A VPN on a Mac has the same knot as everywhere else: "VPN" can mean two unrelated things, and a VPN app you install often doesn't show up on the VPN page of System Settings even while it's running. This guide covers turning one on, changing it, turning it off, and the two most-searched Mac cases: "the VPN won't turn off, it reconnects itself" and "no internet after I disconnect."
We write this as the team that builds a macOS VPN app — the mechanics below are the same ones our app uses (and it's the same app as on iPhone and iPad).
Two kinds of VPN on a Mac
Built into macOS — under System Settings → VPN (older macOS keeps it in Network). This is for connecting to a company VPN or one you set up by hand with older protocols (IKEv2, L2TP). You enter the server address yourself.
A VPN app you install (like TUKTUKVPN) — these use Apple's Network Extension system to run their own tunnel. A well-behaved app does show up as an entry under System Settings → VPN, but detailed control (picking a server, a mode, seeing status) happens in the app. The System Settings switch only connects or disconnects.
How to turn on a VPN on Mac
Turn it on from the app: click connect. The first time, macOS asks to add a VPN configuration and may ask you to approve a System Extension under System Settings → Privacy & Security (click Allow once). After that it connects on its own. When the VPN is up you'll see a small VPN icon in the menu bar.
With TUKTUKVPN, connect from the app — it picks the server and protocol that suit your current network automatically.
How to change a VPN on Mac
Change the server or country inside the same app — pick a new server in the app and connect. The app drops the old connection and brings up the new one.
Switch from one VPN app to another — like iPhone, macOS allows one Network-Extension VPN config active at a time. When you connect in a new app, the system swaps the active config for you and the old app drops on its own. No need to disconnect first.
When you retire an old app for good: deleting the app sometimes doesn't remove the VPN configuration it installed. Clean it up at System Settings → VPN — if you still see an old app's name, click (i) or right-click and remove it. Also check System Settings → General → Login Items & Extensions → Network Extensions; if an old app's extension lingers, you can disable it there.
How to turn off a VPN on Mac
- From the app: click disconnect — the cleanest way.
- From the menu bar: click the VPN icon and disconnect.
- From System Settings: System Settings → VPN → toggle the config off.
Normally that's it. If it reconnects or the internet drops, read the next two sections.
VPN won't turn off on Mac, it reconnects — the cause and fix
Symptom: you switch it off and a few seconds later it connects again. The number-one cause is Connect On Demand — exactly like on iPhone, because macOS uses the same VPN framework. An On Demand rule tells the VPN to connect automatically when its conditions are met, so it reconnects no matter how many times you flip the switch.
Fix:
- Turn off auto-connect / on demand in the app first — the correct way, because the app removes the rule cleanly.
- Turn it off in the system: System Settings → VPN → click (i) next to the stubborn config → turn off On Demand (on some macOS versions this option is inside the config's detail page).
- Managed case: if the config came from a profile your organization installed (MDM), you can't remove it yourself — talk to the admin.
- Last resort: delete the whole config, then open the app to reinstall it clean.
No internet after disconnecting a VPN on Mac
Usually it's stale DNS or a route left over from the switch. Quick fix: toggle Wi-Fi off and on once from the menu bar. If that doesn't do it, open Terminal and run sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder to clear the macOS DNS cache. If it's fully blocked (no sites load at all), check whether the app has a kill switch enabled — opening the app and disconnecting properly releases its filters.
Should you leave a VPN on all the time on a Mac?
It depends on the job. Modern protocols like WireGuard have low idle overhead, so leaving it on barely affects a MacBook's battery. If you only use it occasionally, turn it off when you're done. The one thing to remember: if you set auto-connect, it will reconnect itself — that's it doing what you told it to.
If you want a VPN that handles all of this in one app — the same app across Mac, iPhone, and iPad, automatic server and protocol per network, and no leftover configs on your machine — TUKTUKVPN has a macOS app you can download. Sign up and try it; your first purchase is covered by a 30-day money-back guarantee.