Setting up a VPN on a Mac takes more than installing an app. macOS permissions, subscription settings, and traffic routing all need to work together. This guide walks you through choosing and installing a client, reviewing system prompts, importing your subscription, and checking that apps use the intended route.
Before you install: check the source of your client and subscription
Open About This Mac to check whether your computer has Apple silicon or an Intel processor, and note your macOS version. Download the version specified in the dashboard. If a universal build is available, confirm that it supports your system. Don’t rely on the installer’s filename to determine compatibility, and never download a client from an unfamiliar chat attachment.
The VPNGrand macOS client is available after you sign in to the dashboard; your subscription is there too. Start at the client download page, then follow the dashboard instructions. Signing in, downloading the client, and having an active plan are separate steps. Opening the app doesn’t mean your subscription has been imported or that it’s routing traffic.
If you choose a third-party client, check that it supports your subscription format and node protocol. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC aren’t interchangeable just because they appear in the same list of proxy protocols. Even when the protocol name matches, the client version and specific settings can affect connectivity. These are common protocol names; this does not mean VPNGrand supports them all.
Finish the installation: understand the different system prompts
- Download the version for your Mac from the dashboard. If it’s a disk image, open it and drag the app to Applications as instructed. If it’s an installer, review the steps and continue.
- Launch the installed client from Applications. Don’t keep running a temporary copy from your Downloads folder or disk image.
- Review the first-launch prompt. Check the app’s name, source, and requested permissions before deciding whether to allow them.
- If the app needs system approval, follow its instructions to open System Settings. Menu locations vary by macOS version; use the search field in System Settings to find the right option.
The “App downloaded from the internet” confirmation, approval to add a VPN configuration, permission for a network extension, and administrator authentication to install a helper are different kinds of prompts. Not every client triggers all of them. Don’t approve unrelated extensions just to make prompts go away.
Import your subscription: a link doesn’t mean the configuration is active
A subscription link lets a client retrieve nodes and related settings. It isn’t a regular website address or your account password. Some clients fetch settings after you sign in; others have an option such as “Import subscription” or “Import from clipboard.” Follow the dashboard instructions for your specific client.
- Sign in to the dashboard, find the subscription option for your client, and copy the entire link. Make sure there are no extra spaces and that no query parameters are missing.
- In the client, choose the subscription import option, paste the link, and save it. If there are format options, follow the dashboard instructions instead of trying random conversion sites.
- Update the subscription, check that configurations or nodes appear in the list, and select the one you want to use.
- Choose a route, turn on the connection or proxy, and then test access. Seeing a node name in the list doesn’t mean it’s the active connection.
If importing fails, first check whether the error occurs while downloading the subscription or parsing its configuration. For a download error, check your internet connection, whether the link has expired, and your dashboard status. For a parsing error, check the format and client compatibility first. Subscription updates can change the node list, so an old node still appearing isn’t proof that the configuration works.
A subscription link may contain access credentials. Don’t share it on public forums, online decoding tools, or public code repositories. Hide links, QR codes, and tokens in screenshots too. If a link has been exposed, reset it in the dashboard if that option is available, then update the clients you use.
Choose how traffic is routed: system proxy or split tunneling
On Mac, the system proxy and routing through a virtual network interface cover different traffic. The comparison below describes general principles; not every client offers every mode. The latter may be called enhanced mode, tunnel mode, or TUN.
| Mode | What it does | Things to note |
|---|---|---|
| System proxy | Provides a proxy for apps that follow the system proxy settings. | Terminal tools and some apps may ignore these settings. A working browser doesn’t mean every app is covered. |
| Tunnel routing | Typically routes more traffic through a virtual network interface and routing rules. | May require additional permissions. Coverage still depends on routes, exclusions, and the client’s implementation. |
| Rule-based routing | Uses domains, addresses, or other rules to choose actions such as direct access or proxy routing. | This is traffic-selection logic, not a separate system permission mode. It must be used with a traffic-routing mode. |
For everyday use, start with the rules provided by your client. Avoid changing the routing mode, DNS, and rule set all at once. If a site has issues, temporarily switch strategies for comparison if your client supports it, then restore your usual settings once you’ve found the cause. Command-line tools may also use their own proxy environment variables, so Safari working doesn’t confirm that your Terminal traffic is configured.
After connecting: check your exit address, DNS, and apps
First, make sure your internet connection works before connecting. Then connect the client and open the network check page to review your exit information. In rule-based mode, the check page itself may use a direct route, so an unchanged exit address doesn’t necessarily mean the connection failed. Check the client’s connection log to see which rule matched.
- ✅ Check the current configuration, selected route, and connection switch. Make sure you didn’t update the subscription without turning the connection on.
- ✅ Open the sites or apps you actually plan to use and test page loading, sign-in, and ongoing activity—not just the client’s status icon.
- ✅ Check which rules matched and how DNS requests were resolved to confirm that traffic follows your intended routing rules.
- ✅ Disconnect and revisit a regular website to make sure your internet connection still works.
A DNS leak test checks whether DNS requests bypass the route you expect; the country shown in a test result alone doesn’t tell the whole story. Encrypted DNS in your browser, the client’s DNS policy, and the system resolver may all be involved. Your rules may also intentionally send directly routed domains to a local resolver. If you see an unfamiliar resolver, check your settings before concluding that all traffic is unprotected.
A changed exit address also doesn’t guarantee that all content will be available. Websites may determine access based on your account region, payment details, and their own policies. When testing, note the specific page, error message, and route used so you don’t mistake a server-side restriction for an installation problem.
Troubleshooting: permissions, network extensions, and lost connectivity
Prompts keep appearing after approval
Make sure you’re launching the installed copy from Applications, and check for an older version or another app with the same name. If System Settings shows an item awaiting approval, verify the developer and source before approving it. Follow the client’s instructions to quit and reopen it. Restart your Mac only if specifically prompted; repeated reinstalls aren’t a substitute for troubleshooting.
Connected, but apps can’t access the internet
Try another route for comparison, then check whether the app follows the system proxy settings. If only Terminal or one app has a problem, check its proxy settings and matching rules instead of changing the network globally. Also check for other VPNs, proxy apps, or network filters running at the same time; they may conflict over routing, DNS, or system proxy settings.
Connection stops working after sleep or a network change
First, make sure Wi-Fi is back and complete any captive portal sign-in for public Wi-Fi. Then reconnect the client. A network change can invalidate an existing connection. If this keeps happening, note whether it occurs after waking from sleep, switching networks, or updating the subscription, and send that information along with your macOS and client versions to support.
No internet access after quitting the client
Reopen the client and use its disconnect, turn off system proxy, or restore network option before quitting normally. Then check whether the proxy settings for your current network service still contain a local proxy address. Remove it only if you’ve confirmed that this client added it. Contact your administrator about network settings managed by a workplace or school. Don’t delete all network configurations or upload full logs containing credentials publicly.
Everyday use: choose a plan based on your data needs
A Mac may sync files in the background, download development dependencies, or update apps. When choosing a plan, consider your actual data use—not just time spent browsing. VPNGrand allows unlimited devices, but that doesn’t mean unlimited data. Keep an eye on your plan’s remaining data when using multiple devices.
Monthly plans include ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB. Data resets monthly on your activation date; if you upgrade mid-cycle, the price difference is prorated for the remaining days. Data packages include ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB. They last until used and never expire. Compare monthly plans for regular use or data packages if your usage varies. See the plan pricing page for details.