Installing a VPN on macOS takes about five minutes, and there are three ways to do it. The easiest is a provider app from the Mac App Store or the provider's website. macOS also has a built in VPN client in System Settings, and advanced users can run the official WireGuard app with a configuration file.
The one thing that trips up most Mac users is the permission prompts. macOS asks you to allow a VPN configuration and, for some apps, a system extension. This guide explains each prompt, walks through all three methods step by step, lists the settings worth changing, shows how to test for leaks, and covers the most common Mac VPN errors. The steps apply to macOS Ventura and every later version, including Sonoma, Sequoia and Tahoe, on both Apple silicon and Intel Macs.
Quick answer: how to install a VPN on a Mac
- Choose a VPN provider with a native Mac app, such as NordVPN, Proton VPN or Surfshark
- Download the app from the Mac App Store or the provider's official website
- Move it to Applications and open it, or let the installer do this for you
- Sign in with your VPN account
- Click Allow when macOS asks to add VPN configurations, and approve any system extension
- Turn on the kill switch and auto connect, then click Connect
Have not picked a provider yet? Our main best VPN ranking compares the top services, all of which have native apps for Apple silicon Macs.
Which installation method should you use?
Each method creates an encrypted tunnel, but they differ in effort and features. For almost everyone the provider app is the best choice.
| Method | Best for | Protocols | Kill switch | Server switching | Difficulty |
|---|---|---|---|---|---|
| Provider app | Almost everyone | WireGuard, NordLynx, Lightway, OpenVPN, IKEv2 | Yes, built in | One click | Easy |
| macOS built in client | Work VPNs and managed Macs | IKEv2, L2TP over IPSec, Cisco IPSec | No | New configuration per server | Medium |
| WireGuard app | Advanced users and self hosted servers | WireGuard | No dedicated switch, on demand rules only | Import one file per server | Medium |
The built in client makes sense when your employer or school gives you a server address and login, or when your Mac is managed and you cannot install apps. For privacy, streaming and travel, a dedicated app is faster and much safer.
Before you start
- An administrator account: approving a system extension or a VPN configuration needs your Mac login password, and some Macs managed by an employer block it entirely.
- macOS updates: open System Settings > General > Software Update and install pending updates. Apple regularly fixes networking bugs that affect VPNs.
- Your chip type: open the Apple menu > About This Mac. If it lists an M series chip, you have Apple silicon. All major apps run natively on it, but avoid old Intel only apps that rely on Rosetta.
- iCloud Private Relay: if you pay for iCloud+, Private Relay may be on. It can conflict with a VPN, so plan to turn it off (see the settings section).
- Old VPN apps: two VPN apps installing network extensions at once is a common cause of failed connections. Remove any you no longer use.
App Store version or direct download?
Many providers offer two Mac apps, and the difference matters more on macOS than on other systems. Apps from the Mac App Store run in Apple's sandbox, update automatically, and are reviewed by Apple. Versions downloaded from the provider's website are signed and notarised by Apple too, but they often have more features because they are not limited by sandbox rules.
| Feature | Mac App Store version | Website version |
|---|---|---|
| Installation | One click, no installer | DMG or PKG installer |
| Updates | Automatic through the App Store | Built in updater |
| Kill switch | Sometimes limited | Usually full system wide |
| Split tunnelling | Often missing | More often available |
| Protocol choice | Can be narrower | Usually all protocols |
| Payment | Through your Apple ID | Directly with the provider |
Our advice: choose the website version if you want every protection, and the App Store version if you prefer Apple billing and automatic updates. Never download a Mac VPN from a third party download site.
Method 1: install a VPN app on macOS (recommended)
This is the fastest way to get a VPN on a Mac. The app chooses the protocol, handles the network extension, and gives you a kill switch and thousands of servers in the menu bar.
Step 1: download the app
Search for your provider in the Mac App Store and click Get, or open the download page on the provider's website. If you download a DMG file, double click it and drag the app into the Applications folder. PKG installers walk you through the same step and ask for your Mac password.
Step 2: open the app and sign in
Launch the app from Launchpad or the Applications folder. The first time you open a downloaded app, macOS checks that it is notarised and may ask you to confirm you want to open it. Click Open, then sign in. Most providers open a browser window for login and send you back to the app.
Step 3: allow the VPN configuration
When you click Connect for the first time, macOS shows a prompt saying the app would like to add VPN configurations. Click Allow and enter your Mac password or use Touch ID. This permission is normal and required: every VPN on macOS uses Apple's Network Extension framework, and this prompt is how you approve it.
Step 4: approve the system extension (if asked)
Website versions of some apps also install a system extension, which powers features like the system wide kill switch. If you see a message that the extension was blocked, open System Settings > Privacy & Security, scroll down, and click Allow next to the message naming your VPN provider.
On macOS Sequoia and later you can review these later under System Settings > General > Login Items & Extensions, in the Network Extensions section. Make sure your VPN's switch is on there.
Step 5: change key settings and connect
Open the app settings, turn on the kill switch and launch at login, then click Quick connect or pick a country. When connected, a small VPN badge appears in the menu bar and in the Network section of System Settings.
Which app is best on a Mac? NordVPN has a polished native app with Meshnet and threat protection, covered in our NordVPN review. Proton VPN publishes open source Mac apps and has a free plan with no data cap, as explained in our Proton VPN review. Surfshark covers unlimited devices on one plan, which suits households with several Apple devices (see our Surfshark review).
Method 2: set up the built in macOS VPN client
macOS can connect to a VPN with no extra software. You add a VPN configuration with a server address and login, then switch it on from System Settings or the menu bar. Apple documents the process on its Set up a VPN connection on Mac support page.
Step 1: get the details from your provider
You need the server address, the VPN type, your manual setup username and password, and for L2TP a shared secret. Consumer providers list these in the account dashboard under manual setup. These credentials are usually different from your account email and password.
Step 2: add the VPN configuration
- Open the Apple menu > System Settings
- Click VPN in the sidebar (on some versions it sits under Network)
- Click Add VPN Configuration, or the three dots menu, and choose the VPN type, ideally IKEv2
- Type a Display name you will recognise, such as "Provider Germany"
- Enter the Server address and, for IKEv2, the Remote ID (often the same server hostname)
- Set User authentication to Username, then enter your username and password
- Click Create
Step 3: connect
Turn on the switch next to the new configuration. To control it faster, open System Settings > Control Center and set VPN to Show in Menu Bar. You can then connect with two clicks from the top of the screen.
Step 4: trust the IKEv2 certificate (if required)
Many providers sign IKEv2 servers with their own certificate authority. Download the root certificate, double click it to open Keychain Access, and add it to the System keychain. Then double click the certificate, expand Trust, and set IP Security (IPsec) to Always Trust. Without this, the connection fails with an authentication error.
Which VPN type to choose on macOS
| VPN type | Security | Speed | Use it? |
|---|---|---|---|
| IKEv2 | Strong | Fast, reconnects quickly when you switch networks | Yes, the best built in option |
| L2TP over IPSec | Acceptable with a strong shared secret | Moderate | Only if IKEv2 is not offered |
| Cisco IPSec | Depends on the server | Moderate | For older company networks only |
Apple removed the insecure PPTP protocol from macOS years ago, so you will not see it. The built in client has no kill switch and no split tunnelling by app, which is why we only recommend it for work connections.
Method 3: install WireGuard manually on a Mac
WireGuard is the fastest modern VPN protocol, and the official Mac app is free, small and runs natively on Apple silicon. It suits people with a self hosted server or a provider without a Mac app.
- Install WireGuard from the Mac App Store, which is the official distribution listed on the WireGuard install page.
- In your VPN account, generate a WireGuard configuration file for your chosen server. Proton VPN, Surfshark and many others offer this under manual setup.
- Open WireGuard from the menu bar and choose Import Tunnel(s) from File, then pick the .conf file.
- Click Allow when macOS asks to add VPN configurations.
- Select the tunnel and click Activate.
The Mac app does not have the kill switch checkbox found on Windows. Instead, click Edit and enable On Demand for WiFi and Ethernet, which reconnects the tunnel automatically. Delete the downloaded configuration file afterwards, as it contains your private key.
Settings to change after installing a VPN on macOS
- Kill switch: blocks traffic if the tunnel drops. Choose the system wide mode when the app offers one.
- Launch at login and auto connect: connects before Safari or Mail opens, and on untrusted WiFi automatically.
- Protocol: leave it on Automatic, or choose WireGuard (NordLynx on NordVPN, Lightway on ExpressVPN) for speed.
- iCloud Private Relay: turn it off under System Settings > your name > iCloud > Private Relay so it does not fight the VPN for Safari traffic. Apple explains what it does in its iCloud Private Relay overview.
- Limit IP address tracking: this per network option in WiFi settings also routes some traffic through Private Relay. Turn it off for networks where you use the VPN.
- Split tunnelling: exclude apps like AirPlay, local printers or your bank if they work better outside the tunnel.
- Threat protection: turn on ad and malware blocking if your provider includes it.
Need to reach your home server or let others connect to you? Our guide on VPN port forwarding explains when that feature matters and which providers still offer it.
How to check your VPN is working on a Mac
- IP check: search "what is my IP" before and after connecting. The address and location should match the VPN server.
- DNS leak test: run an extended test on a site such as dnsleaktest.com. Only your VPN provider's servers should appear.
- Kill switch test: while connected, turn WiFi off and on, or quit the VPN. Websites should stop loading until the tunnel reconnects.
- Network panel: open System Settings > VPN. Your provider should show as Connected, with no second VPN active.
Test in Safari and in any other browser you use. WebRTC in Chrome and Firefox can reveal your real IP, and most provider browser extensions block it.
Common macOS VPN problems and how to fix them
| Problem or message | Likely cause | Fix |
|---|---|---|
| App keeps asking to add VPN configurations | The configuration was denied or became corrupted | Delete the profile in System Settings > VPN, then reconnect in the app and click Allow |
| System extension blocked | Extension not approved | Allow it in Privacy & Security, then check Login Items & Extensions |
| User authentication failed | Wrong manual credentials | Use the manual setup username and password from your provider dashboard |
| The VPN server did not respond | Firewall or router blocks IKEv2 or L2TP | Switch to the provider app or allow UDP ports 500 and 4500 |
| Connected but no internet | DNS issue or a second VPN or Private Relay conflict | Turn off Private Relay, remove other VPN apps, change server |
| Slow speeds | Distant server or slow protocol | Pick a nearby server and use WireGuard |
If problems continue, restart the Mac, then flush DNS by opening Terminal and running sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder. As a last step, remove the VPN completely using the instructions below and reinstall it.
A streaming service blocking your server can look like a broken connection. Our guide to fixing the HBO Max VPN error covers that case.
How to remove a VPN from macOS
Dragging the app to the Trash does not always remove its network extension. Do it in this order:
- Disconnect and quit the VPN app, including its menu bar icon
- Use the provider's own Uninstall option if the app has one
- Delete the app from Applications
- Open System Settings > VPN, click the info button next to any leftover configuration and choose Remove Configuration
- Check General > Login Items & Extensions and remove leftover login items
Moving from a PC as well? Our guide on how to install a VPN on Windows 11 covers the same three methods for Windows.
Do Macs really need a VPN?
macOS is secure, but its protections work on your device, not on the network. A VPN encrypts your traffic on public WiFi in cafes, hotels and airports, hides your browsing from your internet provider, and gives you a stable home IP address when you travel. That last point is why it is so popular with people living abroad, as covered in our best VPN for expats guide.
A VPN does not replace good habits. Keep macOS updated, use strong unique passwords and turn on two factor authentication. The Electronic Frontier Foundation's guide to choosing a VPN is a neutral read on what a VPN can and cannot do.
FAQ
Does macOS have a free built in VPN?
macOS has a built in VPN client, not a VPN service. You still need a server from a provider or your employer. iCloud Private Relay is not a full VPN either: it only covers Safari and some unencrypted app traffic, and you cannot choose a country.
Is it safe to click Allow on the "add VPN configurations" prompt?
Yes, for a VPN you installed from the App Store or the provider's official website. Every VPN on a Mac must ask for this permission. If the prompt appears from an app you do not recognise, click Don't Allow and remove that app.
Do VPN apps work on Apple silicon Macs?
Yes. NordVPN, Proton VPN, Surfshark, ExpressVPN and WireGuard all run natively on M series chips.
Which protocol should I use on a Mac?
Use WireGuard or your provider's version of it in the app. In the built in client, choose IKEv2.
Can I use a VPN and iCloud Private Relay together?
It is best not to. Both try to route your traffic, which can cause slow pages, failed connections or traffic leaving outside the VPN. Turn Private Relay off while the VPN is on.
Why is my Mac VPN slow?
Usually because of a distant server or an older protocol like OpenVPN TCP. Connect to a nearby server, use WireGuard, and close other apps that use heavy bandwidth.
