With a VPN on macOS, the hard part usually isn't clicking Connect — it's the permissions and configuration that come before it. macOS keeps VPN configurations in the system's network layer, and the client has to go through a network extension to take over traffic, so the system asks for permission separately from the app. Decline that prompt and you get results that look like magic: the app says connected, but no web page will load.
The first connection takes four steps: download the client → grant system permissions → import your subscription → verify it works. Each step comes with checkpoints you can compare against, and with the next action to take if it fails.
Three things to check before you install
Desktop systems are not the same as mobile. A Mac client really does rewrite the routing table and DNS resolution, so two minutes of preparation can save you half an hour of troubleshooting later.
- ✅ Your subscription link is at hand: the full string you can paste into a text editor, not just a screenshot.
- ✅ Your system is reasonably current, and System Settings has a Privacy & Security section.
- ✅ Quit any other proxy or VPN client that is running first, so two programs aren't rewriting the routing table at once.
- ❌ Don't post your subscription link in a group chat or a public clipboard — it works like account credentials.
- ❌ Don't change DNS while connected. Disconnect first, or the change may not take effect.
One more thing that's easy to miss: don't run two programs that take over networking on the same Mac. The old client never quit, the new one opens another tunnel, and the two default routes overwrite each other. The result is a connection that comes and goes, with a different outcome on every reconnect.
Before switching clients, go to System Settings → Network and delete the VPN configuration the old client left behind. If the old configuration stays, the new client can inherit the same tunnel parameters, and you'll be debugging two variables at once.
Step 1: Download and install the client
Download the macOS installer from your provider's dashboard or website — usually a disk image. Double-click to mount it, drag the app icon into the Applications folder, then eject the mounted image from the Finder sidebar. If you run the app straight from the image, it can be hard to find after a restart.
- Download: sign in, choose the macOS build on the download page, and pick the right package for Apple silicon or Intel.
- Install: double-click to mount, drag the app into Applications, then eject the disk image.
- First launch: if the system says it can't verify the developer, open System Settings → Privacy & Security, click Open Anyway at the bottom of the page, and confirm once more.
- Sign in: use your username and password. This service does not require an email address to sign up, and those two credentials are all you have — use the dashboard to recover them if you lose them.
Get the installer from official channels only. With a repackaged build from a third-party download site, you can't tell what was added to the install script — and a VPN client gets the highest level of network-layer access there is.
Step 2: Grant system permissions
The first time you click Connect, macOS shows a system-level dialog saying an app wants to add a VPN configuration. This isn't the app's own pop-up — it's the system's authorization request. You have to click Allow and enter your login password or use Touch ID before the configuration is actually written.
If the client uses a network extension, a pending extension also appears under System Settings → General → Login Items & Extensions. The wording differs slightly between macOS versions, but it always sits near the Privacy & Security section of System Settings. After you approve it, you usually need to restart the client once before the extension loads.
After you click Don't Allow, clicking Connect again won't bring the prompt back — macOS remembers the refusal. The fix: go to System Settings → Network, delete the leftover VPN configuration, quit the client, open it again and click Connect so the system issues a fresh authorization request.
A Mac managed by a company or school may be restricted by a configuration profile that prevents users from adding VPN configurations. In that case the client will sit at the authorization step forever, and reinstalling won't help — an administrator has to allow it on the management side.
Step 3: Import your subscription and pick a route
Once permission is granted, go back to the client. Subscriptions are usually imported in one of two ways: paste the subscription link, or scan a QR code. On desktop the first is more common — paste the whole link from the dashboard into the field and the client fetches the route list itself. Don't leave spaces or line breaks in the middle of the link; a partial paste fails to parse immediately, and that error has nothing to do with the routes.
After a successful import, the client lists the available routes. This service offers 100+ countries / 180+ routes; pick in this order:
- Nearest first: a relay or direct route that's physically close usually has lower round-trip latency, so pages and video respond more snappily.
- Then by purpose: for remote work and long downloads where stability matters, prefer IEPL dedicated lines; for a quick lookup, a direct route is enough.
- Then by destination: pick an exit in the region where the service you're reaching lives, so traffic doesn't go halfway around the world and back.
- 100+ Countries and regions covered
- 180+ Available routes
- Unlimited devices Online at once on one account
- 60 days No-questions-asked refund
As for protocols, the two options you'll usually see in the client are WireGuard and OpenVPN. WireGuard has a light handshake and low overhead, so make it your default; OpenVPN is more compatible, and when the network you're on restricts UDP and nothing connects, switching to OpenVPN's TCP mode often gets through, at a small cost in speed. The protocol doesn't decide whether a service works — it only decides whether the tunnel gets established.
The routing mode decides which traffic goes through the tunnel. Rule mode splits by domain and IP — local sites go direct, international sites use the route — and it's the least fussy option day to day. Global mode pushes everything into the tunnel and is handy for one-off debugging. Direct mode is effectively proxy off, client still running. Start with rule mode, and if a site is misjudged, add it to your custom rules.
Step 4: Check that it actually works
Connected in the client only means the tunnel is up — not that traffic is really going through it. A minute spent on the checks below beats suspecting your network afterwards.
| Check | How to look | What good looks like |
|---|---|---|
| Exit address | Open any IP lookup page in a browser | The region shown matches the route you picked |
| DNS resolution | Check the resolver currently in effect in Terminal | Not the default set from your local ISP |
| Default route | Check which interface the default route points to in Terminal | A virtual interface starting with utun |
| Routing rules | Open a local site and an international site at the same time | The local site isn't detoured; the international site uses the chosen route |
Copy the two lines below into Terminal and run them — if the output matches, traffic is being captured:
# DNS resolver currently in effect
scutil --dns | grep 'nameserver\[0\]'
# Which network interface the default route points to
route -n get default | grep interfaceThe troubleshooting order for common problems
The table below covers the problems you're most likely to hit on macOS. Match the symptom first, then work through the fixes in order — don't start by reinstalling.
| Symptom | Likely cause | Fix |
|---|---|---|
| Says connected, but pages won't load | DNS isn't handled by the tunnel, or the MTU is too high | Turn on DNS resolution inside the tunnel; lower the MTU one step and try again |
| The client spins forever and won't connect | The current network restricts UDP | Switch to OpenVPN's TCP mode, or try another route |
| You have to reconnect manually after waking from sleep | On-demand connection is off | Turn on on-demand connection and launch at login in the client |
| The VPN entry in System Settings won't delete | Leftover configuration; the extension hasn't exited | Quit the client, restart the system, then delete it |
| Speed drops noticeably after connecting | The route takes a detour | Switch to a nearby relay or direct route |
| "Adding a VPN configuration is not allowed" | Authorization was denied earlier, or the device is managed | Clear the leftover configuration and retry; on a managed device, contact your administrator |
It pays to fix the troubleshooting order and always start with the cheapest action:
- Disconnect and reconnect: clears the leftover session from last time and fixes most one-off failures.
- Try another route: switch to a relay or direct route in the same region to tell a route problem from a local network problem.
- Change protocol or port: when UDP is restricted, switch to OpenVPN's TCP mode.
- Check DNS and routing: use the commands from the previous section to confirm the tunnel really is carrying your traffic.
- Restart the client, then the system: when a network extension is stuck, only a restart clears it.
- Reinstall last: and delete the old configuration in System Settings first, or the fresh install inherits the old state.
A few settings that make the connection steadier
On-demand connection and launch at login
On-demand connection in the client reconnects automatically when it detects a network change, so waking from sleep or switching from Wi-Fi to Ethernet won't drop you. Once it's on, you don't have to click Connect every time. Turn on launch at login as well, especially if this is your default exit.
Keep the system clock accurate
Subscription fetches and node information both travel over encrypted connections, so a large clock skew makes certificate validation fail — the client reports an authentication error while the route itself is fine. Just turn on automatic time in System Settings → General → Date & Time.
Background limits in Low Power Mode
Low Power Mode restricts background network activity, so a long-running connection can drop intermittently. If you need a stable long connection, turn it off for a while and see whether the drops stop.
Custom routing rules
Addresses like your company intranet, LAN devices and local printers should go direct. Put them in the direct rules — that avoids a detour and avoids intranet services failing to resolve inside the tunnel. That's the value of rule mode: not all traffic needs to take the long way round.
Moving to a new Mac or uninstalling: clean up the configuration
Don't migrate the old configuration files when you move to a new Mac. VPN configurations on the old machine carry a device identifier, so a migrated setup often won't connect and leaves greyed-out entries in System Settings that you can't delete. The right way: install the client fresh on the new machine and import the subscription again.
- Sign out in the client and disconnect the current connection.
- Open System Settings → Network, select the VPN configuration the client created, and click the minus button to delete it.
- Quit the client and drag the app from Applications to the Trash.
- Restart the system once and confirm no leftover entries remain in Network settings.
If you're only switching routes rather than uninstalling, you don't need to delete the configuration. Change the route in the client and the system-level tunnel is rebuilt along with it, in a few seconds.