Setting up a VPN on your Mac involves more than installing an app. Make sure your subscription, permissions, and traffic routing mode all work together. Follow this sequence to get started on macOS: download a client, allow the necessary permissions, import your configuration, and verify the connection. Test it in a browser first, then check your work apps to narrow down any issues.
Before you install: check your client, subscription, and macOS version
The client reads your configuration and establishes the connection. A subscription link retrieves and updates route configurations, while the subscription service provides the routes you can use. These are not the same thing. Installing a client does not give you access to routes, and copying a subscription link does not mean your traffic is already using an international route.
On your Mac, check the chip type and macOS version under About This Mac. If the download page offers separate builds for Apple silicon, Intel, or both, choose the right installer and check the minimum system requirements. Supported macOS versions and protocols vary by client, so don't rely on the app name alone to determine compatibility.
VPNKN users can check the download instructions at the client downloads page, then get a subscription from the dashboard. No email address is required; create an account with a username and password. Subscription links usually contain access credentials, so protect them like passwords. Don't put them in public notes or shared documents, or include them in full in screenshots.
| Item or setting | What it's for | Common mix-up |
|---|---|---|
| Client download page | Get an app compatible with your system | Not the address used to import a subscription |
| Subscription link | Fetch routes and configuration updates | Not a webpage to keep opening in your browser |
| Single-node link | Import the settings for one route | May not include routing rules or future updates |
| System proxy or tunnel mode | Controls how app traffic is routed through the client | Selecting a node doesn't automatically enable traffic routing |
Install the client and keep macOS security checks enabled
If you downloaded a disk image, open it and follow the prompts to drag the app into Applications, then launch it from there. If you downloaded an installer, follow the instructions from the trusted source. Avoid running the app directly from Downloads or a mounted disk image long-term, as this can cause confusion with updates, file paths, or permissions.
The first time you open the app, macOS may warn that it was downloaded from the internet. Check the app name and source before confirming. If macOS says it can't verify the developer, first make sure you downloaded the right file from a trusted source. Only after confirming the source should you use the system-provided option to allow the app under Privacy & Security in System Settings.
“App is damaged” and “Apple cannot check it for malicious software” are different warnings. If macOS says the app is damaged, download the installer again and check the release notes. If the publisher provides a checksum, verify it. Avoid copying Terminal commands from unknown sources, removing quarantine attributes in bulk, or disabling system security checks altogether.
On a company-managed Mac, network extensions, proxy settings, or software installation may be restricted. If you see a management policy warning, ask your administrator which connection methods are allowed. Don't try to work around it by removing management profiles.
Grant permissions: understand proxy and tunnel modes
The client may ask to add a VPN configuration, enable a network extension, or install a helper app to change network settings. The requests depend on how the app is built, so not every client shows the same prompts. Make sure the request comes from the app you just installed, and grant only the permissions it needs to work.
System proxy provides a proxy for apps that follow macOS proxy settings. Browsers often use it, but some office apps, terminal tools, and apps with their own network stack may ignore it. So if a website works in your browser, that doesn't mean every app is using the same route.
Tunnel mode typically routes more traffic through a virtual network interface and system routing. It's often called TUN or enhanced mode. It may require additional permissions, and traffic can still be affected by routing rules, exclusions, and route configuration. “VPN connected” is a system status, not proof that every request is being proxied.
For your initial setup, start with the default mode recommended in the client documentation. Don't run multiple tools that change system proxy or routing settings at the same time. If you need access to your company's intranet, check which domains and subnets should connect directly. Forcing all traffic through the same exit can disrupt access to internal resources.
- ✅ Check that the app name and download source match the permissions prompt.
- ✅ Start with one traffic-routing mode, then adjust it once you've confirmed it works.
- ✅ If macOS asks you to restart the app or your Mac, do so before testing.
- ❌ Don't confuse helper app permissions or browser extension permissions with network access permissions.
Import a subscription: check the format, then update your routes
Open the subscription, configuration, or profiles section in your client. Choose the option to import from a link, paste the full address from your dashboard, and give it a recognizable local name. Menu labels vary by client. If the dashboard has import options for specific clients, use the one that matches yours.
- Copy the right link. Don't copy the dashboard login URL or omit any query parameters. After pasting, check that there are no extra spaces or line breaks at either end.
- Download or update the configuration. Wait for the client to read it and make sure routes appear in the list, rather than just an empty configuration name.
- Activate the imported configuration. Some clients let you save multiple configurations. After importing one, you may still need to select it as the active configuration.
- Choose a route and enable traffic routing. Select a route in your target region, then enable the system proxy or tunnel mode if needed. Finally, test the website you want to use.
If the client reports a parsing error, first check the subscription format and which formats the client supports. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different proxy protocols or protocol families. Support also depends on the client version and core. Support for a protocol doesn't necessarily mean the client can read every subscription format.
A route list and routing rules are not the same thing. Some subscriptions contain only nodes; a full configuration may also include routing rules and DNS settings. Before editing a subscription-generated configuration, check how updates work, or your changes may be overwritten the next time it refreshes. For rules you need to keep, use a local override or a separate rules section supported by the client.
Don't give a private subscription URL to an unfamiliar online tool just to convert its format. A conversion service may be able to access the credentials in the link. If you think the link has been exposed, check whether the dashboard lets you reset your subscription credentials, then import the new link.
Verify your connection: check websites, exit IP, and DNS
Test your setup against the tasks you actually need to do. First, make sure your local network works before connecting. Then enable the client and visit the website you want to use. A menu bar icon, a route test button, or a “Connected” message alone isn't enough to confirm that app traffic is being routed as expected.
Test your browser first, then your apps
Use a trusted IP lookup site to compare your public exit IP before and after connecting and confirm it matches the route you selected. Geolocation databases can be inaccurate, and an exit region doesn't prove how every request is routed. Next, open the office apps, sync tools, or developer tools you actually need and test sign-in and data loading.
If the browser works but a terminal tool doesn't, check whether it follows the system proxy or needs proxy environment variables set separately. Don't copy a local port number from a guide without checking: the proxy type, listening address, and port should match your current client settings. After enabling tunnel mode, test the target app again.
Check DNS in the context of your routing rules
DNS resolves domain names to IP addresses. Encrypted DNS in a browser, the system resolver, and the client's DNS feature may use different routes. A trusted DNS test page can help you investigate, but its results reflect only that test and can't replace checking each app you use.
If your rules explicitly send local websites directly, a local DNS result doesn't necessarily mean anything is misconfigured. What matters is whether domains that should go through the proxy are still sending DNS queries over an unexpected network. When adjusting DNS, follow the client documentation and keep the resolution path needed for company intranet domains.
A working connection means your target apps work and your exit route and traffic rules match your expectations—not just that a toggle is green. Even after your browser passes a test, check apps that ignore system proxy settings, along with DNS and intranet access.
Common issues: troubleshoot based on where they occur
Subscription won't update, but your local network works
First, check that your system date and time are correct. Then check whether the link has expired, whether the configuration format is supported, and the subscription status in the service dashboard. If your client lets you choose which network path to use for subscription updates, check that setting too. An expired proxy route can also prevent configuration updates. Keeping the error message is more useful than repeatedly reinstalling the client.
No websites load after connecting
First, turn off traffic routing and confirm your original connection works again. Then check the current route, DNS settings, and any other network tools for conflicts. If you still can't connect after quitting the app, check your current network service's proxy settings for any leftover proxy pointing to your Mac. Note the original settings before making changes, especially if your company manages the proxy configuration.
Disconnects after waking from sleep, or keeps asking for permission
When your Mac wakes from sleep, the network reconnects and the client may need to reconnect too. First, make sure you've completed any network sign-in, then reconnect. If permission prompts keep appearing, check that the app is still in Applications and that an older copy isn't running at the same time. For issues with a network extension or helper app, check the client logs and macOS prompts instead of repeatedly clicking Allow.
Can't connect to hotel Wi-Fi
Hotel Wi-Fi may require you to open a sign-in page first. Temporarily turn off the proxy and tunnel, complete the network sign-in, then enable the client. If the basic connection works but a particular connection mode still fails, check the client logs and service documentation instead of guessing based on the route name.
IEPL, relay, and direct routes describe how a connection is set up, not macOS permission types or client protocols. Switching to a route labeled dedicated won't automatically fix app permissions, an invalid subscription, or local DNS settings. If the issue persists, submit your macOS and client versions, the error message, and troubleshooting steps through the support ticket page. Remove subscription credentials from logs before sharing them.
Everyday use: update configurations and keep a way to revert
Once your first connection works, adjust routing rules as needed. Local websites, your company intranet, and international services can use different routes. Change one type of setting at a time and test the relevant apps. Client updates and subscription updates are separate: the former updates the app, while the latter refreshes the configuration provided by the service.
You don't need to move to a larger plan just because setup is complete. VPNKN monthly subscriptions reset each month on the activation date. Data packs remain valid until used and never expire. Check your actual usage before comparing billing options on the plans page. There is no device limit, but that doesn't mean data usage is unlimited.
Keep a short record of your current client, active configuration, traffic-routing mode, resources that need a direct connection, and how to restore your original network settings. The next time you switch networks or update macOS, test in the same order. It's easier to pinpoint the cause than when changing routes, DNS, and rules all at once.