macOS VPN From Scratch: Install, Grant Permissions, Import Subscription, Verify

When you set up a VPN on macOS, the step that actually trips people up is rarely the Connect button — it's the installer source, the system extension approval, the subscription import, and verifying that it works. This guide walks through the real order of operations: get the macOS client from your dashboard, work through the system permission prompts, import the subscription link, and finally confirm with exit IP, DNS and routing that your traffic is really going through the route you chose. No command-line experience is required, and every terminal step comes with a command you can copy and paste.

Before You Start: three things to confirm

There are only three things to prepare. Get them done before you open the client and the rest of the setup goes much more smoothly.

• System version: the last several major releases (macOS 12 and later) all work fine. Modern macOS clients create the virtual network interface through a system extension (Network Extension), Apple silicon Macs included, so the old kernel extension approach is no longer needed.
• Account status: a VPNDT account only needs a username and password — no email address required — so there's no “wait for the verification email” step in your prep. Once you log in to the dashboard, both the subscription link and the client downloads are right there.
• Network environment: finish downloading the installer and importing your subscription on your current connection first, then switch routes — switching mid-download can leave you with an incomplete installer.

Keep these basic service figures in mind — the verification steps later will refer back to them:

Download and install: put the client in Applications

1. Log in to your dashboard, open the download page, and pick the macOS version.
2. Check your chip type: Apple silicon (M-series) and Intel Macs each have their own installer, though some clients ship a universal build. Downloading the wrong one won't harm your system — it just won't install.
3. Open the DMG, drag the app icon into the Applications folder, then launch it from Applications.
4. If the first launch says the developer cannot be verified, go to System Settings → Privacy & Security, click Open Anyway in the Security section, and confirm once more.

System permissions: what each of the three switches does

macOS splits VPN app permissions into several layers, so the first connection triggers a run of dialogs. Each one handles a single job, and a missing layer shows up as either “won't connect” or “connects but no internet”:

When the prompts show up, this is the order to handle them in: first accept the “Add VPN Configuration” dialog on the first connection (macOS warns that all network activity will go through this configuration), then check under Login Items & Extensions that both the network extension and Allow in the Background are switched on, and finally restart the client once so the settings take effect. Panel names vary slightly between macOS versions — in older releases this section is called Login Items.

One more thing: macOS 15 added a Local Network permission, which only matters if you want other devices on the same LAN to share the proxy running on this Mac — for ordinary single-machine use you can ignore it. If a switch is greyed out and won't move, the Mac is usually managed by a configuration profile or MDM policy, and you'll need to contact the device administrator; reinstalling the client over and over won't fix that.

Import the subscription: pasting the link and keeping it updated

The subscription link is the address your client uses to fetch its server list. You can copy it from the dashboard with one click; it's usually a long string starting with https://. It contains both the server configuration and your credentials, and once imported, the client automatically pulls the servers and routes that are currently available.

1. Copy the subscription link from your dashboard. Don't edit any part of the address by hand — especially the token at the end; changing a single character will make the fetch fail.
2. Open the macOS client, choose “Import Subscription” or “Add Configuration”, paste the link in and confirm.
3. Wait a few seconds and the client will show the server list and groups. If the list is empty, run “Update Subscription” manually once; if it's still empty, go back to the dashboard and copy the link again.
4. Pick a route from the list (a Hong Kong server on an IEPL line, for example), set the mode to “Rule”, then hit Connect. Subscription links commonly carry Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC servers, and the client detects them automatically — no manual selection needed.

Which of the three import methods to use

How often to update your subscription

Servers and routes are adjusted from time to time. Most clients let you set an automatic update interval, and you can also refresh manually from the configuration at any time. One small habit is worth building: when a route won't connect, update the subscription by hand first, then work out whether it's the route or your local network — most cases of “it suddenly stopped working” come from a stale subscription.

Verify it's working: exit IP, DNS and routing

The client showing “Connected” doesn't mean your traffic is really taking the route. Once the tunnel is up, traffic between the client and the server is protected with bank-grade encryption, and the point of verification is simply to confirm that traffic really enters that tunnel. Check the three items below in order — if any one doesn't match, it points you to the exact step that's off:

Three commands you can copy straight into Terminal:

# Show the current DNS resolvers
scutil --dns | grep 'nameserver\[0\]'

# Check whether the client has taken over the system proxy
scutil --proxy

# Check whether a virtual network interface has been created (TUN mode)
ifconfig | grep -A 2 utun

There's a macOS-specific detail worth knowing here: in system proxy mode, only apps that respect the system proxy settings use the route, and curl in Terminal ignores them by default. To verify from Terminal, either switch to TUN mode so routing takes over, or set the proxy environment variables explicitly before the command (use the local port shown in your client). That's usually why “the browser works but Terminal still goes direct”.

Common issues: what to do when permission prompts keep coming back

Permission prompts keep reappearing

If you have to re-authorize on every connection, work through these in order — one of them will usually explain it:

1. The app has moved: if you once ran it straight from the DMG and later dragged it into Applications, macOS treats the two as separate programs and authorizes each one. Launch it from Applications once and you can ignore the old authorization record.
2. Allow in the Background got switched off: a client upgrade or system update sometimes resets this toggle — just turn it back on.
3. The system extension was denied once: after a single denial macOS stops prompting, and you have to enable the switch manually under Login Items & Extensions.
4. The device is managed: a company- or school-issued Mac may block third-party network extensions through a configuration profile, and you'll need to contact the device administrator.

It says Connected, but international sites won't load

• Make sure the mode is “Rule” and not “Direct”, and check whether the target domain has been sorted into the direct group by mistake;
• Check whether another app has overridden the system proxy: System Settings → Network → Details → Proxies;
• Stale routes after waking from sleep: disconnect and reconnect, or just restart the client;
• Try a different route to rule out a problem with that one.

DNS still resolves through your local ISP after connecting

This usually means you're in system proxy mode: application traffic takes the route, but domain resolution is still handled by your local network. Whether that's acceptable depends on what you need; if you want resolution handled too, switch to TUN or enhanced mode and check again with scutil --dns. After changing modes, disconnect and reconnect so the routing table and resolvers are rebuilt.

The client says the developer cannot be verified

Go to System Settings → Privacy & Security and click Open Anyway in the Security section. If the installer didn't come from the download page in your dashboard, delete it and download it again: an installer from an unknown source may be blocked by the system, and it also scrambles your authorization records — which is often where those repeating permission prompts start.

Setup checklist: run through it whenever you change devices

The steps above, condensed into a checklist — follow it when you move to a new Mac or set one up for someone else:

• ✅ The client is in the Applications folder and was launched from there
• ✅ The “Add VPN Configuration” dialog on first connection was allowed
• ✅ In Login Items & Extensions, both the network extension and Allow in the Background are on
• ✅ The subscription link is imported and the server list updates properly
• ✅ Mode is set to “Rule”; switch to global temporarily only when you need it
• ✅ The location shown on the My IP page matches the route you selected
• ❌ Don't run the client straight from the mounted DMG
• ❌ Don't screenshot or forward your subscription link in public