How to Setup VPN on Mac OS: Step-by-Step Guide

Which VPN apps work on macOS

macOS has a built-in VPN client in System Settings that supports IKEv2, IPsec and L2TP over IPsec, long-established protocols used mostly for company networks. It cannot open WireGuard-based or VLESS profiles, so for those you need a third-party app that adds its own VPN configuration to the system.

Flex-VPN profiles open in two clients, both available for macOS as well as for phones and Windows.

AmneziaWG is the simpler starting point: it is based on WireGuard and adds extra masking of its service packets. VLESS + Reality runs over TCP, and the connection looks like ordinary HTTPS traffic, which helps on networks that handle UDP poorly, such as some hotel and guest Wi-Fi. You can install both apps and keep the second as a fallback; the differences are explained in AmneziaWG vs VLESS + Reality. v2RayTun can also import a VLESS subscription, but check its store listing for macOS support first.

Before you setup VPN on Mac OS: version, chip and key

1. Check your macOS version and chip. Open the Apple menu and choose About This Mac. It shows the macOS version and either a Chip line (Apple silicon) or a Processor line (Intel). Compare this with the requirements on the app's store listing or download page.
2. Make sure you can approve system changes. Adding a VPN configuration changes network settings, so macOS may ask for an administrator password or Touch ID. On a work Mac managed by an IT department, company policy may not allow VPN apps, so check with the administrator first.
3. Get your key or subscription link. Flex-VPN issues keys and subscription links in the Telegram bot @vpn_flex_bot. The base plan includes three devices, and extra devices are available separately. Use a separate key for each device, so you can tell connections apart and fix a problem on one device without affecting the others.
4. Quit other VPN and proxy apps. Disconnect any VPN you used before and quit it fully, including its menu bar icon. Two clients changing routes and DNS at once often break a new setup.

Treat your key and subscription link like a password: anyone who has them can connect with your profile. Paste them only into the VPN app, never into shared notes, screenshots or group chats.

Setting up Amnezia VPN with an AmneziaWG key

Amnezia VPN saves your AmneziaWG key as a connection and manages the tunnel for you, so you never enter server addresses or ports by hand.

1. Download Amnezia VPN from the official Amnezia website or, if it is listed for your Mac, the App Store. Avoid mirror sites and repackaged installers.
2. Install the app and open it from Applications. If macOS warns that the app was downloaded from the internet, confirm only if the file came from the official source. Some versions ask for an administrator password during installation because they add a background service that manages the tunnel.
3. Copy your AmneziaWG key from the bot in one piece.
4. In Amnezia VPN, choose the option to add a connection with a key, paste the full key and continue. Depending on the version, the app can also read a key from the clipboard or open a saved configuration file.
5. Give the connection a recognizable name if the app offers it, then connect.
6. If macOS asks to add a VPN configuration, allow it (see the System Settings section below).

If the import fails, the key is usually damaged: a missing last character, an extra space or a line break added by a messaging app. Copy it again and paste it straight into the app. A detailed walkthrough is on the Amnezia VPN setup page.

Setting up Happ with a VLESS subscription

Happ uses a subscription link rather than a single key. The link points to a server list that Happ updates on its own, so you do not need to re-import anything when locations change.

1. Install Happ from the App Store or the developer's official page, and check that the listing supports your Mac.
2. Copy your subscription link from the bot.
3. Open Happ, click the add button and choose to import from the clipboard. The subscription and its server list appear in the app.
4. Pick a location and connect.
5. Allow the VPN configuration when macOS asks.

Choosing a server

Flex-VPN locations are in Europe, for example Germany, the Netherlands and Finland. A server closer to you usually gives lower latency, and for video calls and remote desktop sessions latency matters more than raw download speed. If the list looks empty or out of date, use the app's option to update the subscription, then reconnect. The full walkthrough is on the Happ setup page.

Allowing the VPN configuration in System Settings

Apps built on Apple's VPN framework show a system prompt the first time they connect, saying the app would like to add VPN configurations. Choose Allow and confirm with your password or Touch ID if asked. If you choose Don't Allow, the app cannot create the tunnel, and the connect button does nothing or shows an error. Apps that install their own background service ask for an administrator password during installation instead.

Where to find the VPN settings for your Mac

On macOS Ventura and later, configurations added by apps appear in System Settings under VPN in the sidebar; on some versions they sit under Network. On macOS Monterey and earlier, look in System Preferences under Network. Each app adds its own entry with an on/off switch, but servers, protocols and routing rules are managed inside the app.

System extensions and leftover profiles

Apps distributed outside the App Store sometimes install a system extension for networking, which stays disabled until you approve it. Depending on the macOS version, the request appears under Privacy & Security or in the extensions list under General. While you are there, remove configurations left by VPN apps you no longer use: an old profile set to connect automatically can take over and interfere with the new tunnel. Removing an entry deletes only that app's configuration; the app adds it again the next time you connect.

Checking your IP and DNS

A connected status means the tunnel is up, not that your traffic and DNS queries actually use it.

1. Public IP. With the VPN off, open any IP check page and note the address and location. Connect and reload the page. The address should change to the server's, and the location should match the one you picked.
2. DNS. Run a DNS leak test while connected. The resolvers shown should not belong to your internet provider; you will usually see servers near the VPN location or a public DNS service. If your provider's servers appear, read the guide on DNS leaks before relying on the connection.
3. Terminal (optional). Run scutil --dns to see which DNS resolvers macOS is using, and ifconfig to list network interfaces. VPN tunnels on macOS use utun interfaces, but the system keeps a few of these for its own services, so compare the output with the VPN off and on.
4. Sleep and network changes. Close the lid for a few minutes, wake the Mac and repeat the IP check, then do the same after switching to another Wi-Fi network or Ethernet. Some clients reconnect on their own; others need a manual reconnect.

Fixing common Mac VPN problems

Change one thing at a time and test after each change. For a checklist that applies to every platform, see why a VPN stops working.

• Connect does nothing or drops instantly. The configuration was probably refused earlier. Remove the app's entry from the VPN settings, reconnect from the app and allow the prompt this time. Also check whether a system extension is waiting for approval.
• Connected, but pages do not load. Look for a conflict: another VPN, a manual proxy in your Wi-Fi or Ethernet settings, or a DNS or content filtering app. Turn them off one at a time while testing, then try a different location.
• Works at home, fails on hotel or guest Wi-Fi. These networks often use a sign-in page. Disconnect the VPN, open a browser, complete the sign-in, then connect again. If an AmneziaWG connection still will not start there, try your VLESS + Reality profile in Happ.
• Disconnects after sleep. Update the app, reconnect after waking and check whether the client offers an automatic reconnect option.
• Slower than expected. Measure your speed with the VPN off first to get a baseline, then try a closer location or the other protocol.
• A printer, NAS or other local device stops responding. Use split tunneling, if your client supports it, to send that traffic directly instead of through the tunnel.
• A firewall or security app stops the tunnel. Add the VPN client as an exception in that app instead of turning protection off entirely.

If nothing helps, write to support at @vpn_flex_support. Include your macOS version, chip type, app name and version, protocol, network type and the time of the error. Never post your key in public chats or forums.