How to Set Up a VPN on Mac in 2026: Step-by-Step Guide

A Mac doesn’t need any special tricks to run a VPN, but the setup differs enough from Windows that it’s worth its own walkthrough, especially with System Settings permission prompts changing across recent macOS versions. This guide covers the app-based route most people should use, then the native macOS method for anyone with a manual config from a cheaper provider.

Method 1: App-based setup (recommended)

A provider’s macOS app handles the network extension permissions, server picking and protocol switching for you. Unless you have a specific reason to go manual, this is the method to use.

NordVPN on Mac

1. Go to NordVPN’s official website and download the macOS app directly from there. The App Store version exists too, but downloading from the official site guarantees you get the latest build immediately rather than waiting on Apple’s review queue.

2. Open the installer and drag the app into your Applications folder, as with any Mac app.

3. Launch NordVPN and sign in. The first time you connect, macOS shows a permission prompt asking you to allow a “VPN configuration” in System Settings. This is Apple’s Network Extension framework doing its job, not a bug. Approve it, and you may need to authenticate with your Mac password or Touch ID.

4. Once approved, click “Quick Connect” in the app. NordVPN picks the fastest nearby server automatically, and the connection completes in a few seconds.

5. A small icon appears in your menu bar confirming the VPN is active. Click it any time for a quick connect/disconnect toggle without opening the full app window.

Choosing a server: use the “Countries” tab in the sidebar to pick a specific location, or the dedicated streaming category if you’re connecting for a particular platform.

Protocol: NordLynx, NordVPN’s WireGuard implementation, is the default and the fastest option on Mac. Leave it as is unless a specific network blocks it.

Download NordVPN for Mac

ProtonVPN on Mac

1. Download the ProtonVPN app from Proton’s official site rather than the App Store, for the same reason as above: faster access to the latest version.

2. Sign in, or create a free account first if you want to test the app before paying. Proton VPN’s free tier covers one device with no data cap.

3. Approve the VPN configuration permission when macOS prompts you. Same System Settings dialog as any other provider.

4. Pick a server from the list or map view and click “Connect.”

ProtonVPN’s Mac app includes a Stealth protocol, worth switching to if you’re on a network that actively blocks standard VPN traffic, like some university or office Wi-Fi.

Download ProtonVPN for Mac

Apple Silicon: what actually matters

Every Mac sold since 2020 runs on Apple Silicon (M1 through M4 as of 2026), and it changes what to look for in a VPN app. Native ARM apps from NordVPN, ProtonVPN, Surfshark and ExpressVPN run directly on the chip with no translation layer, which means normal battery drain and no Rosetta 2 overhead. Older or less maintained VPN clients that still rely on Rosetta 2 emulation or legacy kernel extensions run slower and drain the battery faster, and some don’t work at all on the newest macOS releases. If an app you’re considering hasn’t been updated in the past year, that’s a reasonable reason to look elsewhere. For a deeper comparison of which providers handle this best, see our best VPN for Mac breakdown.

Method 2: Native macOS setup via System Settings

If you already have a manual WireGuard or IKEv2 configuration, maybe from a cheap provider that skips a full app, macOS can connect without any third-party software.

What you need first

Get your server address, protocol type, and either a configuration file or your login credentials from your provider’s dashboard. Mullvad is a good example of a provider built around this approach: it’s WireGuard-only and gives you a downloadable config file rather than a polished connect button, which keeps its price low and its infrastructure simple.

Setting up WireGuard manually

macOS doesn’t include WireGuard support natively, so you’ll need the official WireGuard app from the Mac App Store. Once installed:

1. Open the WireGuard app.
2. Click the plus icon and choose “Import tunnel(s) from file.”
3. Select the configuration file your provider gave you.
4. Click “Activate” to connect.

This takes under a minute once you have the file, and the connection typically establishes almost instantly.

Setting up IKEv2 through System Settings

1. Open System Settings.
2. Go to Network in the sidebar.
3. Click the plus button at the bottom of the VPN list, or “Add VPN Configuration” depending on your macOS version.
4. Choose “IKEv2” as the VPN type.
5. Enter a name for the connection.
6. Fill in the server address and remote ID your provider supplied.
7. Enter your authentication details (username and password, or a shared secret, depending on what your provider requires).
8. Click “Create,” then toggle the connection on from the Network panel.

Once connected, a VPN status icon appears in the menu bar, and you can toggle it from there without reopening System Settings each time.

Want to compare all VPNs side by side? Check our full VPN comparison table with scores across 18 criteria.

Menu bar quick-connect and auto-connect on untrusted Wi-Fi

Every major provider app adds a menu bar icon with a one-click connect/disconnect toggle, which is faster than opening the full app window every time. It’s worth using daily, since the friction of a two-second click is the difference between actually using your VPN and skipping it “just this once.”

More useful long-term: auto-connect on untrusted networks. NordVPN, ProtonVPN and most competitors let you set the app to detect when you join an unrecognized Wi-Fi network, coffee shops, airports, hotel networks, and connect automatically before any other app sends traffic. Look for this under Settings, usually labeled “Auto-connect” or “Trusted networks.” Mark your home and work Wi-Fi as trusted so the VPN doesn’t fire needlessly on networks you already control, and leave everything else to trigger it automatically.

Pair this with the kill switch, found in the same settings area, which cuts your internet entirely if the VPN connection drops rather than silently falling back to your unprotected connection. Both should be on by default for anyone who works from cafes or travels regularly.

Confirming your Mac VPN is actually working

The menu bar icon changing color isn’t proof enough on its own. After connecting, visit a leak-test site and check that the IP address and location shown match your VPN server, not your real one. Our guide on checking for VPN IP leaks walks through what to look for and how to fix one if you find it.

If your Mac feels slower than expected once connected, distance to the server and protocol choice are the usual culprits. Our guide to fixing a slow VPN covers the common causes in more depth. And if the connection keeps dropping, particularly after your Mac wakes from sleep, our troubleshooting guide for disconnects covers the fixes worth trying first.

Common Mac-specific VPN issues

A few problems come up specifically on macOS rather than other platforms. If a VPN app shows as connected but a leak test says otherwise, check System Settings under Network for a stuck or duplicate VPN configuration entry left over from a previous provider, and remove it. If macOS repeatedly asks for the VPN configuration permission even after you approved it once, a full app reinstall usually clears it, since a corrupted permission entry is more common after major macOS version upgrades than most people expect. And if your Mac wakes from sleep with no internet at all, disconnecting and reconnecting the VPN manually is faster than waiting for the app to notice on its own.