VPN, proxy and filters

VPN connected but no internet on a Mac

A VPN sends traffic through a tunnel. If the tunnel, its routes or its DNS do not work, the VPN shows Connected but sites do not load.

Applies to: macOS 13 Ventura and later for System Settings. The commands work on all current macOS versions.Checked: 29 October 2026

Symptoms

The network under the VPN. The VPN needs a working Wi-Fi or Ethernet connection. A captive portal or a weak signal stops the tunnel.
Routes. A full-tunnel VPN sends all traffic to the VPN server. If that server cannot reach the internet, nothing loads.
DNS. The VPN can set its own DNS servers. If they do not answer, names do not resolve.
An address overlap. If your local network uses the same address range as the company network, traffic can go to the wrong place.
Another VPN or filter. A second VPN, firewall or content filter can block the tunnel traffic.

Disconnect the VPN. Make sure that sites load without it.
Connect the VPN again. Show the VPN services and their status.
```
scutil --nc list
```
Show which interface the default route uses now.
```
route -n get default
```
Output The interface line shows a utun interface when a full-tunnel VPN is on.
Show the full routing table.
```
netstat -rn
```
Show the DNS servers that the VPN added.
```
scutil --dns
```
Test the name and the address separately. A reply to the address but not the name points to DNS.
```
ping -c 3 1.1.1.1
ping -c 3 example.com
```

Disconnect and connect the VPN again.
If you are on public Wi-Fi, disconnect the VPN. Complete the network login page first, then connect the VPN.
Quit other VPN, proxy and firewall apps. Then test again.
If DNS fails, ask your VPN provider or IT team for the correct DNS settings. Do not change them without their advice.
Restart the Mac if the VPN still fails.
Remove and add the VPN configuration again. Choose Apple menu > System Settings > Network, or use the VPN app.

Kilobat's connection check compares the direct path with the VPN path. It also checks a private VPN resolver.
```
kilobat why intranet.example.com
```
List the physical and VPN interfaces with their counters.
```
kilobat interfaces --json
```
Find whether the problem is the Wi-Fi, the router, the internet or DNS.
```
kilobat diagnose
```
These commands are free. See Find why one site or API won't connect for the app steps.

Why do sites load by IP address but not by name?

The tunnel works, but DNS does not. The VPN's DNS servers do not answer, or the Mac sends names to the wrong server.

Can I run two VPNs at the same time?

Sometimes, but many VPNs block traffic that does not use their tunnel. Use one VPN at a time if you can.

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with man <name> in Terminal.