When you use an acceleration service on a Mac for the first time, the first step is not picking a server, but installing the client correctly. The macOS install flow has two extra hurdles compared to Windows: make sure the download comes from the official source, and get past Gatekeeper on first launch.
Install the client: download source and install steps
Download the client
Get the client from the download page on the provider's official website. Do not download from third-party download sites or cloud drive links. Installers from third-party channels may be repackaged; at best your subscription link gets swapped, at worst malware is planted.
Once you have the installer, double-click the .dmg file and drag the client into the Applications folder. If the system says "damaged and cannot be opened", that is usually Gatekeeper blocking an unsigned app. Go to System Settings → Privacy & Security and click "Open Anyway". If that button is grayed out, click the lock icon in the lower-left corner, enter your admin password, and try again.
First launch
After launching the client, macOS may show several permission prompts. These are not ads or malicious pop-ups; the system is confirming that you want this program to take over the network. A macOS accelerator client cannot take over the network directly; it must work through the Network Extension framework, so the authorization dialogs on first launch are unavoidable.
Network Extension / System Extension / Notifications
more causes connection failure
IP check + DNS leak check
System authorization: Network Extension and permission dialogs
Network Extension authorization
On first launch, the system will prompt "xxx wants to install a Network Extension. Allow?". You must click "Allow", otherwise the client cannot establish a connection.
The Network Extension authorization dialog on first launch must be allowed. If you click "Don't Allow", the client can still open but cannot establish any connection, and you will need to manually re-enable it in System Settings later.
If you didn't allow it at the time, or accidentally clicked "Don't Allow", go to System Settings → Privacy & Security → Network, find the client, and turn the switch on manually.
System Extension authorization
Some clients also request "System Extension" authorization, mainly for kernel-level traffic forwarding. This authorization is in the "System Extension" section at the bottom of System Settings → Privacy & Security. If you see "xxx was blocked from loading a System Extension", click "Allow".
Notifications and local network permissions
Some clients request "Notifications" permission to show connection status changes. This permission is optional; not granting it does not affect the connection, you just won't see connection success/disconnect notifications.
The "Local Network" permission is more important. If the client needs to scan devices on the local network (for example for LAN sharing), it needs this permission. If you only want to use it for yourself, you can skip it.
Import subscription link: from copy to active
What a subscription link looks like
A subscription link is a URL provided by the provider that contains all the server information. After importing, the client automatically pulls the node list, so you don't have to configure each one manually.
Subscription links usually start with https:// followed by a long string. Some providers also offer links starting with clash://, which is a dedicated format for Clash-family clients. A typical subscription link looks like this:
https://example.com/subscribe?token=xxxxxxxxxxxxxxxx
Import steps
- ✅ Open the client and find the "Subscription" or "Profiles" tab
- ✅ Click "Add" or "Import"
- ✅ Paste the subscription link into the input field
- ✅ Click "OK" or "Import", and the client automatically pulls the node list
- ✅ Select a node, click "Connect", and watch the status change
What to do if import fails
If the node list is empty after importing, first check whether the link was copied in full. Some chat apps truncate long links automatically; when copying, it is best to use the "Copy Link" button rather than manually selecting text.
If the link is fine but it still fails to pull, the network environment may be preventing the subscription address from being reached. Try a different network, or open the subscription link in a browser to confirm it returns text content normally.
Verify it works: from IP to DNS leak check
After a successful connection, don't just look at the green icon in the top-right corner of the client; you should actually verify that traffic is really going through the proxy.
Don't assume everything is fine just because the green icon in the top-right corner of the client is showing. The client showing "Connected" only means the proxy process is running, not that traffic is really going through the proxy. Always verify with an external tool.
Check the IP address
The most direct way is to visit https://ip.sb or https://ifconfig.me and see whether the displayed IP address matches the region of the node you selected. If the IP is your local one, traffic is not going through the proxy, and you need to check the client configuration.
Check for DNS leaks
A DNS leak means: traffic goes through the proxy, but DNS queries do not, and are sent directly to your local ISP. That way the ISP can still see the domains you visit.
To check, visit https://www.dnsleaktest.com and click "Standard Test". If your local ISP name appears in the results (for example China Telecom or China Unicom), there is a DNS leak, and you need to turn on the "DNS Proxy" or "DNS Hijack" switch in the client settings.
Check the routing rules
Routing rules decide which traffic goes through the proxy and which goes direct. To check whether routing is working, look at the latency when visiting domestic sites. If domestic sites also go through the proxy, speed will be noticeably slower, which means the routing rules are not working.
| Check item | Tool | What to look at | Normal result |
|---|---|---|---|
| IP address | ip.sb | Exit IP region | Matches the selected node |
| DNS leak | dnsleaktest.com | DNS server ownership | No local ISP |
| Routing rules | Visit domestic sites | Latency | Close to direct connection |
Additionally, if you are using a Clash-family client, you can see the detailed process of each connection in the "Logs" tab. The log records DNS queries, TCP connections, TLS handshakes, and so on. If a step keeps hanging, the corresponding node or protocol has a problem.
FAQ: what to do when a permission dialog won't show up
Can't find the Network Extension authorization entry
If you clicked "Don't Allow" on first launch and want to re-authorize later, go to System Settings → Privacy & Security → Network. If the client is not in the list, first go to System Settings → General → Log Out and log back in, then open the client again; the system will re-prompt for authorization.
Can't find the System Extension entry
The "System Extension" authorization entry is at the very bottom of System Settings → Privacy & Security. If you can't find it, first check whether there is a "System Extension" section. Starting with macOS Ventura, the location of the System Extension entry has changed. If you really can't find it, you can try running sudo spctl --master-disable in Terminal to temporarily disable Gatekeeper, but this is not recommended; it is better to find the correct authorization path.
Also, if you are using macOS 15 or later, the location of the System Extension authorization may be adjusted. If you can't find the entry, type "Network Extension" or "System Extension" directly into the search box in the top-right of System Settings, and the system will jump to the corresponding settings page.
What if the client can't connect
If the client shows connected but you can't visit any site, try switching to a different node first. Some nodes may be under maintenance. If all nodes fail, check whether the system time is correct — a clock skew of more than 5 minutes causes TLS handshake failures.
Conclusion: get the flow working before optimizing
From install to active, the macOS accelerator configuration flow is roughly the steps above. The first time you may be overwhelmed by all the permission dialogs, but once you get the flow working, daily use is actually simple: open the client, pick a node, connect — three steps and you're done.
The macOS accelerator configuration flow is not complicated; the hard part is mainly the system authorization step on first launch. Once you get past the Network Extension authorization hurdle, the subsequent subscription import and verification are standard operations. When a permission dialog won't show up, go through System Settings → Privacy & Security item by item, and you can usually find the corresponding switch.
Finally, a few practical tips: keep the client up to date, because with every major macOS upgrade the Network Extension authorization mechanism may change; subscription links update regularly and providers occasionally adjust servers, so re-importing the subscription gets you the latest node list; when something goes wrong, check the client logs first, as most problems can be traced in the logs.