A VPN routes your Mac’s internet traffic through an encrypted tunnel to a server somewhere else, so the network you’re on (a coffee shop, an airport, your ISP) can’t read what you’re doing and websites see the server’s IP address instead of yours. There are two ways to set one up on a Mac, and you almost never need the hard one.
The easy way: install the provider’s app
If you pay for a VPN service (NordVPN, Proton VPN, Mullvad, ExpressVPN, etc.), the fastest and most reliable setup is their own Mac app:
- Download the app from the provider’s website or the Mac App Store.
- Sign in with your account.
- Grant the one-time permission prompt that says the app wants to “add VPN configurations” — that’s macOS asking you to approve the connection, and it’s normal.
- Pick a location and click Connect.
The app handles the encryption protocol, DNS, and the kill-switch for you. A small VPN badge appears in the menu bar when you’re connected. For 95% of people, stop here — you’re done.
The manual way: add a VPN in System Settings
Use this only if your VPN is a work/school network, or a service that gives you a server address and login instead of an app. On macOS Ventura and later:
- Open System Settings > Network.
- Click the … (three dots) button at the bottom of the network list and choose Add VPN Configuration.
- Pick the type your provider gave you — usually IKEv2 (most common today), or L2TP over IPsec / Cisco IPsec for older setups.
Then fill in the fields your provider or IT department supplied:
- Display Name — any label you want (e.g. “Work VPN”).
- Server Address — the hostname or IP they gave you.
- Remote ID — for IKEv2, usually the same as the server address.
- Authentication — username + password, or a certificate they provide.
- For L2TP, you’ll also enter a Shared Secret (a pre-shared key).
Click Create, then toggle the connection on. Turn on “Show VPN status in menu bar” so you can connect and disconnect in one click.
Turn on "Connect On Demand"
In the VPN’s Options, you can set it to connect automatically for certain networks or domains — handy for a work VPN that should switch on whenever you’re off the office Wi-Fi. Most consumer VPN apps have this as an “auto-connect on untrusted networks” switch in their own settings instead.
When a VPN actually helps
- Public Wi-Fi — hotels, cafes, airports. The real benefit: nobody else on that network can snoop your traffic. (Note: HTTPS already encrypts most of what you do, but a VPN covers everything and hides which sites you visit.)
- Privacy from your ISP — your internet provider can’t log which sites you visit.
- Region-locked content or travel — appearing to browse from another country.
- Accessing a work/school network remotely.
When it’s just marketing
A VPN is not antivirus, and it’s not a firewall. It won’t stop malware, phishing, or a bad download — those are separate problems. It also doesn’t make you anonymous; you’re just trusting the VPN company instead of your ISP, so pick a reputable no-logs provider (ideally an audited one) rather than a random “free” VPN, which often pays for itself by selling your data. If your only goal is encrypting the files on your Mac, that’s FileVault, not a VPN.
Does a VPN slow down my Mac?
A little — your traffic takes a longer path, so expect a small speed and latency hit, worse the farther the server is. On a modern Apple-silicon Mac the CPU cost of the encryption is negligible; the slowdown is network distance, not your machine. If your Mac feels slow in general, a VPN isn’t the cause — and a snappy Apple-silicon MacBook handles VPN traffic without breaking a sweat.
Buying a Mac to do this on?
Any Apple-silicon Mac runs a VPN flawlessly — you don’t need anything fancy. A refurbished M1 MacBook Air from $450 is plenty. See current Apple clearance deals, and if you just picked one up, here’s how to set up a used MacBook the right way.
Every Mac we sell is tested, cleaned, and covered by our own warranty. Browse Apple clearance or get in touch and Rick will help you find the right one.