How to use a VPN on Mac: a complete macOS setup guide

Before you install: check your Mac, macOS version, and subscription format

Open the Apple menu and select “About This Mac” to check your chip and macOS version. If the download page offers separate builds for Apple silicon and Intel, choose the one that matches your Mac. For a universal build, check the release notes for compatibility. Don't assume an installer found online comes from the same developer just because its app icon looks familiar.

If you're using 2HVPN, start at the download section in the dashboard for the client and import instructions. You can create an account with a username and password—no email address required. The client, subscription, and plan are separate: installing the app doesn't give you a usable configuration or access to a plan.

• ✅ Check that the client supports your macOS version and chip, and verify the download source.
• ✅ Make sure the subscription format is compatible with the client. Use the import option recommended for that client in the dashboard.
• ✅ Quit any other proxy or VPN that is currently routing traffic to avoid conflicts while troubleshooting.
• ❌ Don't share your subscription URL in public groups, online conversion tools, or diagnostic pages run by strangers.

Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC each require support from the client's core. An app's ability to read a subscription file doesn't mean it supports every protocol or setting in that file. This list is for checking compatibility; it doesn't mean any particular service offers all of these protocols.

Install the client and grant system permissions

1. Download the app from a trusted source, follow the installation instructions to move it to the Applications folder, then open it from there rather than running it from the disk image.
2. If macOS says it can't verify the developer, check the download source, developer details, and release notes first. Only proceed through the security settings provided by macOS if you've confirmed the app is trustworthy. Don't disable your Mac's security checks altogether.
3. Read each permission prompt when you first connect. Depending on how the client works, macOS may ask to add a VPN configuration, allow a network extension, or install a helper tool to manage proxy settings.
4. After granting permission, return to the app and check the connection toggle, configuration name, and selected route. Restart the app or Mac if the release notes call for it.

Permission prompts vary by client. An app that only uses the system proxy may not need a network extension, while a client that routes traffic through a virtual network interface may need additional permissions. Some helper tools require administrator approval on your Mac; that's separate from your service account password.

Import a subscription: it's not a system VPN configuration

A subscription link lets the client retrieve routes and related configuration. It may contain an account identifier or access token, so keep it as carefully as you would a password. The built-in macOS VPN settings support specific system protocols; they can't directly read every kind of proxy subscription.

1. Sign in to your service dashboard, find the subscription or client import section, and choose the format for your app.
2. For one-click import, make sure your browser opens the client you just installed, then check the result in the app.
3. To import manually, copy the full link, add it as a remote subscription in the client's subscription, configuration, or profile manager, then update it.
4. Make sure the configuration is selected, not just saved in the list. Then choose a route and enable the connection mode you need.

If no routes appear after importing, check the update error. Common causes include a missing character in the copied link, the wrong format, an expired subscription, or a network that can't reach the subscription URL. Don't turn the link into a node address or use the dashboard login URL as a subscription.

Updating a subscription refreshes its configuration; you don't need to do it before every browsing session. Check for updates if routes haven't refreshed in a while or the service announces a change. If your link is exposed, reset it through a supported dashboard option or contact support, then update the old subscription on your devices.

Connection modes: rule-based routing, global mode, and virtual interfaces

First, separate two questions: which traffic enters the client, and how the client routes traffic it receives. “System proxy” and “virtual network interface” mainly control which traffic is captured; “rules” and “global mode” mainly determine how captured requests are handled.

For everyday use, start with the rules provided by the service. If a particular international site won't open, try global mode temporarily as a comparison. If that fixes it, check which rule applies to the domain. A site loading in your browser doesn't mean command-line tools, games, and meeting apps use the same route.

Choose a route based on what you need to access and how the connection performs. Direct connections, relays, and IEPL describe different network paths or transport options; they aren't client protocols, and the name alone doesn't predict how well a route will work. For background, see our guide to routes and protocols. Don't replace a working configuration with unfamiliar protocol settings.

Verify your connection: check your exit IP, DNS, and routing rules

When a client says “Connected,” it usually means only that one part of the connection has been established. Test the apps you actually use, not just the menu bar icon. First confirm your local network works while disconnected, then connect and test; this can rule out many issues unrelated to your subscription.

1. Open the target site in the browser you normally use and make sure its content loads, rather than seeing a cached page.
2. Use a reputable exit IP checker to see which route you're using. With rule-based routing, different sites may take different routes, so check the client's connection logs too.
3. Check which rule matched the request, which route was selected, and any error details. This helps distinguish direct connections, proxied traffic, and rejected requests.
4. To check DNS, use a reputable testing tool and compare the results with the client's DNS settings to see whether lookup requests took the expected route.

A DNS leak occurs when DNS requests don't get the expected protection from a tunnel or proxy route and instead travel another way. Rule-based routing may intentionally resolve some domains locally, so detecting a local resolver doesn't by itself mean all requests are leaking. Likewise, a changed exit IP doesn't prove that every DNS request is handled as expected.

Browser secure DNS, system resolver settings, and the client's DNS features can all affect the results. Don't change every layer at once: keep the service's recommended settings, check the logs, then adjust the specific item causing trouble. A protected network connection doesn't make you anonymous to websites; your sign-in state, cookies, and site permissions still apply.

Troubleshooting: permissions, extensions, and connection conflicts

Permission prompts keep appearing, or the connection turns off by itself

Make sure the app is in your Applications folder and check whether macOS still needs approval for an extension or helper tool. If you have another similar client installed, quit it fully so multiple apps aren't changing proxy settings at once. A work-managed Mac may be restricted by device policies; check with your administrator instead of trying to work around them.

Your browser works, but Terminal or other apps don't

Start by checking which traffic the client captures. Terminal apps may not use the system proxy; some need proxy environment variables configured separately, while others have their own network settings. Follow the app's documentation, or check virtual network interface mode if the client supports it and has the required permissions. Don't copy commands containing account credentials from an unfamiliar guide.

The client says it's connected, but websites won't load

Try another available route for comparison, then check your rules and DNS settings. If only one site is affected, the cause could also be its regional policies, your account status, or how it identifies your exit IP. Changing connection methods doesn't guarantee that platform restrictions will be lifted. Recording the error is more useful than repeatedly reinstalling the app.

Regular websites stop loading after you quit the client

Check the proxy settings for your current network service to see whether they still point to a local proxy on the stopped client. If you changed DNS manually, check that those settings are still valid too. Disconnect and turn off the system proxy in the client before quitting. Revert only settings you added yourself; don't remove work network configurations.

After setup: keep a consistent, easy-to-reproduce configuration

Once everything works, note which configuration, route, and mode you used. If something goes wrong after waking your Mac from sleep, switching networks, or updating macOS, check whether any of them changed. Keeping your client and subscription source trustworthy is easier to maintain than frequently switching apps.

Instructions for Windows clients won't map directly to a Mac, and iOS handles network permissions and app installation differently from macOS. For help with other platforms, see our setup guides. “Unlimited devices” describes how many devices you can use; it doesn't mean unlimited data. Check the plans page for data allowances and billing details.