How to Set Up a VPN on Mac
macOS supports VPNs both through dedicated provider apps and through the built-in VPN client in System Settings. Modern provider apps use Apple's Network Extension framework, while older apps used a now-deprecated kernel extension approach. This guide covers both methods.
Method 1 - Dedicated VPN App (Recommended)
| Step | Action | Where |
|---|---|---|
| 1 | Download the macOS client from your provider's website (e.g., ExpressVPN for Mac or Mullvad for macOS) - Affiliate link - We may earn a commission | Provider website or Mac App Store |
| 2 | Open the .dmg file and drag the app to Applications | Finder / Downloads |
| 3 | Launch the app from Applications or Launchpad | Applications folder |
| 4 | Sign in with your account credentials | VPN app |
| 5 | Allow the VPN configuration in System Settings if prompted | macOS permission dialog |
| 6 | Select a server and click Connect | VPN app |
| 7 | Verify the VPN icon in the macOS menu bar, then run a leak test | Menu bar & VPN Leak Test |
Method 2 - MacOS Built-in VPN (System Settings)
| Step | Action | Where |
|---|---|---|
| 1 | Open System Settings (Apple menu › System Settings) | Apple menu |
| 2 | Click "VPN" in the sidebar (macOS Ventura+) or Network › "+" on older macOS | System Settings › VPN |
| 3 | Click "Add VPN Configuration" and choose IKEv2, L2TP over IPSec, or Cisco IPSec | VPN screen |
| 4 | Enter the server address, account name, and authentication settings from your VPN provider | Configuration dialog |
| 5 | Click Create, then toggle the VPN on | VPN screen |
Network Extension vs Kernel Extension
- Network Extension (modern): Used by all major VPN apps on macOS 10.15+ (Catalina and later). Runs in user space, sandboxed, approved by Apple - No System Integrity Protection bypass needed. This is the current standard.
- Kernel Extension (legacy/kext): Older approach requiring a full macOS restart and reduced security. Apple deprecated kexts for VPN use. Avoid VPN apps that still require installing a kernel extension.
- If an app asks you to disable System Integrity Protection or install a kernel extension on modern macOS, that is a red flag - Look for a newer version or switch providers.
- Apps distributed through the Mac App Store can only use Network Extensions (sandboxed), which is generally safer.
Verifying Your Mac VPN Connection
- The VPN provider's icon in the menu bar should show an active state.
- Open System Settings › VPN - Your profile should show "Connected".
- Run our VPN Leak Test in Safari or Firefox to verify IP and DNS.
- Check for WebRTC leaks - Especially in Chrome and Firefox which expose local IPs via WebRTC.