How to Connect and Manage VPNs in macOS Terminal Using scutil

Connecting to corporate Virtual Private Networks (VPNs) on macOS is typically handled through the graphical interface in System Settings or via the menu bar network status item. However, when automating secure file transfers, scheduling nightly database backups over private tunnels, or administering headless Mac mini build servers, an automated command-line interface is essential.

While third-party VPN clients frequently require proprietary CLI tools, macOS contains native VPN control built into the System Configuration utility (scutil --nc). Using scutil --nc, administrators can query configured VPN profiles, start and terminate secure connections, and monitor tunnel status directly from terminal shell scripts.

Auditing Configured VPN Connections

To view all native network connection services and VPN profiles registered in macOS Network Settings, open Terminal and execute:

scutil --nc list

The command outputs a structured list of available network configurations:

Available network interface services:
* (Connected)    6F8B2C4E-1234-5678-ABCD-001122334455 PPP --> IP (IPSec) "Corporate VPN" [PPP:IPSec]
  (Disconnected) 9A1B3C5D-8765-4321-DCBA-998877665544 IPSec "Staging Gateway" [IPSec]

Interpreting the Output Flags:

• * (Connected): Indicates an active, established VPN tunnel.
• (Disconnected): The profile is configured but currently inactive.
• (Connecting) / (Disconnecting): A cryptographic handshake or teardown is in progress.
• The string in quotation marks (e.g., "Corporate VPN") is the service name used for command targeting.

Starting a VPN Connection from the Terminal

To establish a VPN tunnel, pass the start directive along with the friendly service name in quotation marks:

scutil --nc start "Corporate VPN"

If your VPN configuration requires interactive authentication (such as a username, password, or two-factor token code), you can pass parameters explicitly:

scutil --nc start "Corporate VPN" --user "admin" --secret "presharedkey"

Verifying Tunnel Status and IP Addressing

To confirm that the connection has fully established:

scutil --nc status "Corporate VPN"

A successful connection reports Connected. You can also inspect the newly assigned virtual network interface (typically utun0, utun1, or ppp0) and verify your internal subnet IP address:

ifconfig utun0

Check the system routing table to verify that corporate subnets route through the tunnel interface:

netstat -rn -f inet | grep utun

Terminating the VPN Connection

To gracefully disconnect the VPN tunnel and restore standard local routing, pass the stop command:

scutil --nc stop "Corporate VPN"

Verify that the service transitions back to (Disconnected):

scutil --nc status "Corporate VPN"

Automating VPN Tunnels in Shell Scripts

You can encapsulate scutil --nc into shell scripts that connect to a secure network, execute administrative tasks, and disconnect automatically even if an error occurs, using a bash trap:

#!/usr/bin/env bash
set -euo pipefail

VPN_NAME="Corporate VPN"

# Ensure VPN disconnects upon script termination or interruption
cleanup() {
  echo "Tearing down VPN tunnel..."
  scutil --nc stop "$VPN_NAME" > /dev/null 2>&1 || true
}
trap cleanup EXIT

echo "Connecting to $VPN_NAME..."
scutil --nc start "$VPN_NAME"

# Wait for handshake completion (up to 15 seconds)
for i in {1..15}; do
  if scutil --nc status "$VPN_NAME" | grep -q "Connected"; then
    echo "VPN tunnel established."
    break
  fi
  sleep 1
done

# Perform secure backup operations over the tunnel
echo "Executing remote synchronization..."
rsync -avz /local/data/ [email protected]:/backup/

echo "Task completed successfully."