Guide
How to set up a VPN on a Mac
Which of the two builds of the client to install, the approval macOS asks for before the tunnel can exist, the settings worth checking, and how to confirm the tunnel is carrying your traffic rather than sitting there looking connected. Written against macOS 27.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a download page.
Install the client from the provider’s own site or from the Mac App Store, never from a search result or a download portal. A VPN client installs a network extension that sees every byte the Mac sends; a repackaged installer is the single worst thing to give that position to.
Install the client
- Choose the build from the provider’s site, not the store, where both exist. The App Store build runs inside Apple’s sandbox, and the sandbox forbids some of what a VPN client is for: a kill switch that holds before you log in, split tunnelling by application. The direct download is usually the full client. Take the store build only when it is the only one offered.
- Sign in on the provider’s website first and download from the account area, so the file you run came from the session that proved you have a subscription.
- Open the installer and approve the extension when macOS asks. The system will say the client wants to add a network extension, or a VPN configuration, and send you to System Settings › General › Login Items & Extensions. Allow it. A client whose extension is not allowed opens, signs in, and never connects.
- Leave the background item on. The same settings page lists the client under Allow in the Background. Switching it off to tidy the list is how the tunnel stops reconnecting after sleep.
- Sign in to the client and name the device something that does not identify you; the name is stored by the provider.
- Do not connect yet. Open the settings first. Two of the three settings below are off by default in most clients.
The three settings worth checking
Client menus differ, the settings do not. Every one of the three has an entry in the glossary if the name is unfamiliar.
The kill switch
Blocks all traffic if the tunnel drops, instead of quietly letting the connection fall back to the ordinary network. It is usually off by default because it makes the product feel less reliable — a dropped tunnel becomes a dead connection rather than an unnoticed one, which is the entire point of it. Turn it on. If the client distinguishes a switch that applies only while connected from one that applies always, take the second: a Mac that wakes on strange Wi-Fi spends several seconds on the bare network before the client reconnects, and that is the gap that matters. What the switch is for is on its own page.
DNS inside the tunnel
Name lookups can leave the Mac outside the tunnel even when everything else is inside it, which tells your network which sites you visited and hides only what you did there. Look for DNS leak protection, use provider DNS or a custom DNS field, and set it to the provider’s own resolver rather than a third party’s. You are already trusting the provider with the traffic; a second party who sees only the lookups increases the number of parties without reducing what any of them knows. How a leak happens is on the DNS leaks page.
The protocol
Leave it on the modern default unless something is broken — the protocol page lists which are current and which are legacy. If the client offers an older option to fix a connection problem, that is a trade to make knowingly and then undo: the register marks the weakest protocol a provider still offers, and selecting it by hand is choosing that mark for yourself.
Confirm it is actually working
Connect, then check rather than assume. Three checks, in this order, all of them free and none of them requiring software:
- Your address changed. Open any “what is my IP” page and confirm the country matches the exit you chose. If it shows your own country while the client says connected, the extension is running and the traffic is not going through it.
- Lookups are inside the tunnel. Run a DNS leak test and read the resolvers it reports. Anything belonging to your internet provider means the DNS setting above did not take.
- The kill switch does what it says. With a download running, open Activity Monitor, find the client’s helper or daemon process — it carries the provider’s name — and force-quit it, so the tunnel drops without the client being asked. The transfer should stop dead. If it carries on, the switch is decorative.
The longer battery of tests, and what each one can and cannot show, is its own guide.
What those checks prove
+Your traffic is leaving through the exit server, in the country you selected
+The network you are sitting on can no longer read which sites you reach
+A dropped tunnel fails closed rather than quietly falling back
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: your browser and your logins are unchanged, see what a VPN does not protect you from
−A passing leak test today is not a promise about tomorrow’s client update
Sleep, wake, and strange Wi-Fi
A laptop is the device that opens on networks it has never seen, and a Mac does the dangerous part — joining the Wi-Fi, checking mail, syncing — in the first seconds after the lid lifts, before any client has reconnected. Two settings close that window. Auto-connect in the client, so the reconnection is the client’s job and not yours; and the always-on kill switch above, so that until it reconnects the Mac sends nothing. With both, a café network sees a laptop that joined and then went silent until the tunnel was up. What such a network can read otherwise is on the public Wi-Fi page.
If a client offers a list of trusted networks on which it stays off, keep the list short. Home is on it because the printer is there, not because the internet provider behind it is blind.
When it does not work
The client installs but never connects
Almost always the approval. Open System Settings > General > Login Items & Extensions and look under Network Extensions: the client has to be allowed there, and the prompt that asks is easy to dismiss by accident during installation.
If it is allowed and still nothing, remove the client with its own uninstaller, restart, and install again so the prompt appears a second time.
The tunnel is gone every time the Mac wakes from sleep
Expected behaviour without auto-connect: the network interface goes down with the lid and the client waits to be asked. Turn on the client's auto-connect, or connect-on-untrusted-network setting, and the reconnection happens before you have finished typing the password.
With the kill switch on, the seconds between waking and reconnecting are a dead connection rather than a leak. That is the switch working.
AirDrop, a printer or the TV stopped working while connected
Local traffic is going into the tunnel too, and the printer is not on the other side of it. Most clients have a setting called local network access, LAN access or split tunnelling; turning it on sends addresses on your own network outside the tunnel and leaves everything else inside.
It is safe on a network you run. On a network you do not, leave it off.
The App Store version is missing a setting the website version has
The two builds are different programs. The store build runs inside Apple's sandbox, and some things a VPN client does — a kill switch that holds at boot, split tunnelling by application — are not possible from inside it. The provider's own download is the fuller client.
If you already installed the store build and need the setting, uninstall it first; two builds side by side fight over the same network extension.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.