The Unwanted Network Tunnel
Virtual Private Networks (VPNs) are essential for corporate security and personal privacy. However, macOS includes a feature called “VPN On Demand.” When this feature is activated by an IT administrator profile or a third-party VPN application, your Mac will automatically establish the VPN tunnel the moment it connects to the internet, or specifically when you try to access certain domain names. While designed for seamless security, this is incredibly annoying if you are trying to use a local network printer, play a low-latency video game, or access a streaming service that actively blocks VPN traffic. You try to disconnect the VPN in your menu bar, but five seconds later, the Mac forces the connection back on.
How to Disable VPN On Demand in System Settings
If the auto-connect feature is managed by the native macOS network settings (rather than a proprietary third-party app), you can disable it directly.
1. Click the Apple logo () in the top-left corner of the screen.
2. Select System Settings (or System Preferences on older versions of macOS).
3. In the left-hand navigation sidebar, click on VPN (If you don’t see VPN, look under “Network”).
4. Locate your active VPN connection in the list and click the small Info (i) button next to it.
5. Look for a setting labelled Connect on demand.
6. Uncheck the box or toggle the switch to the Off position.
7. Click OK or Done to save the changes.
Your Mac will now only connect to the VPN when you explicitly click the connect button in the menu bar.
How to Stop Third-Party VPN Apps from Auto-Connecting
If you are using a commercial VPN service (like NordVPN, ExpressVPN, or Cisco AnyConnect) with its own dedicated software, disabling the macOS setting might not work because the app’s internal daemon forces the connection.
1. Open your specific VPN application.
2. Open the application’s Settings or Preferences menu (usually accessible via the menu bar icon or by pressing Cmd + , while the app is active).
3. Look for a tab labelled “General,” “Connection,” or “Auto-Connect.”
4. Find the setting that says “Connect on launch,” “Auto-connect when on untrusted networks,” or “Always-On VPN.”
5. Disable these settings.
If your computer is managed by a corporate IT department using an MDM (Mobile Device Management) profile, the “Connect on demand” setting may be greyed out and locked. In that scenario, you cannot stop the auto-connection without contacting your IT administrator to remove the profile.