VPN for Mac: set up WireGuard on macOS

Does macOS come with a VPN?

No. System Settings has a VPN section, but that is a slot for configurations, not a service: there is no server on the other end. A provider supplies the server and a client builds the tunnel. On a Mac, the official WireGuard app is that client, free, open source and integrated with the system.

Because it uses the system's own network extension framework, it appears under System Settings and toggles from the menu bar.

The alternative most people meet first is a browser extension, which covers only that browser; Mail, Messages, Slack, cloud sync and every other app keep talking to the internet directly. WireGuard on macOS captures all of it, which is the point when your Mac lives on networks you do not control. SuaVPN has no browser extension and no app of its own, and a Mac needs neither: the panel produces the configuration and WireGuard does the rest.

Two limits up front: a VPN hides your traffic from the local network and your address from the sites you visit, but it does not make you anonymous once you sign in somewhere. And SuaVPN has no split tunneling, so on a Mac the tunnel carries everything or nothing.

Installing WireGuard from the Mac App Store

The App Store build is the one to use day to day: a universal app that runs natively on Intel and Apple Silicon (M1 through M4) and survives macOS upgrades cleanly. The steps assume you already have a SuaVPN plan, listed on the pricing page.

With the tunnel active, the app shows the latest handshake and the data counters. A blank handshake field means the tunnel is not reaching the server yet; the troubleshooting section below covers the usual causes.

• Install WireGuard from the Mac App Store and open it.
• In the SuaVPN panel, under Devices, create a device named after your Mac, choose a location from those listed on the status page, and save the .conf file. The panel also shows a QR code, but that is meant for phones.
• In WireGuard, click "Import tunnel(s) from file" (also available in the File menu) and pick the .conf.
• macOS asks you to allow the app to add a VPN configuration. Approve it; this prompt appears only the first time.
• Select the tunnel and click "Activate". From then on, the WireGuard icon in the menu bar toggles the tunnel without opening the window.

Does the WireGuard Mac app have a kill switch?

No. Unlike the Windows client, the macOS app has no checkbox that blocks traffic outside the tunnel. On-demand activation is the closest equivalent: edit a tunnel, tick Wi-Fi under On-Demand, and macOS brings the tunnel back after sleep and whenever the Mac joins a wireless network.

The rule can be narrowed by network name: any network, only the ones you list, or every network except the ones you list. Most people land on "any Wi-Fi except home", which covers cafes, hotels and airports while leaving the home network alone.

A related toggle on the same screen is "Exclude private IPs". Turn it on to keep printing, AirPlay and access to a NAS on the local network while the tunnel is up; leave it off on public Wi-Fi, where you have no reason to talk to the devices around you.

The terminal route: Homebrew and wg-quick

If you would rather skip the menu bar app, Homebrew has the same tools Linux uses: brew install wireguard-tools gives you wg and wg-quick. Copy the .conf into /opt/homebrew/etc/wireguard/ on Apple Silicon or /usr/local/etc/wireguard/ on Intel with a short file name, since it becomes the interface name. Then sudo wg-quick up followed by that name starts the tunnel, sudo wg-quick down stops it, and sudo wg shows the state and the latest handshake.

Both routes use the identical .conf from the panel, so you can switch between them without touching your device in SuaVPN. Just do not run both at once for the same tunnel: the app and wg-quick would each try to own the route and the DNS setting, and the Mac ends up reaching nothing. The terminal route is also the right fit for scripts and headless Macs, such as a Mac mini working as a home server.

Checking it works, and fixing common Mac problems

With the tunnel active, open any site that shows your public IP address. It should display the city and country of the location you picked, not where you are. In the app, the latest handshake should be under two minutes old and the counters should climb as you browse. If the address shown is still yours, the tunnel is not carrying your traffic.

If the handshake never appears, check the status page first: a location that is down looks identical to a broken configuration from the Mac's side. Then run through the list below. When writing to support, mention the handshake time and whether you use the app or wg-quick.

• Tunnel active, no internet: deactivate and reactivate it; if it persists, generate a fresh configuration in the panel and import it again.
• No handshake at all: a third-party firewall such as Little Snitch or LuLu may be blocking WireGuard's outbound UDP. Allow it in the firewall rules, or test on another network.
• DNS does not change: another VPN client or a DNS filtering tool installed at the same time usually conflicts. Disable it to test.
• Safari behaves differently from other apps: iCloud Private Relay may be in the way. Turn it off in System Settings, under your Apple ID and iCloud, while the tunnel is active.
• The tunnel vanished from the menu bar after a macOS update: open the WireGuard app once so the system extension registers again.

Mac, iPhone and iPad on one subscription

Each device gets its own configuration and key pair in the panel, within the device limit of your plan: Basic covers 3 devices, Pro 5 and Family 10. A Mac that keeps two locations ready uses two slots. Per-device keys mean you can revoke a lost MacBook without touching the iPhone, and each can point at a different location. The iPhone scans the QR code; the Mac imports the file.

Billing is deliberately plain: current prices are on the pricing page, payment is by card through Stripe from anywhere, and you can cancel at any time. Purchases can be refunded within 7 days under Brazilian consumer law, which works as a trial on your own Mac and network. SuaVPN does not offer dedicated IP addresses or a business plan. Available locations are the ones listed on the status page; the iPhone guide covers the phone side of the same subscription.