For Mac VPN beginners, system permissions and subscription imports can be trickier than choosing a location. VPNFish monthly plans start at ¥9.9, with a 7-day no-questions-asked refund policy. Follow these steps to install, authorize, import and verify your connection—starting with your browser before routing other apps.
Before You Install: Check Your Mac, Client and Connection Mode
Check your chip and macOS version in Apple menu > About This Mac. Choose the installer for your Apple silicon or Intel Mac, or follow the client’s instructions if it offers a universal version. Older macOS releases may not support the latest client. Check the minimum system requirements before downloading instead of repeatedly changing permission settings after an installation fails.
Check the client download section in the user dashboard for compatibility details, then follow the instructions to get the software. App packages usually need to be dragged into the Applications folder. Don’t keep running the app from a disk image, and avoid keeping multiple copies with the same name—login items, helper components and the app you opened may otherwise point to different copies.
“Mac VPN” is a common search term, but clients can route traffic in different ways. Some mainly configure the system proxy; others create a tunnel through a network extension or use a virtual network interface and helper components. If no VPN configuration prompt appears, that doesn’t necessarily mean installation failed. First check whether your selected mode actually requires that permission.
| Connection method | Traffic covered | Permissions and notes |
|---|---|---|
| System proxy | Usually affects apps that follow macOS proxy settings | May require changing network settings; apps that ignore the system proxy may not be affected |
| Network extension tunnel | Routes traffic according to the tunnel configuration and routing rules | Usually requires adding a VPN configuration or enabling a network extension |
| TUN virtual interface | Can route traffic from apps that don’t use the system proxy, subject to routing rules | May rely on a helper service or administrator approval; it doesn’t mean all traffic will necessarily go through a remote server |
System Permissions: Grant Only What the Feature Requires
When you first open the app, macOS may ask you to confirm that you want to run software downloaded from the internet. Check the source and app name before proceeding. If macOS says the developer can’t be verified, consult the official installation guide and check Privacy & Security in System Settings. Don’t disable system-wide security checks just to launch the app, and don’t run Terminal commands from unknown sources.
When you enable a tunnel, the client may ask to add a VPN configuration. A client that uses a network extension may also ask you to allow the extension. Where to approve these requests varies by macOS version: look under VPN & Filters in Network, or under Login Items & Extensions in General. Follow the prompt to find the right setting, and make sure the developer and app names match.
- Move the app to Applications and open it normally. First, read the client’s instructions for the current connection mode.
- Turn on the connection or tunnel feature in the client and check whether macOS asks for authorization.
- Approve the requested configuration or extension. Enter your Mac administrator credentials only if macOS explicitly asks.
- Return to the client and reconnect. If it asks you to restart the app or your Mac, follow the prompt.
A Mac managed by an organization may have device policies that restrict VPNs, extensions or proxy changes. Reinstalling repeatedly won’t resolve these restrictions; ask your device administrator which options are allowed. If an enterprise tunnel or network filter is already installed, check compatibility before making changes, and don’t remove work configurations without approval.
Subscription Import: Accounts, Configurations and Routes
Installing a client doesn’t mean you have a route configured. A subscription link lets the client retrieve route settings and usually contains an account-related identifier. It isn’t a website login or an installer link. VPNFish doesn’t require an email address. Sign in to the dashboard with your account and follow its instructions to get subscription details for your client.
Look for an option such as Configuration, Subscription or Import from URL in the client. Paste the full link and update it. Clients use different configuration formats; support for the same protocol doesn’t mean they can read the same subscription format. If the dashboard offers options for different clients, choose the format for your software rather than relying on the file extension.
- Copy the subscription URL from the dashboard. Don’t include instructions, spaces or line breaks.
- Choose the remote subscription import option in the client, save it and update.
- Check that routes or a policy group appear in the list, then select a route.
- Start with rule mode and enable the system proxy. Change to another routing method only if needed, following the client’s instructions.
If import fails, identify which layer is causing the error. For “invalid URL,” check what you copied. For “parse failed,” check the format. For “protocol not supported,” check the client’s core and version. Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC are different protocols, and support varies by client. Changing the display name won’t make an incompatible configuration work.
Verify the connection: check your exit IP, routing rules and DNS separately
A client showing “Connected” usually means a connection feature is enabled, but doesn’t prove that all apps are using the intended route. Note your exit IP before connecting, then connect and check it on My IP. Location databases can take time to update, so don’t rely on the city name alone to verify a route.
Rule mode routes traffic based on domains, addresses or other conditions. A common setup sends local websites directly and routes selected international websites through a proxy. A local exit IP on one site may mean the rules are working as intended, not that something is broken. Check which policy group matched the domain and which route that group selected. You can temporarily switch to global proxy mode for comparison, then restore your usual rules.
DNS determines how domain names are resolved. A change in your exit IP doesn’t prove that DNS queries took the same route. Use a DNS test page alongside the client’s resolution logs to check whether requests behave as expected. Seeing a particular DNS provider in the results doesn’t, by itself, indicate a leak. Check whether queries bypassed a tunnel or DNS policy that was supposed to handle them.
- ✅ Test a website that needs a proxy, then confirm the matched rule and route in the client.
- ✅ Check your exit IP and DNS behavior separately; they measure different things.
- ✅ Test each app you actually use. Browser access doesn’t guarantee that terminal tools or other software are routed too.
- ❌ Don’t enable system proxies or tunnels in multiple clients at once to “stack” them for faster speeds.
Your browser may use Secure DNS, and some apps have their own proxy settings; either can change the route. If results don’t match expectations, note your original settings and compare them with the client’s documentation, changing one thing at a time. Changing browser settings, system DNS and routing rules together makes it hard to tell what fixed the issue.
Common issues: narrow down the cause by symptom
No permission prompt appears
First, check whether you enabled a mode that actually needs authorization. Importing a subscription, opening the app or using only the system proxy may not trigger a network extension prompt. Then check whether the relevant configuration or extension is already authorized in System Settings. If you previously denied a request, follow the client’s instructions to trigger it again and check for a pending approval in System Settings.
Authorized, but still can’t connect
First, pause the proxy and check whether your local network works. Then check that the subscription updated successfully and that your account plan and data status are in order. Try another route, verify your Mac’s date and time, and review the client’s error logs. Certificate errors, connection timeouts and DNS failures point to different problems; don’t assume they’re all caused by missing permissions.
If only some apps fail, check whether they follow the system proxy, have separate proxy settings, or need traffic routed by the current mode. Consider TUN only if you’ve confirmed it’s needed. Browser extensions, other VPNs and network filters can also affect routing. Rule them out one at a time without disrupting work configurations.
Disconnects after waking from sleep or switching networks
A connection may drop when you switch from your home network to another one. First make sure the new network has completed its own access authentication, then disconnect and reconnect in the client. Launch at login, background operation and automatic connection are separate settings: opening the app automatically doesn’t mean the system proxy or tunnel is enabled. Verify each one separately.
Websites stop loading after you quit the client
Check whether the current network service still points to a proxy running on your Mac. If the proxy process has quit but the system continues sending requests to it, connections may fail. Try reopening the original client and turning off the proxy normally. If needed, restore the previous settings in Network settings. Don’t clear settings still used by your organization’s network or another app.
Everyday use: check compatibility, then choose a plan for your usage
Route types and protocol names describe different things. IEPL leased lines, relay routes and direct connections refer to network paths or how access is organized; a protocol describes how the client and server communicate. A leased line doesn’t replace local authorization or guarantee that a third-party platform will accept a particular exit IP. Performance also depends on your local network, the destination service and route load. See route details on the server page.
VPNFish monthly plans are ¥9.9/60GB, ¥18/250GB and ¥28/500GB. Data resets monthly on your activation date. Data add-ons never expire, making them suitable if your usage varies. There’s no device limit, but usage is still subject to your plan’s data allowance. See plan pricing for full details. You don’t need to choose a higher tier just to complete setup.
VPNFish’s privacy policy states that it keeps no logs. That doesn’t mean third-party websites won’t retain account activity, and it doesn’t replace the need to protect your subscription link and local account. Keep your operating system, browser and client reasonably up to date. When asking for help, include your system version, client name, symptoms and steps already tried; that’s more useful than simply saying “it won’t connect.”