How can I force all traffic for a single app through VPN / Proxy + Open Source? aka App Firewall?
I have looked into things like the built in app sandboxing via sandbox-exec which seems promising


sandbox-exec (deprecated, according to its man-page) is a utility of restriction framework with allow-deny semantics meaning it won't help you to change an app to bind a specific IP-address only (which later could be used together with Pf).

There's a similar post where it's been claimed to be solved with Network Kernel Extensions but source hasn't been shared.


  I just found TSocks which looks great


tsocks (even if was available) relies on LD_PRELOAD mechanism which isn't really bullet-proof because it's based on pre-loading of shared library which would further tamper libc calls. Of course, together with sandbox it could be more-or-less secured of leaks, but in general it's too much tinkering. Network Kernel Extensions look more promising, as to me.