How to set up a VPN on macOS

macOS ships with a VPN client, and for most people it is the wrong one to use. The built-in client under System Settings, Network, VPN speaks IKEv2, L2TP over IPsec and Cisco IPsec. It does not speak WireGuard or OpenVPN, and it never will, because those are third-party protocols implemented through the Network Extension framework rather than by the system.

So the practical route on macOS is an app.

Installing the app

1. Download the installer from the provider's own domain. VPNmine's is on the macOS download page.
2. Run it, then sign in or skip.
3. Approve the system extension. macOS blocks it on first run and shows a notification; the approval lives in System Settings, Privacy & Security, near the bottom of the pane. On Apple silicon this may need a restart.
4. Approve the VPN configuration prompt. macOS asks once, with Touch ID or your password, before any app may add a configuration.
5. Pick a server and connect.

The extension approval is the step people miss. Without it the app runs, the interface works, and connecting silently fails or falls back to nothing. If a client on macOS will not connect and has never shown an error, this is the first thing to check.

The official WireGuard client

If you have a config file instead of an app, WireGuard for macOS is on the Mac App Store and imports .conf files directly. It is the reference implementation, it is tiny, and it does exactly one thing.

You give up the server picker and the automatic reconnection logic. What you keep is full control: AllowedIPs = 0.0.0.0/0, ::/0 routes everything, and the client's on-demand rules can bring the tunnel up automatically on specific Wi-Fi networks, which is a genuinely useful feature the app versions often lack.

DNS on macOS

macOS resolves through the interface with the highest priority in the service order, which the VPN normally takes while connected. That is better behaviour than Windows has, but two things still leak.

Browsers with their own encrypted DNS. Safari follows the system. Chrome and Firefox both default to their own DNS-over-HTTPS resolver in some regions, independently of the tunnel. Check the browser's secure DNS setting if the DNS leak test reports a resolver you never configured.

Bonjour and local discovery. macOS resolves .local names on the local network regardless of the tunnel, which is correct behaviour and occasionally surprising in a leak test result.

Keeping the tunnel up

Three settings do most of the work:

• Launch at login, so the client is running before you open anything.
• Connect on untrusted Wi-Fi, if the client offers per-network rules. This is the setting that makes a VPN useful in cafés without you thinking about it.
• Kill switch. On macOS this is normally implemented as a packet filter rule. Turn it on before you rely on the tunnel, and know what it does: with the tunnel down, the machine has no network, which is confusing at 8am if you have forgotten it is set.

Sleep, and the reconnect that does not happen

A MacBook that sleeps drops the tunnel. Most clients reconnect on wake, but the window between the network coming back and the tunnel re-establishing is real, and any app that was mid-request will have sent that request in the clear unless a kill switch was blocking. If that window matters to you, the kill switch is not optional.

Confirm it works

Open what is my IP and check the address belongs to the server you chose. Then run the DNS leak test. Those two together catch nearly everything: the first proves traffic is entering the tunnel, the second proves lookups are not escaping it.

Removing a VPN cleanly

Dragging the app to the bin is not enough. A VPN app leaves behind a system extension, a network configuration and often a launch daemon, and a leftover configuration can interfere with the next client you install.

Use the app's own uninstaller where it has one. Otherwise, remove the configuration in System Settings, Network, then check Privacy & Security for an orphaned extension, and look in /Library/LaunchDaemons for a matching plist.

What macOS does not give you

There is no per-app tunnelling on macOS for consumer apps. Split tunnelling, if the client offers it, is implemented in the client's own extension rather than by the system, and its behaviour varies. Nor is there a system-level always-on VPN equivalent to Android's. The nearest thing is the WireGuard client's on-demand rules, which is why some people run that alongside a provider's app rather than instead of it.