How do you use a VPN on a Mac? First install a compatible client, then grant permissions as needed, import your subscription, choose a route, and verify your connection. Don’t assume that “Connected” means setup is complete: your browser, terminal, and other apps may use different network paths, and the required permissions depend on how the client handles traffic.
Before you install: Check your chip, macOS version, and subscription format
Open the Apple menu and select “About This Mac” to check your chip and macOS version. If the download page offers separate builds for Apple silicon and Intel, choose the one that matches your Mac. If it offers a Universal build, follow its compatibility notes. Whether an older macOS version is supported depends on the client’s release notes; an installer that opens isn’t proof of compatibility.
Get the 9OVPN macOS client from the user dashboard after signing in. Your subscription is available there too. Creating an account requires no email address—just a username and password. Visit the dashboard download page for the current client and setup instructions. Avoid downloading installers with the same name from unknown sources.
Next, check the subscription format and which clients support it. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are names of different protocols or protocol families; that doesn’t mean every client supports them. A subscription URL usually provides a set of nodes or configurations. Whether a client can import it depends on the format, its core version, and its protocol support.
- ✅ Verify the installer’s source, chip architecture, and minimum macOS requirements before installing.
- ✅ Use the subscription or configuration provided for your client in the dashboard; don’t guess compatibility from the file extension.
- ✅ Keep your account credentials and subscription URL secure. Don’t share the full URL in public chats or screenshots.
- ✅ Pause other proxy clients’ automatic traffic handling to avoid conflicts over system proxy settings and routing.
Install and launch the client: Understand system prompts
A common installation method is to open the disk image and drag the app into Applications. If an installer is provided, follow the dashboard instructions. After installation, launch the app from Applications rather than running it from the disk image long-term; doing so can cause problems with updates, helper components, or permissions.
The first launch may prompt you to confirm the app’s source, or macOS may block it for security reasons. First verify the download source, file integrity, and developer details. Then check System Settings under “Privacy & Security” for the relevant option. Labels and locations vary between macOS versions, so follow the prompts on your system.
A work- or school-managed Mac may be restricted by device management policies, preventing you from approving extensions or installing helper components. Contact your device administrator to resolve these restrictions. Reinstalling the same file won’t change the policy, and you shouldn’t modify system protection settings to get around it.
Permissions: System proxy, network extensions, and TUN
A client may show a permission prompt when it needs to change network settings or start a traffic-handling component. Read the app name and the action it’s requesting before deciding whether to allow it. A system proxy is generally used by apps that follow the system proxy settings; a network extension or TUN may handle more traffic, depending on the implementation and rules.
| Traffic handling method | Possible prompt | Use cases and considerations |
|---|---|---|
| System proxy | Change proxy settings or install a helper tool | Works with apps that follow the system proxy settings; terminals and some other apps may not use them. |
| Network Extension | Add a VPN configuration or allow a network extension | Handles network traffic according to the client’s implementation; the relevant System Settings location varies by macOS version. |
| TUN virtual interface | Start a privileged helper, network extension, or related service | Often used to handle traffic from apps that don’t follow the system proxy settings. Check DNS, routing, and local network rules. |
These methods aren’t mutually exclusive. Some clients use a network extension to create a virtual interface; others use a privileged service. Don’t treat this table as a fixed list of permissions every client needs. A helper component requiring administrator approval doesn’t mean the app needs access to all your files, and Full Disk Access isn’t a general requirement for network connections.
If the client explicitly asks you to approve a system extension, follow its instructions to find the developer entry in System Settings. On newer versions, the relevant controls may be under General > Login Items & Extensions; other versions may show a prompt under Privacy & Security. Restart only when macOS or the client asks you to—restarting isn’t required for every connection.
If you dismissed a prompt, return to the client and enable the feature again, then check System Settings. If no prompt appears, first confirm that the current mode actually needs that permission. If you’re using a system proxy, searching for a VPN configuration may mean troubleshooting a problem that doesn’t exist.
Import your subscription: Update it, then choose a route
Importing a subscription gives the configuration to your client; it doesn’t necessarily turn on the proxy. A complete setup includes importing and updating the subscription, choosing a node, and enabling traffic handling. The steps below use general labels; the actual buttons depend on your client.
- Get your subscription. Sign in to the dashboard and find the subscription option for your macOS client. Copy the full URL. Don’t use the dashboard login URL as your subscription URL.
- Add a remote configuration. In the client, look for “Subscription,” “Configuration,” or “Profiles,” then paste and save the URL. If opening the link can launch an app, confirm that it opens the intended client.
- Update and check the configuration. Make sure it downloaded successfully and that the node list appears. If you see a format error, check that the client and subscription formats are compatible. Don’t send private links through public conversion websites.
- Choose a route and mode. Select a region supported by your target service, start with the default rule configuration, then enable the system proxy or the client’s recommended traffic-handling method.
- Verify access. Check your route and the target app. Once everything works, consider convenience features such as automatic updates and launch at startup.
An import failure doesn’t necessarily mean a node is unavailable. The subscription URL may have expired, spaces may have been added when copying it, the request may have returned a login page, or the client may not support that configuration format. If only the update fails, keep the existing configuration and note the error instead of deleting it and losing a useful point of comparison.
Labels such as dedicated line, relay, or direct describe how a route is set up—not macOS permission types. An IEPL dedicated line typically uses a private Ethernet transport service provided by a carrier. A relay routes traffic through an intermediate server; a direct route doesn’t use that kind of service-provider relay. The actual result still depends on the exit point, routing, and destination service, so the label alone doesn’t tell you how well it will work.
Verify your connection: Exit IP, DNS, and app routing
Note your exit IP before connecting, then enable the client and check for a change using an IP lookup. In rule mode, the lookup page may be routed directly. If the exit IP hasn’t changed, check which rule matched the request before concluding that the whole connection is broken.
Next, open the international website or app you actually want to use. If the client provides connection logs, check that the request matched the expected rule and used your selected node. A website opening in your browser only confirms that the browser’s current route works; it doesn’t prove that your terminal, developer tools, or background services are also routed through the client.
Why do terminal and browser results differ?
Many command-line tools don’t automatically use the macOS system proxy. Follow the tool’s documentation to set proxy environment variables or its own proxy options. Get the proxy address and port from your current client; don’t reuse values from another guide. If you switch to TUN, check that the relevant requests are actually routed through the client rather than relying on the toggle’s status.
What is a DNS leak?
A DNS leak generally means that domain lookups which should follow the expected proxy route are instead sent to an unexpected resolver. A changed exit IP doesn’t mean DNS is using the same route. Browser encrypted DNS, system DNS resolution, client-side DNS handling, and routing rules can all behave differently.
During testing, check the client’s DNS settings, domain lookup records, and the results from a resolver test. The resolver’s reported location may not match your exit location, and a location label alone doesn’t prove there’s a leak. Prefer a DNS setup supported by your client, then adjust one setting at a time to avoid conflicting configurations.
Common problems: Narrow down the cause by symptom
The client says connected, but websites won’t load
Turn off the proxy first and check whether your regular network connection works. Then check that the subscription is up to date, a node is available, and your service has active traffic. Review the client’s error logs to distinguish a connection timeout from a DNS lookup failure or incompatible configuration. Change one setting at a time and keep the conditions that reproduce the problem so you can tell what helped.
You still can’t connect after quitting the client
The system proxy may still point to a local service that has stopped. Turn off the system proxy in the client before quitting normally. If the app has crashed, check the proxy settings for your current network service for any leftover entries. Don’t reset all network settings at once, especially on a device that uses an organization proxy or custom network configuration.
Connection drops after waking from sleep or switching networks
Your network interface, default route, or DNS settings may change when you switch networks. Wait for your local connection to come back, then reconnect to the node. If the problem persists, turn traffic handling off and on again. Check the release notes before updating the client. If the issue only happens on a particular network, provide your macOS version, client version, and error logs; that’s more useful than repeatedly importing the subscription.
Local network devices or company network resources are unreachable
Check your local network bypass rules and make sure the destination address isn’t being sent through the proxy by mistake. Using a corporate VPN alongside a personal proxy can also cause routing conflicts. Follow your organization’s requirements and test each connection separately to avoid overlapping traffic handling. Before sharing logs, redact subscription tokens, account details, internal addresses, and other sensitive information.
Everyday use: Keep your configuration easy to verify
Once your setup is stable, note the client name, traffic-handling mode, and source of your rules. Automatic subscription updates make node maintenance easier, but shouldn’t overwrite custom settings you haven’t backed up. After updating macOS or the client, retest your browser, terminal, and frequently used apps, and check whether permission prompts or DNS behavior have changed.
Choose a traffic plan based on your usage: 9OVPN monthly subscriptions are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB. Monthly data resets on the activation date; data packages remain valid indefinitely until used. See the plans page for details. Unlimited devices doesn’t mean every app is automatically routed through the client; verify the configuration on each device.