOS user and Chrome installation, reload Anon, and retry its local check.

If Chrome permission is missing or was revoked, allow local access in Anon. If permission is already allowed, repeating that prompt will not fix installation or communication errors.

Development and production installations use separate identities. Do not edit manifests or register another extension to work around a conflict. If Setup reports an existing registration conflict, leave it in place and request support.

Testing a development build? A checkout-based registration must be backed up and disabled before using the development installer. Installing does not update an older registration automatically. After switching, use Setup for helper updates; rebuilding the extension alone no longer updates the installed helper.

Share only the diagnostic code, Network Guard version, and installation check result with support—not wallet keys, account addresses, VPN login, or raw logs containing personal data.

Provider support & limits

Mullvad: the first validation target. Reads local status and can request the currently selected connection only after your consent. A Mullvad account and the official app are separate requirements.

IVPN: existing adapter retained with limited validation. Its daemon may refresh provider information during a status check; connecting the last profile may also enable IVPN’s firewall.

NordVPN: the existing adapter can open the supported website-distributed app. It does not verify connection status or automate connection.

Proton VPN: requires Guard 0.1.3+ for the saved macOS WireGuard status check. Connect in Proton’s own app; Anon can open it and refresh status, but cannot auto-connect or disconnect it. The supported app version is 6.5.1.

Anon does not pick VPN servers, handle your credentials, change DNS or split tunneling, or verify regional eligibility. Follow the terms and laws that apply to services you use.

Repair, update, or remove Network Guard

For a repair or update, use the verified setup app and choose Install / Repair. Existing settings and provider consent remain in Anon. Interrupted installs can be checked and repaired with the same app.

To remove access, choose Unlink in Anon. To remove local files, open Setup → Uninstall. It removes only its own installation and matching Chrome registration; it leaves your VPN app, wallet, and unrelated registrations alone.

Unlinking or uninstalling does not disconnect a VPN. Use the provider’s own app to manage that connection.

Open to review

A small tool.
Source you can inspect.

anondotinc/network-guard · Public source, protocol documentation and tests for your own review.