macOS VPN Setup Guide: From Install to Verified Connection

This macOS VPN setup guide breaks the first-time configuration into four steps: install the client, grant system permissions, import your subscription link, and verify that it actually works. All four take under ten minutes, and step two is the one that trips most people up. We go through them in order below, with checkpoints you can compare against at each stage.

Before You Start: Account, Client, and System Version

You need three things before you begin: a VPNBL account, an active subscription, and the client installer that matches this Mac. Signing up only takes a username and password — no email address, no email verification step — so you can log straight in to the dashboard.

Subscriptions come in two forms: monthly plans reset their data allowance on the same day each month, while data packs are billed by total volume and never expire. Log in to the dashboard and confirm your subscription is active before installing — it saves you from having to backtrack.

Before you start, confirm two things: check the macOS version and chip architecture (Apple silicon or Intel) under "About This Mac" — the download page separates installers by both — and note your current system version number, since the permission entry points have different names depending on it.

Step 1: Install the macOS client

There is only one source for the installer: the client download page in your dashboard after logging in. Once the download finishes, follow the steps below.

1. On the download page, choose macOS and download the .dmg installer.
2. Double-click the installer to mount it, then drag the app icon into the Applications folder.
3. Open Applications and double-click the client to launch it. If macOS says it "cannot be opened because Apple cannot check it for malicious software", do not click "Move to Trash" — allow it using the method in the next section.
4. Once it launches, the client icon appears in the menu bar, and the main window shows the route list and a connect button.

Always launch the app from the Applications folder rather than double-clicking it in Downloads. System extension permissions, launch at login, and future updates are all tied to where the app lives — if you move it later, some permissions need to be confirmed again.

Step 2: Grant System Permissions (the step that trips most people up)

Since macOS 10.15, Apple has tightened control over network takeover: for an app to handle all traffic according to split-tunneling rules, it must be authorized through the Network Extension framework — it cannot simply change its own network settings the way an ordinary app does. That is why you see two prompts in a row on first launch: one to add a VPN configuration, and one to allow the network extension.

Just confirm both prompts in the system dialogs; you will need to enter your login password or use Touch ID. If you clicked "Don't Allow" at the time, or the prompt flashed by before you could read it, allow it manually in the location that matches your macOS version:

• macOS 13 and later: System Settings → Privacy & Security → Network Extensions (on some versions it lives under "Login Items & Extensions").
• macOS 12: System Preferences → Security & Privacy → General.

Notification permission is optional — it only affects connection status alerts, and declining it does not affect anything else. You only need to authorize once; if the system asks again after a client update, just confirm it the same way.

Step 3: Import Your Subscription Link and Choose a Route

A subscription link is a URL that points to a configuration file. Once the client fetches it, the full node list is generated automatically — protocols (Shadowsocks / VMess / Trojan / VLESS / Hysteria2 / TUIC), ports, and encryption parameters are all included, so you do not have to fill in a single field by hand.

1. Log in to the dashboard, find the subscription address, and click copy. Copy the entire link — be careful not to copy only the first segment.
2. Back in the client, choose "Add Subscription" or "Import from Clipboard", paste the link in, and give the subscription any name you like.
3. Save, then click "Update" once and wait for the node list to appear.
4. Pick a route from the list and click Connect.

Most clients support scheduled auto-updates. When routes change on the dashboard side, a single manual update is enough — no need to reinstall the client or import the subscription again.

Choosing a Route: IEPL, Relay, and Direct

The type labels in the route list are not decoration — the three approaches differ noticeably during peak evening hours.

Do not judge a route by its off-peak latency alone: for routes in the same region, stability during peak hours matters more than the latency number. If you are unsure, run an IEPL dedicated line for a night, then switch based on how it actually feels.

Do the Split-Tunneling Rules Need Changing?

The client splits traffic by rules by default: domains in mainland China go direct, everything else goes through the route. That way mainland sites do not take a detour, and payment apps are not affected. Only when a particular app ignores the system proxy do you need to switch to global mode temporarily — and switch back to rule mode when you are done.

Step 4: Verify It Is Actually Working

The client showing "Connected" only means the tunnel is up — not that traffic is actually going where you expect. Check the four points below one by one, and only start using it normally once all of them pass.

Check 1: Has the exit IP changed?

Open any IP geolocation lookup page and see whether the returned IP belongs to the region your route is in. If you prefer the terminal, two commands will give you a rough idea:

# Show the current exit IP
curl -s https://ipinfo.io/ip

# Show the DNS resolvers the system is currently using
scutil --dns | grep 'nameserver\[0\]'

Check 2: Is DNS Following Along?

A DNS leak means "the IP changed but resolution stayed local": pages still load, but DNS queries still go to your local ISP, so results do not match the route's region — and some sites will flag the requests as anomalous traffic. If the second command above returns a router address (192.168.x.x) or a local ISP address, resolution is not following along; disconnecting and reconnecting usually refreshes it.

Check 3: Is Split Tunneling Working as Expected?

Open a mainland China site and an overseas site in turn: the mainland site should go direct, at speeds close to what you get when disconnected; the overseas site should go through the route. If the mainland site also takes a detour, first check whether you have switched to global mode.

Check 4: Does It Recover After Disconnecting?

Local networking should come back immediately after you disconnect. If pages will not load after disconnecting, the system proxy or virtual network adapter was not cleaned up properly — quit the client and open it again.

• ✅ Exit IP geolocation now matches the route's region
• ✅ DNS resolvers are no longer your router or local ISP addresses
• ✅ Mainland sites go direct, at speeds close to before connecting
• ✅ Local networking recovers immediately after disconnecting
• ❌ The lookup still returns a local IP, meaning traffic is not going through the route
• ❌ DNS still points to your local ISP, so resolution is leaking

Common Permission and Connection Issues

The symptoms below cover the vast majority of snags in a first-time macOS setup — when you hit one, just follow the "Fix" column.