A VPN on macOS is one of two things: a system-level connection profile that macOS itself manages, or a client app that runs its own tunnel. Which one you need depends entirely on what your provider gives you, and the two are configured in different places.

Option 1: The Built-In Client

macOS handles IKEv2, L2TP over IPSec and Cisco IPSec natively. If your provider or employer supplies those settings, no third-party software is needed.

  1. Open System Settings → Network.
  2. Click the … menu and choose Add VPN Configuration.
  3. Pick the type, then fill in the server address, account name and the shared secret or certificate your provider supplied.
  4. Save, then toggle the connection on.

The advantage of this route is that it is part of the system: it starts at login, survives updates, and the connection state appears in the menu bar without any app running. The limitation is protocol support — no OpenVPN, no WireGuard, no provider-specific transports.

Option 2: A Client for a Profile File

If your provider hands you a .ovpn file, the built-in client cannot open it. Tunnelblick is the long-standing open-source OpenVPN client for macOS: drop the profile in, enter credentials, connect. It handles multiple profiles and can be set to connect at launch.

WireGuard has its own official client, and providers that support it usually recommend it over OpenVPN for speed. Whichever client you use, the setup is the same shape — import a profile, authenticate, connect.

Verify the Tunnel Is Actually Up

A VPN that says “connected” is not proof that traffic is going through it. The check is the public IP address: compare it with and without the tunnel.

curl -s https://ifconfig.me

Run it before connecting, then after. If the address does not change, traffic is not using the tunnel — usually a routing problem, or a client that connected but did not set the default route.

The second check is DNS. A tunnel that carries traffic but leaks DNS queries to the local network defeats a good part of the purpose. Providers that care about this publish a DNS leak test; run it rather than assuming.

The Kill Switch Question

Most clients offer to block all traffic if the tunnel drops. Turn it on if you are using the VPN because you do not trust the network — a hotel Wi-Fi, an airport. Without it, the moment the tunnel fails, everything reverts to the unprotected path, and the failure is silent.

If you want to see what is leaving the machine regardless of the tunnel, Little Snitch shows every outgoing connection per application and lets you block it. That is a different layer of control from a VPN — one hides where traffic goes, the other decides whether it goes at all.

Choosing a Provider

The protocol matters less than the provider’s logging policy, jurisdiction and track record. A fast tunnel through a provider that keeps connection logs is a different product from a slower one that does not. Our guide to VPN clients for Mac compares the clients; the policy question is answered in the provider’s own documents, not in a review.

Frequently Asked Questions

Does a VPN hide my browsing from my employer or ISP?

It hides the destination of your traffic from the network you are on. It does not hide it from the VPN provider, and it does not protect you from anything installed on the Mac itself. Those are three different threats.

Why does my VPN disconnect on sleep?

The tunnel is tied to a network session that a sleep cycle tears down. Most clients reconnect on wake, but the reconnect takes a few seconds during which traffic goes out unprotected unless the client is configured to block it.