How to set up a VPN: Windows 11, Mac, iPhone, Android and small business

What a VPN does, and what it does not do

A VPN client on your device wraps each packet in an encrypted tunnel that ends at a VPN server. The server unwraps the traffic and sends it on to the site or app you asked for. As EFF's Surveillance Self-Defense guide puts it, your requests then appear to come from the VPN rather than from your internet provider, and the website sees the server's IP address and approximate location instead of yours. The café Wi-Fi, the hotel network and your ISP see only encrypted traffic going to one server.

The same technology does different jobs. The Canadian Centre for Cyber Security (CCCS) lists four kinds: gateway-to-gateway (joining two offices), host-to-gateway (a remote worker's laptop into the company network), host-to-host, and third-party privacy, the consumer VPN you subscribe to. Setting up a VPN for yourself means the last kind; setting one up for staff means the second.

What a VPN does not do matters just as much:

• It does not make you anonymous. The VPN provider can now see what your ISP used to see, and sites can still track you through cookies, tracking pixels, browser fingerprinting and GPS. For anonymity, EFF points to Tor instead.
• It does not stop malware or phishing. CCCS is explicit that a VPN gives no protection against someone clicking a malicious link or downloading malicious content. That is the job of your browser, your email filtering and antivirus or EDR.
• It protects nothing past the server. From the VPN server to the website, traffic crosses the internet like any other, so HTTPS still does the real work of protecting logins and payments.
• It is not a reliable way around geo-blocking. EFF notes that streaming platforms increasingly block devices that appear to be using a VPN.

On public Wi-Fi, the case for a VPN is weaker than it used to be. The FTC now says that because most websites encrypt their traffic, using a public network is usually safe. What HTTPS does not hide is metadata: someone on the same network can still see which domains you visit and when. A VPN you trust hides that from the local network, which is worth having on a network whose operator you do not know. How that kind of interception works is covered in our guides to eavesdropping attacks and man-in-the-middle attacks. On an iPhone with iCloud+, iCloud Private Relay sends traffic through two separate relays so websites do not see your IP address, but Apple describes it in terms of Safari browsing: a browser privacy feature, not a VPN for every app.

How to choose a VPN provider

If the VPN is for your employer's network, skip this section: the provider is your IT team. For a personal VPN, you are moving trust from your ISP to a company, so choose the company carefully.

Audits are the strongest evidence a provider can offer, within limits. Proton VPN's page on its no-logs audits, for example, last updated on June 16, 2026, reports a fifth consecutive yearly audit by the security firm Securitum and lists what was checked on the servers: whether DNS queries, session timestamps, traffic contents or links between a user and a server are logged, and whether logging settings are protected by change control. Use that list to read any provider's report. EFF's caution still applies: an audit is a snapshot, and practices can change after it, especially under a government order.

VPN protocols compared

A kill switch blocks all internet traffic whenever the tunnel drops, so apps do not quietly fall back to your normal connection and reveal your IP address. In a provider's app it is a setting: turn it on. Company-managed devices can get the same behaviour from the operating system. With Apple's Always On VPN for IKEv2, if the tunnels are not up, all IP traffic is dropped.

One more check before you travel: VPN legality differs by country, and EFF advises keeping up with each country's policy on VPNs, including outright bans.

Set up a VPN app on Windows, Mac, iPhone and Android

A provider's app is the simplest route on every platform, because it handles the protocol, the server list and the kill switch for you:

1. Install the app from an official source. On Windows, Microsoft suggests checking the Microsoft Store for your service's app, or the provider's website for its connection settings. On a Mac, iPhone or Android phone, use the App Store or Google Play.
2. Sign in with the account you created, and follow the app's first-run prompts to create its VPN connection.
3. Open the settings before you connect. Turn on the kill switch, choose WireGuard or IKEv2 if the app lets you pick, and turn on automatic connection for untrusted Wi-Fi if the app offers it.
4. Pick a server near you, unless you need a particular country. Distance adds delay.
5. Connect, then check it worked. Search "what is my IP" before and after: the address shown should change to the VPN server's.
6. Keep the app updated along with the operating system (see how to keep your computer and phone updated). EFF notes that VPN software not updated against flaws such as TunnelVision may not protect you when it matters.

Where the connection lives on each platform:

Use the built-in VPN client in Windows 11

Windows 11 has its own VPN client for connections that do not need a vendor app, typically a work VPN or a provider that publishes IKEv2 settings. Get the server address, VPN type and sign-in method first, then follow Microsoft's steps:

1. Open Settings > Network & internet > VPN and select Add VPN.
2. For VPN provider, choose Windows (built-in).
3. Enter a Connection name you will recognize, and the Server name or address.
4. For VPN type, choose the one your provider or IT team specifies. Prefer IKEv2 when it is offered, and never choose PPTP.
5. For Type of sign-in info, choose what you were given: user name and password, one-time password, certificate or smart card. Select Save.
6. Connect from the same page, or from the VPN button in quick settings on the taskbar. The connection shows Connected, and a blue shield appears on the taskbar when you are connected to a recognized VPN.

Microsoft's Intune reference lists IKEv2, L2TP and PPTP, plus an Automatic option, as the native Windows VPN types; WireGuard and OpenVPN need their own apps. On a company laptop you may not have to type anything at all: IT can push the profile through Intune, set it to Always On so it reconnects when you sign in or change networks, and use a certificate on the device instead of a password.

Add a work VPN on a Mac, iPhone or Android phone

Work VPNs usually arrive ready-made, as the vendor's client app, a configuration profile, or a profile pushed by device management. Use that when you have it, and enter settings by hand only when IT gives you the values.

Mac

1. Choose Apple menu > System Settings, then click Network in the sidebar.
2. Click the Action pop-up menu, choose Add VPN Configuration, then choose the type: L2TP over IPsec, Cisco IPsec or IKEv2.
3. Enter a display name, then the server address, account name and authentication settings you were given. Click Create.
4. Connect and switch between VPNs from the VPN status menu in the menu bar.

If IT sent you a VPN settings file, Apple's guide says you can simply double-click it instead.

iPhone and iPad

Your company will normally send a configuration profile by email or through a web page, or install it with device management. iOS asks for permission before installing a profile and shows what it contains; afterwards you can review it in Settings > General > VPN & Device Management. Deleting a profile also deletes the settings, apps and data that came with it.

The built-in client handles IKEv2, L2TP over IPsec and Cisco IPsec without extra apps; any other VPN needs the vendor's app. Managed iPhones can also use per-app VPN, which sends only the organization's managed apps through the tunnel and keeps personal traffic out of it.

Android

1. Get the VPN details from your administrator. You may need to install their VPN app first and start setup there.
2. Open Settings > Network & internet > VPN (search for "VPN" if your phone's menus differ), tap Add, enter the details and tap Save.
3. Tap the VPN, enter your user name and password, and tap Connect.
4. To stay connected, tap the settings icon next to the VPN and turn on Always-on VPN.

Google's Android help notes that some of these steps need Android 14 or later, that the always-on option is not offered there for a VPN set up through an app, and that with a work profile the VPN can apply to work apps only.

Set up a VPN on your home router

A router VPN does one of two jobs, and they are easy to confuse:

• Router as VPN server. The router accepts connections from your phone or laptop when you are away, so you can reach a NAS, cameras or a printer at home, and route your browsing through your home connection when you are on public Wi-Fi.
• Router as VPN client. The router keeps a tunnel open to a VPN provider, and every device behind it uses that tunnel, including smart TVs and game consoles that cannot run a VPN app.

Both depend on your router's firmware, so check its admin pages or manual for a VPN section that offers WireGuard or OpenVPN. Prefer WireGuard where you have the choice. Open-source firmware shows what the setup involves: OpenWrt's WireGuard server guide uses its LuCI web interface like this:

1. Install the luci-proto-wireguard package (and qrencode if you want QR codes for phones), then restart the network service.
2. Add a new interface with the protocol WireGuard VPN, generate a key pair, and set a listen port (the guide uses 51820) and an internal address such as 10.0.0.1/24.
3. Add a peer for each phone or laptop: generate its keys, give it one address such as 10.0.0.10/32, and generate its configuration or a QR code to scan with the WireGuard app.
4. Allow the WireGuard UDP port from the WAN zone in the firewall, save and apply, then restart the WireGuard interface.

The phone's side of the tunnel ends up looking like this:

[Interface]
PrivateKey = <the phone's private key>
Address = 10.0.0.10/32
DNS = 192.168.1.1

[Peer]
PublicKey = <the router's public key>
Endpoint = home.example.com:51820
AllowedIPs = 192.168.1.0/24
PersistentKeepalive = 25

AllowedIPs decides what goes through the tunnel: WireGuard treats it as a routing table when sending and as an access list when receiving. With 192.168.1.0/24, only traffic for your home network uses the tunnel. With 0.0.0.0/0, ::/0, everything does, so a public hotspot only ever sees the tunnel. Address and DNS are wg-quick settings for the tunnel's own address and the DNS server to use while it is up.

A router VPN makes sense when you want devices without VPN apps covered, or one controlled way into your home network instead of exposing each device to the internet. It makes less sense when you only want protection on the move (a router client does nothing for your phone at a café), or when your connection has no reachable public address, in which case a router server cannot accept incoming connections. Either way, the router now runs an internet-facing service, so keep its firmware updated along with the rest of your home network.

Set up remote access for a small business

Remote access usually means putting a service on the internet for anyone to reach. In September 2021, NSA and CISA described VPN servers as entry points into protected networks, which makes them attractive targets, and published joint guidance on selecting and hardening them. Its top recommendations remain the baseline: products tested and validated on the NIAP Product Compliant List, multi-factor authentication, prompt patching, and a smaller attack surface with non-VPN features turned off.

Start by deciding what staff actually need to reach:

For a VPN gateway, CCCS recommends IPsec first, because it is an open standard; TLS VPNs often rely on custom, non-standard features and tie you to one vendor's client and server.

Whichever model you choose, set it up with these controls:

1. MFA on every remote sign-in, with phishing-resistant factors where you can, as both CCCS and CISA's 2024 guide on network access recommend.
2. Check the device, not only the person. Let only managed, encrypted and patched devices connect; a ZTNA broker can check device posture on every connection, and a VPN can require a certificate issued to managed devices.
3. Least privilege. Give each person the systems their role needs, not the whole network, and land VPN users in a restricted network segment.
4. Patch the gateway first, within days for anything in CISA's catalogue, and retire hardware the vendor no longer supports.
5. Shrink what the internet can reach. Turn off features the VPN does not need and restrict the gateway to the ports it uses: for IPsec, UDP 500 and 4500 plus ESP; for TLS VPNs, TCP 443.
6. Decide on split tunnelling deliberately. CCCS says to avoid it as much as possible. Microsoft's guidance for Microsoft 365 is narrower than it sounds: keep the tunnel, and exempt only the latency-sensitive Teams, SharePoint and Exchange Online endpoints it marks as Optimize, as least-privilege exceptions. Set that policy centrally, not per user.
7. Log and watch. Centralize management, alert on failed sign-ins, and scan your public-facing systems for vulnerabilities automatically.
8. End access the day someone leaves, including their certificates, sessions and devices.

A sample of VPN and remote access flaws in CISA's Known Exploited Vulnerabilities catalogue, by the date CISA added them (as of September 2026):

CISA's 2024 guide adds that Citrix Bleed let attackers bypass passwords and MFA by hijacking legitimate sessions, which is why MFA alone does not make an unpatched gateway safe. Two emergency directives show what patching alone can miss. ED 24-01, issued on January 19, 2024, led to US federal agencies being ordered to disconnect Ivanti Connect Secure appliances by February 2, 2024, and warned that attackers may keep rootkit-level persistence that survives a factory reset. ED 25-03, issued on September 25, 2025 for Cisco ASA and Firepower devices, states that applying Cisco's updates does not necessarily remove an attacker already on the device, and required agencies to disconnect ASA hardware whose support ended on or before September 30, 2025. For a small business the lesson is the same: when your VPN appliance appears in an advisory, patch it, then find out whether it was compromised before the patch.

Zero trust changes the question from "is this user on our network?" to "should this person, on this device, reach this application now?". NIST SP 800-207 defines zero trust as granting no implicit trust based on network location, and authenticating and authorizing both the user and the device before each session. In CISA's description of ZTNA, an access broker verifies identity and policy, can check device posture and enforce MFA, and grants access to each application on a least-privilege basis; the same 2024 guide urges businesses of every size to move toward zero trust, Secure Service Edge (SSE) and Secure Access Service Edge (SASE).

In a Microsoft 365 business, Microsoft Entra Private Access is one example: remote workers with the Global Secure Access client reach internal apps and resources without a VPN, and Conditional Access policies decide who gets in.

Most of what good remote access depends on is identity and device management. Our IT support team sets up MFA and conditional access, enrols laptops and phones in Microsoft Intune or Jamf, and runs offboarding as one documented sequence, so access ends when employment ends. Our security scanning checks exposed services, such as a VPN gateway, for known CVEs and ranks findings with the CISA KEV catalogue, so what attackers exploit today is fixed first. For the wider picture, see our cybersecurity checklist for small business.

Fix common VPN problems