What macOS's Network Extension Approval Is, and Why Every VPN Client Needs It Separately

Any program that wants to create a virtual network adapter on macOS and route system traffic through its own tunnel has to request that capability through Apple's NetworkExtension framework — a mechanism Apple has enforced since macOS 10.15 Catalina, replacing the older and far more privileged kernel extensions (kexts).

The framework has two halves: the app bundles a piece of code meant to run with elevated system privileges, and the OS shows a confirmation prompt — only after you personally click Allow does that code actually get loaded and start handling traffic. Skip this step and the extension just sits "pending", which is why the client's icon keeps showing "connecting" forever without ever succeeding.

• Anything that can create a virtual adapter and take over traffic can, in theory, see all your unencrypted network data and silently redirect it — exactly the capability spyware wants most. Apple changed this from "works as soon as it's installed" to "requires a manual click in System Settings" specifically so nothing can gain this capability without your knowledge.
• This prompt only appears the **first time**: once a given client is approved, normal connections and reboots never trigger it again. It comes back if you reinstall the OS, install a fresh copy of the client, or turn the approval off yourself in System Settings.
• Each of the four clients has to clear this gate separately — the system tracks approval per requesting program, not as a single global switch. That is not redundant design; it is the actual granularity of the check.

Apple merged the "Login Items" and "Extensions" management screens in Sequoia. Network extensions now live inside this new screen's category view instead of being listed individually.

1. Open System Settings → General → Login Items & Extensions.
2. Scroll to the "Extensions" section at the bottom and switch the view in the top right from the default to "By Category" — without this, network extensions get buried in a long list alongside dozens of other system extensions.
3. With the view set to "By Category", find the "Network Extensions" category and click the ⓘ next to it to expand it.
4. Find the client you're using (Tailscale / OpenVPN Connect / Cisco Secure Client / Hiddify) and turn on the toggle next to it.
5. macOS will ask for your login password, or confirmation via Touch ID — this step confirms it's the person sitting at the machine granting the approval, not the client itself.
6. Once confirmed, the toggle switches to on. Go back to the client and reconnect — the tunnel should come up normally this time.

These two versions use the older entry point; the alert and the wording inside System Settings differ from Sequoia. Follow this path instead.

1. Launch the client normally and click Connect once — the OS only shows the prompt after a real connection attempt, not just from having the app installed.
2. A system notification appears, titled something like "System Extension Blocked". You can dismiss it or ignore it; the next step is to go find the setting yourself.
3. Open System Settings → Privacy & Security and scroll down (not the top — usually somewhere in the middle of the page) until you see a line reading "System software from developer '<the client's developer name>' was blocked from loading".
4. Click Allow next to that line; macOS will ask for your login password to confirm.
5. Go back to the client and reconnect — the tunnel should come up normally this time.

On Ventura / Sonoma, the name in quotes after "developer" is different for each client — match it to the one you're actually installing; do not click Allow if the name doesn't match what you expect:

• Private network (Tailscale): shows as "Tailscale Inc." — confirmed accurate against a real device.
• OpenVPN (OpenVPN Connect): expected to show as "OpenVPN Technologies, Inc.", not yet confirmed on a real device. If what you see differs, please contact support and we'll update this page.
• Cisco (Cisco Secure Client): expected to show as "Cisco Systems, Inc.", also not yet confirmed.
• Hiddify: expected to show as "Hiddify Team", also not yet confirmed.

• "I can't find the line System Settings is supposed to show": make sure you've actually launched the client and clicked Connect once, as described above — the OS only shows this line after it has received a real load request from the extension. Having the app installed but never opened won't produce it.
• "I accidentally clicked Don't Allow / dismissed the notification": there is no need to hunt for an undo button — just go back to the client and click Connect again. The OS will show the same prompt again, and you can go through the steps above; a single dismissal does not lock you out permanently.
• "On a company-issued Mac, the Allow button is greyed out": this is usually an MDM (device management) policy locking the setting — only an IT administrator can approve it from their console. Ask IT to add the client to the approved system extensions list.
• "I installed two of the four clients, but only one asked for approval": the other one probably hasn't been launched and connected yet — see the first item above.