How to Set Up a VPN on Mac

macOS supports VPNs both through dedicated provider apps and through the built-in VPN client in System Settings. Modern provider apps use Apple's Network Extension framework, while older apps used a now-deprecated kernel extension approach. This guide covers both methods.

Method 1 - Dedicated VPN App (Recommended)

Step	Action	Where
1	Download the macOS client from your provider's website (e.g., ExpressVPN for Mac or Mullvad for macOS) - Affiliate link - We may earn a commission	Provider website or Mac App Store
2	Open the .dmg file and drag the app to Applications	Finder / Downloads
3	Launch the app from Applications or Launchpad	Applications folder
4	Sign in with your account credentials	VPN app
5	Allow the VPN configuration in System Settings if prompted	macOS permission dialog
6	Select a server and click Connect	VPN app
7	Verify the VPN icon in the macOS menu bar, then run a leak test	Menu bar & VPN Leak Test

Method 2 - MacOS Built-in VPN (System Settings)

Step	Action	Where
1	Open System Settings (Apple menu › System Settings)	Apple menu
2	Click "VPN" in the sidebar (macOS Ventura+) or Network › "+" on older macOS	System Settings › VPN
3	Click "Add VPN Configuration" and choose IKEv2, L2TP over IPSec, or Cisco IPSec	VPN screen
4	Enter the server address, account name, and authentication settings from your VPN provider	Configuration dialog
5	Click Create, then toggle the VPN on	VPN screen

Network Extension vs Kernel Extension

• Network Extension (modern): Used by all major VPN apps on macOS 10.15+ (Catalina and later). Runs in user space, sandboxed, approved by Apple - No System Integrity Protection bypass needed. This is the current standard.
• Kernel Extension (legacy/kext): Older approach requiring a full macOS restart and reduced security. Apple deprecated kexts for VPN use. Avoid VPN apps that still require installing a kernel extension.
• If an app asks you to disable System Integrity Protection or install a kernel extension on modern macOS, that is a red flag - Look for a newer version or switch providers.
• Apps distributed through the Mac App Store can only use Network Extensions (sandboxed), which is generally safer.

Verifying Your Mac VPN Connection

• The VPN provider's icon in the menu bar should show an active state.
• Open System Settings › VPN - Your profile should show "Connected".
• Run our VPN Leak Test in Safari or Firefox to verify IP and DNS.
• Check for WebRTC leaks - Especially in Chrome and Firefox which expose local IPs via WebRTC.

Frequently Asked Questions

Should I download the VPN app from the App Store or the provider's site?

Prefer the provider's site where both exist. App Store builds are sandboxed and sometimes ship without the system-level kill switch or full protocol support.

Why does macOS ask for my password when I connect?

Installing a VPN configuration modifies system network settings, which requires administrator authorisation. It is expected on first setup and after major client updates.

How do I remove a VPN configuration completely?

System Settings, then VPN, select the configuration and remove it — then check Network and Profiles for leftover entries. Provider apps often leave a system profile behind after being deleted.

Does the macOS built-in client support WireGuard?

No. The built-in client covers IKEv2, L2TP/IPSec, and Cisco IPSec. For WireGuard use the provider's app or the official WireGuard client.

How we evaluate VPNs: every provider on this site is judged on audited no-logs claims, leak-test results, protocol support, jurisdiction, and price transparency — never on commission. Read the full testing methodology →

ⓘ Affiliate disclosure: Some links to VPN providers in these guides are affiliate links - We may earn a commission at no extra cost to you. This never affects rankings or evaluations.

Last updated: 2026-08-02