Back to all guides

App rules

Set apps to Proxy, Direct, or Block

Create app rules so different apps use different proxies, connect directly, or have network access blocked.

A rule combines what application to match with how to handle its connections. Every Configuration has its own rules and default behavior.

01

The three actions

  1. 1

    Proxy

    Connections are sent to the selected proxy server. A Proxy action requires an existing proxy to be selected.

  2. 2

    Direct

    Traffic fully bypasses AntifyCore, so it does not appear in normal connection logs or statistics.

  3. 3

    Block

    Network connections from the matched app are blocked. No proxy server is required.

Antify Rules page showing Proxy, Direct, and Block app rules
02

Create an app rule

  1. 1

    Choose the app

    In Rules, click Add Rule, then drop a .app into the form or choose it with the file picker. Antify resolves its path and identifier.

  2. 2

    Choose an action

    Select Proxy, Direct, or Block. If you choose Proxy, select an upstream proxy server as well.

  3. 3

    Choose Configurations

    When multiple Configurations exist, a new rule can be added to one or more of them. The active one carries an Active label.

  4. 4

    Save and inspect

    Return to the list and confirm that Application, Action, and Proxy match your intent.

03

Block an app from the network

  1. 1

    Identify the app

    Choose the app in Add Rule and confirm the displayed name and path.

  2. 2

    Choose Block

    Set Action to Block. A Proxy Server is not needed.

  3. 3

    Reconnect to verify

    Save the rule, make sure Antify is running, then reopen the app or let it establish a new connection. Connections can show blocked flow records.

04

Which processes a rule covers

Components inside the app bundle are handled by that app rule. Other processes the app starts are not covered by default, which includes a terminal running curl and an IDE running its build tools.

The Apply to spawned processes switch in the rule form controls this. It is off by default and only applies to .app rules. Consider the scope before turning it on: if the rule targets a terminal or an IDE, everything it launches then follows this rule.

XPC services of an app are the exception. They always follow the rule of the app that hosts them, regardless of this switch.

05

Narrow a rule by host or port

Advanced Options provides Target Hosts and Target Ports. Hosts accept domain wildcards, IPs, IP ranges, and CIDR. Ports accept individual values and ranges.

Traffic that misses those filters is not automatically blocked; it follows the Configuration default. If an app uses encrypted DNS, Antify may see only IP addresses, so hostname filters may not match.