Install, connect and make Nthbe yours.

1. Choose and install a version

iPhone and iPad

1. Open the iPhone and iPad download page and install Nthbe from the App Store.
2. Open Nthbe, sign in or create an account, then select a server.
3. Tap Start and approve the Apple VPN configuration when prompted.

Mac

1. Download the signed DMG from the Mac download page, move Nthbe to Applications and open it.
2. When macOS requests approval, open System Settings, Privacy & Security and allow the Nthbe system extension.
3. Return to Nthbe, choose a server and start the tunnel. Restart the App only if macOS or Nthbe asks you to do so.

2. Connect and choose an outbound mode

Select a line before the first connection. The status area shows the friendly server name once the server catalog has loaded.

• Direct: send ordinary requests directly while local and Mesh route handling remains available.
• Global: send non-local requests through the selected proxy server.
• Rules: use domain, IP, GeoIP and app rules to choose direct, proxy or reject behavior.

Tap Start on iPhone or iPad, or use the Running control on Mac. The control remains available in the shared navigation area while you move between pages.

3. Servers, policy and local rules

The Servers page groups available lines by region and uses the display name and location image supplied by the service. Selecting a line updates the account selection used by the next tunnel start.

Policy changes the active outbound mode. Rules received from the managed service are applied by the system but remain hidden and read-only in the local editor. The Rules page is reserved for rules you create on the device.

On Mac, App Rules choose which apps use the tunnel: every app, only the apps you select, or every app except them. Apps that are not identified follow the normal rules, and Mesh and local destinations keep working.

4. Traffic, sessions and capture

Traffic shows current upload and download rate, active flows and tunnel traffic accumulated during the current VPN run. Session traffic is reset when a new tunnel session begins; it is not a billing quota.

Capture is a local diagnostic tool. Captured connection metadata and packet details remain on the device unless you explicitly export them. Stop capture when the needed sample is complete and review an export before sharing it.

5. Mac Terminal and local proxy listeners

Signing in only authenticates the account; traffic is handled after Nthbe shows Running. In TUN mode, IPv4 traffic from Terminal tools such as curl, Git and SSH enters Nthbe transparently. Choose Global to proxy non-local traffic, or Rules to follow the configured routing policy. Direct intentionally sends ordinary requests without the proxy server.

Use an explicit proxy in Terminal

The loopback HTTP and SOCKS listeners are separate from TUN and are off by default. Open Settings > Network, enable Keep local HTTP/SOCKS server while TUN is on, and confirm that the listener is active. Nthbe uses HTTP 127.0.0.1:19190 and SOCKS5 127.0.0.1:19191; the older 9090/9091 ports do not apply.

curl -x http://127.0.0.1:19190 https://api.ipify.org\ncurl --proxy socks5h://127.0.0.1:19191 https://api.ipify.org

Verify transparent TUN routing

Use an IPv4-only request while the status is Running:

curl -4 --noproxy '*' https://api.ipify.org

IPv6 default routing is not enabled in the current Mac release, so a command that prefers IPv6 may use the native network path. Use -4 when diagnosing the current release. Do not expose local listener ports to untrusted networks.

6. Private Mesh devices and subnet gateways

Enable Mesh on each device that should participate. A device receives a .nbmesh name and exchanges descriptors only with the authenticated account. Nthbe tries an authenticated LAN path, NAT traversal and then account relay fallback when necessary.

A remote network is not shared automatically. On Mac, enable subnet gateway mode for the specific LAN route you are authorized to publish. When two devices publish the same subnet, priority and primary or standby state determine the preferred gateway; the Mesh page reports conflicts and the active path.

To test safely, first connect to a service running on the peer itself by its .nbmesh name. Then test a specifically published subnet destination. Ping may be filtered even when TCP access works, so verify with the actual TCP or HTTP service.

Mesh can also run on its own: turn it on without starting the proxy tunnel to reach your devices while other traffic connects directly. When a relay is needed, Auto uses the first relay that works and moves to the next one if it stops answering; the Mesh page shows the relay in use.

7. iPhone and iPad widget

Add the Nthbe widget from the system widget gallery to view the current line, transfer rate and connection state. Interactive start and stop actions require a supported iOS version and an installed, signed Nthbe App. If an action is delayed, open Nthbe once so the app and Network Extension can reconcile state.

8. Plans, expiry and account purchase recovery

The remaining service time shown in Nthbe comes from the current authenticated user record. When entitlement expires, proxy and Mesh service stop and the App prompts for renewal.

Apple consumable purchases are credited to the Nthbe account and are not restored by the standard Apple Account password flow. If a completed purchase is missing, use Recover Account Purchases while signed in to the same Nthbe account. If recovery cannot verify it, submit the transaction identifier through the contact page.

9. Troubleshooting

• No Start or Running button: update to the latest version. Long account addresses should wrap without pushing the control off screen.
• No usable Mesh endpoint: confirm both peers are online, Mesh is enabled, the public service API is reachable and the destination route is explicitly published.
• Mac system extension does not start: check Privacy & Security for a pending approval, then quit and reopen Nthbe.
• A server name shows its internal code: refresh Servers once and confirm the server catalog request succeeds.
• Connection fails only on one network: try another line and include the device, app version, time and selected line in a support request.

10. Diagnostics, privacy and support

Use the App export command to collect the diagnostic log needed for a reproducible issue. Logs can include device, line, domain and connection metadata, so inspect the archive and never add passwords or private keys.

Read the Privacy Policy for data-handling details. Submit account, purchase, installation, connectivity or security questions through the private contact form.