How to set up a VPN on a Mac
Connect a MacBook or desktop Mac, handle the network-extension prompt and keep access to the local devices you need.
On a Mac, the download, the network extension and the VPN configuration can be three separate steps. If you have put the app in Applications and still cannot connect, the missing step is often an approval in System Settings. Start by choosing the route that matches what you have been given.
| What you have | Where to start |
|---|---|
| A consumer subscription | The service’s official Mac app and your existing account. |
| A workplace sign-in and setup instructions | Your employer’s approved app or profile, following its instructions. |
| Only a Safari or Chrome extension | Check whether you need the desktop app for Mail, video calls or other applications. |
Install the app and approve its connection
- Check Apple menu → About This Mac for your macOS version. Follow the provider’s own link to its Mac download or App Store listing. If it supplies a disk image with an Applications shortcut, drag the app there and launch that copy.
- Sign in and choose the default server. Read any system prompt that appears at this point. A VPN configuration or network extension bearing the developer’s expected name can be part of setup. A request to give a stranger remote control of the Mac is unrelated.
- If macOS reports that a system extension is blocked, open the settings panel from the app. Proton VPN, for example, directs users of macOS Sequoia and later to General → Login Items & Extensions. Open the information control for Network Extensions and enable the named Proton component. Earlier releases have different screens. Follow the provider’s instructions for your version.
- Return to the app and complete the connection. On a Mac with a configured system VPN you can also go to Apple menu → System Settings → VPN to see or change its state. Corporate policies may limit which settings are available.
If you already have a work VPN, ask IT whether a personal one can be used alongside it. Enabling two applications does not establish which one handles a particular company address. For a work-only Mac, the right check is usually reaching an authorised internal site over the approved connection.
Check one ordinary browsing session
On home Wi-Fi, load the connection exposure page before connecting and again afterwards. Look at the public address and network beside it. Changing from Safari on Private Relay to a different browser halfway through gives you two variables. Stay in one browser and make a note if it already uses a relay or proxy.
Close the laptop lid, wait for it to sleep, then open it and inspect the VPN status before starting a new request. If the app opened automatically when you logged in, check that it actually connected too. Launching at login and making a connection are separate settings on many clients.
The internet works but the printer has disappeared
Printers, network drives and speakers often use the local network. Some VPN configurations block local devices while allowing websites to work. On your own Wi-Fi, look in the VPN app for Allow LAN connections or similar wording. Check the provider’s documentation for interaction with its kill switch. Proton, for example, documents limits on local access with its Mac kill switch enabled.
Confirm the Mac and printer are on the same home network before changing the VPN. Test the printer, change one setting and test again. Allowing local access on a café network is a separate choice. Revisit that setting when you move between networks. If an employer manages the Mac or printer, use the approved settings for that network.
Gather the right details for support
Record the macOS and app versions, the name of the failed approval and whether browsing or just local access is affected. If the connection fails only after sleep, include that sequence. Where the Mac connects but a website still reports an unexpected location, work through how to check a VPN connection before reinstalling.
macOS references
- Apple’s instructions for connecting a Mac to a VPN
- Proton’s version-specific network-extension guide
- Proton’s local network access settings
- Proton’s platform-specific kill-switch behaviour
Related reading
How to set up a VPN on your iPhone
Make your first connection, recognise Apple’s permission prompt and check what happens when your iPhone leaves Wi-Fi.
Read guide
How to set up a VPN on Android and use always-on protection
Connect a personal Android phone, choose what should happen if the tunnel drops and spot apps that have been left outside it.
Read guide
How to set up a VPN on Windows 11
Use a provider’s Windows app or connect a profile supplied by work. Find the right sign-in, confirm the route and troubleshoot a connection that stalls.
Read guide