The VPN Auto-Launch
Virtual Private Networks (VPNs) are essential for securing internet traffic on public Wi-Fi or accessing corporate intranets. macOS features a robust built-in VPN client within its network settings. For convenience, macOS (and many third-party VPN applications) offer an “Connect on demand” or auto-reconnect feature. If your Wi-Fi drops momentarily, or if you restart your computer, the system will automatically re-engage the VPN tunnel. While great for security, this is highly problematic if you only need the VPN for a specific task (like checking a corporate email portal) and want to use your maximum, unencrypted bandwidth for casual browsing or downloading large files afterward.
Controlling the Tunnel
To ensure you only route traffic through your VPN when you explicitly choose to do so, you must disable the auto-connect and on-demand features within the macOS network configurations.
Click the Apple logo in the top-left corner and select System Settings. In the left-hand sidebar, click on VPN (or Network, depending on your macOS version). Locate your configured VPN connection in the list and click the small “i” (Information) button next to it. Look for a setting labelled Connect on demand or a checkbox that says Connect automatically when needed. Ensure this toggle is turned completely Off. Additionally, if you use a third-party application (like Cisco AnyConnect, NordVPN, or ExpressVPN), you must open the specific app’s preferences menu. Look under “General” or “Connection” settings for options like “Launch on startup” or “Auto-connect on untrusted networks” and disable them. You are now entirely in manual control of your secure tunnels.