Turnout

Turnout for Windows

The same VPN client for WireGuard servers, on Windows 11: your configs as wg-quick reads them, the network interface you choose for each tunnel, and tunnels that connect by themselves on a schedule or a Wi-Fi network. It lives in the notification area, and one license covers your Macs and PCs together.

Download for Windows

Version 1.1.4, released · Release notes

Windows 11 on an x64 PC (Intel or AMD) · 7-day trial · US$19 once, three computers, Mac or Windows

Turnout's window on Windows 11 with a connected tunnel: its path from the tunnel through the network adapter it leaves by to the server, with the traffic in both directions.
A connected tunnel's path: the tunnel, the network adapter its traffic leaves through, and the server.

As on the Mac

  • Your configs, as wg-quick reads them. Import WireGuard .conf files and zips of them, including the official app's exports, and export them again. The editor has a form and the text; comments and lines it does not know stay as you wrote them.
  • The network interface you choose. #@ BindInterface sends a tunnel's encrypted traffic out through the adapter you name, such as Ethernet 2, and #@ Route … dev sends chosen networks out through an adapter instead of the tunnel. The path at the top of each tunnel shows which adapter carries it.
  • Connects by itself. A schedule, or the Wi-Fi networks you list, connect a tunnel and disconnect it again; in between, what you do by hand stands.
  • Hooks. PreUp, PostUp, PreDown and PostDown run as on the Mac, once an administrator approves them.
  • Notifications, five languages and one license. The same notifications, menus and windows in English, 繁體中文, 日本語, Español and 한국어, and one license for three computers, Mac or Windows.

What differs

  • In the notification area. Turnout's icon opens a panel with every tunnel and its switch; the window has each tunnel's path, routes, peers and configuration, and the settings. Windows may keep a new icon behind ^ on the taskbar: drag it onto the taskbar, or turn Turnout on in Settings › Personalization › Taskbar › Other system tray icons, to keep it in sight.
  • Full tunnels stay inside. While a tunnel that takes all traffic is connected, Windows' firewall blocks traffic that would leave outside it, and DNS to servers other than the tunnel's, as the official WireGuard app does. Your bypass routes, the local network's essentials (DHCP, loopback) and the tunnel's own connection to the server are let through.
  • No Phantun yet. A config that reaches its server through Phantun is shown, but does not connect on Windows.
  • From the command line, in place of Shortcuts: Turnout.exe connect <tunnel>, disconnect <tunnel> and status [tunnel].
  • Windows 11 on x64 only. No Windows 10, no Windows on Arm and no Windows Server.
Turnout's panel above the notification area: every tunnel with its switch, the adapter a connected one leaves through and its traffic, and the Settings and Open Turnout buttons.
The panel that opens from Turnout's icon in the notification area.

Download and install

  1. Download the installer, Turnout-<version>-x64.msi, from the latest release.
  2. Open it. The installer is not signed with a Windows code-signing certificate, so Windows SmartScreen may say it protected your PC: choose More info, then Run anyway. Windows then asks for an administrator's approval.
  3. Turnout is installed in C:\Program Files\Turnout, its background service starts, and Turnout opens. Its welcome tour shows where its icon is.

On a PC with Smart App Control turned on, Windows does not let an installer without a code-signing certificate run at all. Updates do not depend on a certificate: each one carries Turnout's own signature, which the background service checks before it installs anything.

Updates

Turnout looks for a newer version at most once an hour while its panel or window is open, and whenever you choose Check for Updates…; the switch in General turns that off. Install and Relaunch downloads the installer and hands it to the background service, which checks its size, checksum and Turnout's signature and installs it with Windows Installer. Tunnels disconnect while it installs; the new version opens its window and reconnects the tunnels that were connected.

What it does to your PC

Turnout installs a background service that runs as SYSTEM, so here is what it is and what it changes, each with a way to check it.

cc.ctsite.turnout.daemon
The service, shown as Turnout in Services: C:\Program Files\Turnout\turnout-daemon.exe, started with Windows and restarted after a failure. The app, C:\Program Files\Turnout\App\Turnout.exe, runs as you, with no special privileges, and asks the service to connect and disconnect.
Wintun
Each connected tunnel is a Wintun network adapter named after it, from WireGuard's own driver, installed with Turnout. WireGuard runs in the service with GotaTun, Mullvad's implementation under the MPL-2.0 license.
Addresses, routes and DNS
Set through Windows' IP Helper functions: the tunnel's addresses, routes into the tunnel, the route that keeps the server on your physical network, and the routes that skip the tunnel. DNS servers are set on the tunnel's own adapter, so nothing else needs putting back.
Windows Filtering Platform
Only for a tunnel that takes all traffic, while it is connected: the rules above. They live in a session of the service's own, so they go away when the tunnel disconnects or the service stops.
%ProgramData%\cc.ctsite.turnout\tunnels
Your configs, private keys included, readable by SYSTEM and administrators only. Only the service writes there; saving a config whose hooks are new or changed needs an administrator's approval.
\\.\pipe\cc.ctsite.turnout.daemon
How the app talks to the service. It answers only this PC's users, never another computer.
%ProgramData%\cc.ctsite.turnout\logs\daemon.log
What the service did, and its errors. The app's own log is %LOCALAPPDATA%\Turnout\app.log.

Hooks run as SYSTEM through cmd.exe /C, with %i replaced by the tunnel's adapter and %I by the tunnel's name. Every change to routes is written down before it is made, so the service undoes at its next start what a crash left behind. To look for yourself, in PowerShell:

Get-Service cc.ctsite.turnout.daemon
Get-NetAdapter                      # a connected tunnel's Wintun adapter
Get-NetRoute -AddressFamily IPv4    # the routes it added
Get-DnsClientServerAddress          # the tunnel adapter's DNS servers

The license

The same key works on your Macs and PCs, three computers in all. Turnout works in full for 7 days on each PC first. Paste the key in License in Turnout's window; on Windows it is entered on each PC, since there is no iCloud to bring it over. The key is kept in Windows Credential Manager. License terms · Privacy on Windows

Uninstalling

Uninstall Turnout in Settings › Apps › Installed apps, or choose Uninstall Turnout… in About in Turnout's window, where you can also delete saved tunnels and free this PC on your license. Either way every tunnel disconnects, the service and the Wintun driver are removed, anything a crash left behind is undone, and the app, its logs and your Turnout preferences are deleted. Saved tunnels stay unless you choose to delete them; from the command line, msiexec /x with PURGE=1 deletes them too.