How to Set Up a VPN on a Mac (macOS)

To set up a VPN on a Mac, install the provider's macOS app, approve the VPN configuration when macOS asks, then sign in and connect. The one part that's specific to macOS is that first-time permission prompt — this guide shows exactly what it looks like so you approve the right thing, then covers the settings and a quick check.

Install the app

Start with the app, which is the right route on both Apple silicon and Intel Macs. You have two clean sources:

1. The Mac App Store — search the provider's name and install. App Store apps are sandboxed and update automatically.
2. A signed download from the provider's own website — open the .dmg and drag the app into your Applications folder. This version sometimes has more features than the App Store build.

Either way, create your account first on the provider's site and note the login. Open the app once it's installed and sign in.

Approve the VPN configuration prompt

The first time you press Connect, macOS shows a dialog reading something like 'App would like to add VPN configurations'. Click Allow, and enter your Mac password or use Touch ID when prompted. This is macOS asking permission to add the VPN to the system network settings — it is required and completely normal. Without approving it, the app cannot route your traffic.

Some apps also install a system extension for their fastest protocol. If you see a note that a system extension was blocked, open System Settings, go to General then Login Items & Extensions (or Privacy & Security on older macOS), and allow the provider's extension. Then connect again. Once approved, you won't be asked a second time.

Turn on the settings that matter

With the app connected, open its preferences and enable the kill switch and auto-connect on untrusted Wi-Fi. The kill switch stops traffic if the tunnel drops; auto-connect means you never forget to turn it on in a café. Leave the protocol on automatic unless you want to choose — WireGuard is a good default. We cover each first-run option in first-time VPN settings.

You can also let the app add itself to Login Items so it starts with your Mac and connects on launch. The menu-bar icon then shows your status at a glance — a solid colour when connected, faded when not.

Confirm the connection

Verify the setup before you rely on it. Connected, search 'what is my IP' in Safari or your browser: the location shown should be the server's, not your city. Run a DNS leak test and check the reported servers belong to the VPN. If your real IP still shows, the app is connected but not carrying traffic — quit and reopen it, then re-test. Note that Apple's iCloud Private Relay is not a VPN and only affects Safari; if you use it, that's separate from the VPN you just set up.

Manual setup on macOS

If you need a manual connection — a work VPN or a provider without a Mac app — go to System Settings, Network, add a VPN interface, and enter the server and account details you were given. As on other systems, a manual profile has no kill switch of its own, so prefer the app for privacy use. The overall approach mirrors every platform: see how to set up a VPN for the full picture, or the Windows walkthrough if you also set up a PC.

Let it launch at login

A VPN only protects you while it's running, so set it to start with your Mac. In the app's preferences, enable 'launch at login' and 'connect on launch', then add auto-connect for untrusted Wi-Fi. macOS may ask you to confirm the app as a login item the first time — allow it. From then on the tunnel is up before you open Safari, and it reconnects after your Mac wakes from sleep, which is when connections most often lapse.

The menu-bar icon is your at-a-glance status: solid when connected, faded or marked when not. Get in the habit of glancing at it before doing anything you'd want protected, the same way you'd check a door is locked.

Apple silicon, permissions and speed

On modern Apple silicon Macs, VPN apps run natively and are efficient on battery, so leaving the VPN on all day is realistic. If the app was written for Intel Macs only, macOS runs it through Rosetta automatically, which still works but may be slightly less efficient — prefer a version the provider has updated for Apple silicon where one exists.

If the VPN feels slow on a Mac, the fixes are the familiar ones: choose a nearer, less-loaded server and switch the protocol to WireGuard if it's offered. If a system extension for the fastest protocol was never approved, the app may quietly fall back to a slower method, so it's worth confirming in System Settings that the provider's extension is allowed. That single check often explains a Mac VPN that connects fine but feels sluggish.

Bottom line

Setting up a VPN on a Mac is the standard four steps with one macOS-specific moment: approving the VPN configuration prompt, and, for the fastest protocol, allowing the app's system extension. Do those, turn on the kill switch and auto-connect, and set it to launch at login. After a major macOS upgrade, it's worth re-opening the app and reconnecting once, since a big system update can occasionally reset the extension approval and you'll want to re-allow it. Confirm the setup with the IP and DNS checks rather than trusting the menu-bar icon alone. And keep in mind that iCloud Private Relay is not a VPN — if you rely on it for Safari, your VPN app is the thing actually covering the whole Mac. Get those pieces in place and you have a Mac VPN you can leave on all day.