Manually configuring a VPN on Mac means entering a VPN’s connection details directly into macOS’s built-in VPN client, rather than installing a separate VPN app. This method requires having the server, account, and authentication details already on hand, typically from an administrator or VPN provider, before starting.
What Manual VPN Configuration Means on Mac
Manual VPN configuration is the process of building a VPN connection in macOS by entering its technical details by hand through System Settings, then Network, instead of relying on an app that handles this automatically. This method is native to macOS and doesn’t require installing additional software, but it only works with the VPN types macOS’s built-in client supports.
What You Need Before You Start
Manually configuring a VPN on Mac requires three categories of information gathered in advance: the VPN type, the server and account details, and the authentication details. Without these from the VPN provider or network administrator, the configuration cannot be completed.
VPN Type
macOS’s built-in VPN client supports IKEv2, Cisco IPSec, and L2TP over IPSec as manual configuration types. The correct type must be confirmed with the VPN provider or administrator beforehand, since selecting the wrong type will prevent the remaining fields from matching what the VPN server expects.
The table below summarizes how the available settings differ across these three types.
| VPN Type | Typical Authentication | Remote ID / Local ID | Additional Settings Available |
| IKEv2 | Username/password, certificate, or shared secret, depending on the server | Required on some configurations | DNS, Proxies |
| Cisco IPSec | Shared secret combined with username/password, or a certificate | Not applicable | DNS, Proxies |
| L2TP over IPSec | Shared secret combined with username/password | Not applicable | Options, TCP/IP, DNS, Proxies |
Server and Account Details
A server address and account name are required for every manual VPN type in macOS. The server address is typically a domain name or IP address provided by the VPN service, and the account name identifies the specific user connecting.
Authentication Details
Authentication details confirm identity to the VPN server and vary by VPN type: a password, a shared secret, or a certificate, depending on what the provider’s configuration requires. Having the correct authentication method ready before starting prevents an incomplete or failed configuration.
How to Add a VPN Configuration in macOS
A new VPN configuration is added through System Settings, then Network, then the Action pop-up menu, then Add VPN Configuration, where the VPN type is selected before any connection details are entered.
Open the VPN Configuration Settings
Open System Settings, then click Network in the sidebar. This is the starting point for every manual VPN configuration on macOS, regardless of which VPN type is being added.
Add a New VPN Service
Click the Action pop-up menu (the gear or three-dot icon near the network list) and choose Add VPN Configuration, then select the VPN type: IKEv2, Cisco IPSec, or L2TP over IPSec. If setting up L2TP over IPSec, an additional Configuration pop-up menu appears for selecting a configuration profile.
Enter a Name for the Connection
macOS prompts for a display name to identify the new VPN service in the network list. This name is only a local label for organizing configurations and has no effect on the connection itself.
How to Enter the VPN Connection Details
The core connection details, server address, account name, and identifiers where required, must match exactly what the VPN provider or administrator supplied. An incorrect entry in any of these fields will prevent the connection from completing.
Enter the Server Address
The server address field accepts the domain name or IP address provided by the VPN service, and must be entered exactly as given, since even minor typos will cause the connection to fail.
Tip: Where possible, copy and paste the server address and any ID fields directly from the information supplied by the provider or administrator rather than retyping them. This avoids the single-character typos that are a common cause of failed manual configurations.
Enter the Account Name
The account name field identifies the specific user account authenticating to the VPN server. This is typically the username issued by the provider or administrator, separate from any password or certificate used for authentication.
Enter the Remote ID and Local ID When Required
IKEv2 configurations may require a Remote ID (identifying the VPN server) and a Local ID (identifying the connecting device or user), depending on how the server is configured. Not every IKEv2 setup requires both fields; which ones are needed is determined by the VPN provider’s specific configuration.
How to Set the Authentication Details
Authentication details must match the method the VPN server expects: username and password for most configurations, or a certificate or shared secret where the VPN type and server configuration require it.
Username and Password
Most manual VPN configurations in macOS accept a username and password entered directly in the VPN settings. These credentials are typically the same account details referenced in the server and account information supplied by the provider.
Certificate or Shared Secret When Required
Some configurations, particularly Cisco IPSec and certain IKEv2 setups, require a shared secret (a pre-agreed passphrase) or a certificate installed on the Mac instead of, or in addition to, a password. Which is required depends entirely on how the specific VPN server is configured, not on a universal macOS default.
Tip: If a certificate is required, it typically needs to be installed in macOS’s Keychain Access before it will appear as a selectable authentication option in the VPN settings.
How to Review and Save the Configuration
Before saving, every entered field (VPN type, server address, account name, and authentication details) should be checked against the information supplied by the provider or administrator. Clicking Apply or OK saves the configuration as a new entry in the Network list without automatically connecting it.
How to Use a VPN Configuration File Provided by an Administrator
Some organizations provide a VPN configuration file (a .mobileconfig profile) instead of requiring each field to be entered manually. Opening this file on the Mac typically prompts macOS to install the VPN configuration automatically through System Settings, then Profiles, which fills in the fields a manual setup would otherwise require by hand.
How to Confirm the VPN Configuration Was Added Correctly
A correctly added VPN configuration appears as a new entry in System Settings, then Network (and subsequently under System Settings, then VPN), with the connection name chosen during setup. Selecting Connect and reaching a “Connected” status confirms the entered details are accurate; a failure to connect points to one of the fields covered in the next section.
Common Manual Configuration Errors to Check
A manual VPN configuration that fails to connect is usually caused by one of four issues: an incorrect VPN type, incorrect server or identity details, incorrect authentication information, or a missing or invalid certificate.
Incorrect VPN Type
Selecting a VPN type that doesn’t match what the server actually uses, for example choosing IKEv2 when the provider requires L2TP over IPSec, will prevent a connection regardless of how correctly the other fields are entered. Confirming the exact type with the provider resolves this.
Incorrect Server or Identity Details
A mistyped server address, or an incorrect Remote ID or Local ID on an IKEv2 configuration, is one of the most common causes of a failed manual setup. Re-checking these fields character by character against the original information supplied is the most direct way to rule this out.
Incorrect Authentication Information
An incorrect password, username, or shared secret will cause macOS to reject the connection, typically with a generic authentication error rather than one specifying which field is wrong. Re-entering these details carefully, rather than assuming they were saved correctly the first time, resolves most cases.
Missing or Invalid Certificate Details
A configuration that requires a certificate will fail if the certificate hasn’t been installed in Keychain Access, has expired, or doesn’t match what the server expects. Verifying the certificate is both installed and current is necessary before the authentication fields can work correctly.
When a Separate VPN Client Is Required
Manual configuration in macOS only supports VPN types natively built into the system: IKEv2, Cisco IPSec, and L2TP over IPSec. A VPN service using a different protocol, such as OpenVPN or WireGuard, cannot be manually configured through System Settings and requires a dedicated VPN app instead.
Frequently Asked Questions
Can I save more than one VPN configuration on my Mac?
Yes. macOS can store multiple VPN services, allowing separate configurations for different VPN servers, organizations, or connections, and it supports switching between configured VPN services.
Does saving a VPN configuration automatically connect the VPN?
No. Saving or creating the configuration adds the VPN service to macOS; connecting is a separate action. Some configurations can use Connect on Demand to start the VPN automatically when needed.
Can I edit a manual VPN configuration after saving it?
Yes. Open System Settings, then VPN, select the information button beside the VPN service, change the required settings, and save them. Recreating the entire configuration from scratch normally isn’t necessary.
Does a manually configured VPN work on both Wi-Fi and Ethernet?
Yes. A VPN uses the Mac’s existing internet connection, so it can operate over Wi-Fi or Ethernet. The underlying network connection provides internet access while the VPN establishes its secure connection over it.
Can I manually configure a work or school VPN on Mac?
Yes. If the employer, school, or network administrator provides a VPN type, server address, account information, and required authentication details that macOS supports, those settings can be entered manually following the same process.