Set up the NetOz VPN on a Mac with WireGuard
Install WireGuard from the Mac App Store, import your NetOz VPN configuration file from your setup link, allow the VPN configuration and connect from the menu bar.
On this page
This guide shows you how to connect a Mac to your organisation's NetOz managed VPN using the official WireGuard app. It takes about five minutes and works on any recent version of macOS on both Apple silicon and Intel Macs.
Before you start
- Find the setup email NetOz sent you on behalf of your organisation. Its subject starts with the name of your VPN, followed by "set up" and the name of this device.
- Make sure the link is for this Mac. Each device gets its own link. Using the same link on a second device stops both from connecting.
- You need an Apple ID signed in to the App Store to install WireGuard.
Step 1 Install WireGuard from the Mac App Store
Open the App Store on your Mac, search for WireGuard and install the free app published by WireGuard Development Team. You can also follow the macOS link at wireguard.com/install.
Open WireGuard once it has installed. A WireGuard icon appears in the menu bar at the top of the screen.
Step 2 Open your setup link
Open the setup email on your Mac and select the link. Your browser shows your personal setup page with:
- An On a phone section with a QR code, which you can skip on a Mac.
- An On a computer section with a Download button.
- A What you'll be able to reach list showing the networks the VPN carries.
If you see This link is no longer valid, the device or your access has been removed or replaced. Ask your administrator to send you a new link.
Step 3 Download your configuration file
In the On a computer section, select the Download button. The file name ends in .conf and is named after your VPN and this device. Safari saves it to your Downloads folder by default.
The file contains your device's private key. Keep it to yourself and do not copy it to any other computer.
Step 4 Import the tunnel
In the WireGuard app window, choose Import tunnel(s) from file. You can also click the WireGuard icon in the menu bar and choose Import Tunnel(s) from File. Select the .conf file in Downloads and choose Import.
macOS asks whether WireGuard may add VPN configurations. Choose Allow. You may be asked for your Mac password or Touch ID to confirm.
The tunnel now appears in the WireGuard window. Once it is imported you can delete the downloaded file. You can always download it again from the same link.
Step 5 Connect
Select the tunnel in the WireGuard window and choose Activate, or click the menu bar icon and choose the tunnel name.
The status shows Active, and after a few seconds you should see a Latest handshake time and data in the Transfer row. A recent handshake confirms your Mac is connected to the NetOz VPN server.
To disconnect, choose Deactivate or untick the tunnel in the menu bar.
Step 6 Check you can reach work systems
Open an internal system your organisation gave you, such as a private web app, file server or remote desktop host. If it loads, you are connected.
You can also check the VPN status in System Settings, under VPN, where the WireGuard tunnel appears alongside any other VPNs.
How the NetOz VPN behaves on a Mac
Split tunnel by design. Only traffic to the addresses listed under What you'll be able to reach goes through the VPN. Your normal browsing, iCloud, video calls and streaming still use your own internet connection. Your public IP address does not change for everyday browsing.
On or off, nothing breaks. You can leave the tunnel on all day or switch it on only when you need work systems. Either is fine.
DNS stays the same. NetOz configurations do not set DNS servers, so your Mac keeps using its normal DNS. If a company hostname does not resolve, try the IP address your administrator gave you.
Leave the settings alone. NetOz chooses settings such as the MTU so the tunnel works reliably on home and mobile networks. Editing the tunnel can stop it working.
Updating or moving the VPN
- The setup page says the network changed: your organisation has updated which networks the VPN reaches. Download the file again, delete the old tunnel in WireGuard and import the new one.
- New Mac: do not copy the tunnel across. Ask your administrator to add the new Mac as a device so it gets its own link, and to remove the old one.
- Reinstalled WireGuard: open your original setup link again and re-import. The link keeps working for as long as the device is active.
If something does not work
If there is no handshake time, the network you are on may block WireGuard traffic. Try a phone hotspot to confirm, then see Troubleshooting the NetOz WireGuard VPN for more fixes.
Next steps
Was this guide helpful?
Your answer helps us keep these guides accurate.