The client says “Connected” but the browser can't load a page, or the exit IP never changes. In most cases the cause sits in two approval steps: the extension and the configuration. macOS moved third-party VPN tunnels into its NetworkExtension framework, so a client no longer implements the tunnel itself — it installs a system extension and then asks the system for a VPN configuration. If either step is denied, the client can still show a connected state while no traffic enters the tunnel.
Three hurdles when installing a VPN on macOS
Work through these three in order first — most “won't install” problems are solved at this step.
Hurdle one: the system extension isn't enabled
After installation, go to System Settings → General → Login Items & Extensions → Extensions → Network Extensions. The client's entry is listed there and is switched off by default. Turning it on requires an administrator password, and some clients ask for a restart. Without this switch the client cannot bring up TUN mode, which is exactly the “connected but no pages load” symptom.
Hurdle two: the VPN configuration prompt was dismissed
The first time you connect, macOS asks whether to allow the client to add a VPN configuration. If you hit “Don't Allow”, the prompt never comes back and the client just keeps reporting that adding the configuration failed. To recover, open System Settings → Privacy & Security and allow the entry manually at the bottom of the list. If the entry is gone entirely, reinstalling the client is faster than hunting through switches.
Hurdle three: iCloud Private Relay stacked on top
With iCloud Private Relay on, Safari traffic first passes through Apple's relay nodes. Running it alongside a VPN stacks two proxy hops: the client typically shows connected while the exit IP stays the same, or a few sites throw certificate and region errors. To troubleshoot, open System Settings → Apple Account → iCloud → Private Relay, turn it off temporarily, then re-check the exit IP.
After “Don't Allow” is clicked, macOS never asks again — the most commonly missed detail on the Mac. When you see “failed to add VPN configuration”, check the switch under Privacy & Security before blaming the client.
| Blocker | Typical symptom | Where to fix it | Restart required |
|---|---|---|---|
| System extension not enabled | Shows connected, no VPN icon in the menu bar, pages won't load | System Settings → General → Login Items & Extensions → Network Extensions | Usually yes |
| VPN configuration permission denied | Keeps reporting that adding the configuration failed; the connect button does nothing | System Settings → Privacy & Security | No |
| iCloud Private Relay | Connected but the exit IP doesn't change; a few sites misbehave | System Settings → Apple Account → iCloud → Private Relay | No |
Chip compatibility: Apple silicon vs Intel differences
Apple silicon and Intel Macs run the same macOS, but the binary and the way extensions load differ. When one client behaves differently on the two platforms, these two areas are usually why.
Build architecture and translation overhead
If a client ships only an Intel build, it runs through the Rosetta translation layer on Apple silicon. Tunnel forwarding is a syscall-heavy path, so an extra translation layer means slower handshakes, higher CPU use and faster battery drain when left running. Choosing a client with an arm64 or Universal build removes that layer.
System extensions vs kernel extensions
Early VPN clients built tunnels with kernel extensions. Loading those on Apple silicon requires lowering startup security and rebooting into recovery mode — a real barrier for ordinary users. Mainstream clients have moved to NetworkExtension system extensions and no longer need any change to startup security. If a client still asks you to “reduce security”, it almost certainly hasn't finished that migration and isn't a good choice for your main machine.
System extensions must also be signed and notarized. An extension with an invalid signature is refused outright, and the error usually appears only as a single line at the bottom of Privacy & Security, while the client's own message stays vague — easy to be led astray when troubleshooting.
| Item | Apple silicon (M series) | Intel Macs |
|---|---|---|
| Recommended build | arm64 or Universal | x86_64 |
| Translation layer | Intel-only builds run through Rosetta, adding a layer of overhead to handshakes and forwarding | Not applicable |
| System extension loading | Must be enabled manually in Login Items & Extensions | Also needs manual enabling |
| Kernel extension | Requires reduced startup security — not recommended | Can load, also not recommended |
| Signing requirement | Extensions must be signed and notarized, or they won't load | Same as above |
Protocols and clients: choosing on macOS
Most macOS clients are built on the Clash/mihomo or sing-box core; the interface is only a shell, and what really determines the experience is the protocols and routing the core supports. Once a subscription link is imported, the core decides by rule which domains go through the tunnel and which connect directly — which is why the same subscription behaves differently in different clients.
The advantage of a subscription link is that when nodes change, the client updates once and you never edit a config by hand; a manually imported configuration file goes stale after server-side changes and has to be exported again. For long-term use, go with the subscription link.
No protocol is inherently better than another; it depends on the network you're on.
| Protocol | Transport | Characteristics | Best for |
|---|---|---|---|
| Shadowsocks | TCP / UDP | Simple structure, low overhead | Everyday browsing, documents and downloads |
| VMess | TCP, WebSocket, gRPC and more | Many transport combinations, and plenty of settings | When you need flexible transport options |
| Trojan | TLS over TCP | Looks like ordinary HTTPS traffic | Networks with strict traffic inspection |
| VLESS | TLS / XTLS | No built-in encryption; TLS provides the security | Used together with TLS |
| Hysteria2 | QUIC(UDP) | Faster handshakes on weak, lossy networks | Mobile networks and long cross-border routes |
| TUIC | QUIC(UDP) | Low latency, but sensitive to UDP quality | Networks where UDP isn't throttled |
TUN mode vs system proxy mode
TUN mode takes over all traffic through a virtual network interface, including command-line tools that ignore system proxy settings; system proxy mode only writes an address into the system proxy settings, so curl and git in a terminal won't use it by default. To tell which mode a client is using on the Mac, check the menu bar icon and whether a virtual interface has appeared in Network settings.
Routing rules decide the real experience
Global mode pushes all traffic into the tunnel, so even local sites take a detour and end up slower; rule mode routes by domain and IP, sending local sites direct and overseas traffic through the tunnel, which is the standard setup on a Mac. Rule lists need regular updates — stale rules misjudge new domains, which shows up as individual sites failing to load or loading slowly.
How to verify after installing: a four-step check
A successful connection doesn't mean it's working. Work through the steps below in order and you can pin down which layer is failing.
- Check the exit IP: open an IP lookup page before and after connecting and compare the address and its location. If the address hasn't changed, traffic isn't entering the tunnel — go back to the permissions section first.
- Check DNS resolution: use a DNS leak test to confirm that queries come from the tunnel exit side. If it still shows your local ISP, the routing rules are sending DNS out over the direct connection.
- Look at the routing rules: in rule mode, local domains going direct is expected behaviour. To confirm whether a specific domain uses the tunnel, check which rule name it hits in the client log rather than judging by how fast the page opens.
- Switch protocols and retest: if a TCP-based protocol handshakes fine but throughput is unstable, try Hysteria2 or TUIC; conversely, if the network throttles UDP hard, fall back to Trojan or VLESS over TCP for stability.
- ✅ Exit IP matches the location of the selected node
- ✅ DNS leak test shows a resolver on the tunnel exit side
- ✅ The target domain hits a proxy rule in the client log
- ✅ curl in Terminal also returns an overseas address, so traffic is going through TUN mode
- ❌ The exit IP is still your local ISP — traffic isn't entering the tunnel
- ❌ Only the browser works and other apps don't use the proxy — you're probably still in system proxy mode
Verify before you pay: once the exit IP and DNS checks both look right, decide about a long-term subscription. VPN31 offers a 14-day refund, no questions asked, so the time spent verifying costs little.
Which metrics matter when choosing a VPN for Mac
Permissions and protocols settle whether it works at all; the points below settle how well it works.
Coverage and route count determine how many nodes you can pick from; device count determines whether one subscription can serve a household. A VPN31 account has no device limit, so the same subscription can be signed in on a Mac, a phone and a tablet at once; creating an account needs only a username and password, with no email address; and billing includes a 14-day refund, so you can verify with the method above before committing long term.
The other item is the logging policy. VPN31 keeps no logs — stated in the privacy notice as a position rather than a technical guarantee. If privacy matters to you, also check for yourself whether the client's local connection logs are uploaded anywhere.
Route types: direct, relay and IEPL dedicated lines
- Direct: the client connects straight to an overseas node. The path is the shortest, but it sits fully exposed to congestion at the international gateway, and evening peaks are where it shows most.
- Relay: traffic enters a relay entry point before going abroad. One extra hop buys a way around some congested paths, so stability is better than direct.
- IEPL dedicated line: traffic travels on a carrier-grade dedicated channel instead of the public international gateway, giving the lowest packet loss and jitter at peak hours — and the highest cost.
If you only browse the web and occasionally watch 4K video on the Mac, direct and relay routes are enough; if you stay connected for long meetings, file transfers, or you're sensitive to evening peak hours, prefer routes that include an IEPL dedicated line.
Choosing a data plan
| Plan | Price | Data | Notes |
|---|---|---|---|
| Monthly | ¥9.9/month | 60GB | Data resets monthly on your activation date |
| Monthly | ¥18/month | 250GB | Data resets monthly on your activation date |
| Monthly | ¥28/month | 500GB | Data resets monthly on your activation date |
| Data pack | ¥158 | 300GB | Use it up at your own pace — it never expires |
| Data pack | ¥358 | 1000GB | Use it up at your own pace — it never expires |
| Data pack | ¥658 | 3000GB | Use it up at your own pace — it never expires |
Bottom line: for Mac-only use centred on web pages and documents, the ¥9.9/month 60GB plan is enough; if you often watch 4K or keep a phone and tablet connected at the same time, the ¥18/month 250GB plan fits better; if you'd rather not renew monthly, take a data pack — use it up at your own pace, it never expires. When you upgrade mid-term, the price difference is prorated by the remaining days.
FAQ and closing advice
The browser works but the terminal doesn't use the proxy
System proxy mode only writes into the system proxy settings, which curl, git and brew in a terminal don't read by default. Either set the proxy environment variables explicitly in your shell, or switch to TUN mode and let the virtual interface take over all traffic.
A leftover VPN configuration after uninstalling
Uninstalling the client doesn't clean up the VPN configuration. Delete the leftover entry in System Settings → VPN, then remove the matching extension in Login Items & Extensions; otherwise the next client you install may hit a configuration conflict.
It stops working after a macOS upgrade
A major macOS upgrade resets extension approvals. After upgrading, re-enable the network extension in Login Items & Extensions and connect once — no need to reinstall the client.
Can one subscription be used on other devices?
Yes. The account has no device limit, so a Mac, a phone and a tablet can share one subscription without paying per device; concurrent use within the terms doesn't knock anyone off.
Should it stay on all the time?
Keeping a VPN always on costs standby battery on a Mac, and it makes local services such as printers, screen mirroring and LAN sharing unreachable. The more practical setup is to put the local network and local domains into the direct rules and send only the traffic you need through the tunnel, rather than using global mode.
Conclusion: when choosing a VPN for macOS, first check whether the client has completed the system extension migration, then look at route types and data plans, and finally verify with the exit IP and DNS checks that it really works. If permissions were never granted, no protocol will get you online.