Mac Internet Stops After a VPN Disconnect? Check the System Proxy

Web pages stop loading after you disconnect a VPN on your Mac. Wi-Fi stays connected, the signal looks normal, and other devices still work. Safari or Chrome spins because the VPN may have left an HTTP, HTTPS, SOCKS, or PAC proxy enabled after its route disappeared.

Check that proxy state before restarting the router or changing DNS. The steps below show where macOS stores the settings, how to inspect them, and how WiFi Lens separates a Mac-side routing problem from LAN or internet trouble.

Different symptoms need a broader sequence. Mac Connected to Wi-Fi but No Internet? Check DNS and Proxy Settings covers DHCP, DNS, captive portals, and router problems.

Why a VPN disconnect can leave browsing broken

The Wi-Fi icon in the menu bar reports one thing: your Mac has established a wireless link with an access point. Everything a web page needs happens above that link.

For a page to load, your Mac needs a valid IP address, the router needs to reach the internet, DNS needs to translate the domain, and — less visibly — your system proxy and VPN settings need to route traffic correctly. Any of these can fail while the Wi-Fi icon still looks healthy.

The confusing part is that failures are often selective. Messaging apps establish a connection when they start and keep it open, so they keep working while DNS or proxy problems block every new browser request. Other devices on the same network are unaffected because their settings differ. The result: Wi-Fi looks fine, the network looks fine, and only your Mac’s browsing is broken.

Think in three stages: This Mac, LAN, Internet

Instead of changing settings at random, sort every possible cause into three stages:

Stage	What it covers	Typical sign
This Mac	Network path, DNS, system proxy, VPN and virtual-interface routing	Only this Mac fails; messaging works but browsers don’t; trouble started after using or quitting a VPN
LAN	Reaching your router (gateway)	Wi-Fi shows connected but the Mac cannot reach its own router — often a DHCP or router problem
Internet	Connectivity beyond the router, ISP, captive portals	Every device on the network fails, or a public network is waiting for sign-in

Most “connected but won’t load” cases that affect a single Mac land in the This Mac stage — and inside that stage, proxy and VPN routing are the easiest things to miss.

How stale VPN and proxy routing breaks browsing

VPN apps create virtual network interfaces (often named utun...) and can configure the system proxy while they run. When the VPN app quits abnormally, or you leave a network while it was active, the proxy settings can stay behind. Traffic then tries to route through a server or tunnel that no longer exists, and browsing dies even though Wi-Fi is perfectly healthy.

Apple’s proxy settings guide lists the proxy mechanisms available in macOS. Any of them can be left in a stale state:

• Auto Proxy Discovery — macOS asks the network for a proxy configuration automatically
• Automatic Proxy Configuration (PAC) — a URL points to a script that decides when to use a proxy
• Web Proxy (HTTP), Secure Web Proxy (HTTPS), and SOCKS Proxy — explicit proxy servers for different traffic types

Proxy and VPN are not the same thing, but they overlap often: a VPN may set a system proxy, and a proxy app may create a virtual interface. That is why a check needs to look at both the proxy configuration and the interfaces traffic is routed through.

A three-stage check that runs on your Mac

WiFi Lens’s Network Self-Check was reworked in version 1.5.1 to follow exactly this three-stage structure: This Mac, LAN, and Internet, with results grouped into a workbench so you can see at a glance which layer is failing.

What the check covers:

• This Mac — whether the macOS network path is active, whether DNS can resolve a test domain, and the system proxy configuration (HTTP, HTTPS, SOCKS, PAC, and auto discovery)
• This Mac — whether a configured proxy routes through a virtual network interface such as a VPN or TUN device. This is the check that catches the stale-VPN scenario above
• LAN — whether your Mac can reach its gateway
• Internet — whether the Mac can reach the internet, using Apple’s authoritative captive-portal probe plus a stable HTTPS page
• Additional checks — IPv6 access, and evidence-based next steps when something is abnormal

Each check ends with one of three verdicts — Normal, Abnormal, or Indeterminate — and when a check fails, the app suggests a concrete next step. For example, “A configured proxy route could not be reached” points you to start the proxy app or disable the stale system proxy. “The network may require sign-in” tells you a captive portal is intercepting web access, so you look for a sign-in page instead of DNS settings.

Everything runs locally. WiFi Lens does not upload your diagnostic results, does not read or save proxy credentials, and does not send HTTP test requests through your proxies. The only network traffic is the connection and DNS checks the tool needs to test connectivity by design.

What to do when the proxy or VPN layer is the problem

If the check (or your own investigation) points at proxy or VPN routing:

1. Quit the VPN app completely — not just toggle it off in its menu. Check Activity Monitor or the app’s quit command if it keeps a helper running.
2. Write down your current proxy settings — System Settings > Network > Wi-Fi > Details > Proxies. Note what is checked before changing anything, so you can restore it.
3. Temporarily uncheck proxies you did not set for this network — if browsing returns, a stale proxy was the cause.
4. Check for leftovers in the terminal — scutil --proxy prints the active proxy configuration in a compact summary. If it shows a proxy you did not configure, that is likely your culprit.
5. On a managed Mac, check with IT first — corporate or school devices may require proxies. Do not remove them permanently.

After each change, re-run the network check. The app’s guidance includes a “run again” step so you can confirm whether the fix worked before moving on to the next suspect.

When the Mac is not the cause

The three-stage view also tells you when to stop blaming the Mac:

• Every device on the network fails — the problem is the router or ISP, not your settings
• Only one room is bad — this is usually coverage or congestion, not proxy routing. See Wi-Fi Slow in One Room? Don’t Replace Your Router Yet
• Only one app or service fails — the problem is usually that app, its servers, or its account state
• Public Wi-Fi shows a connection but no internet — check for a captive portal sign-in page before touching DNS or proxies

Where to go from here

If browsing stopped after a VPN disconnect, inspect the system proxy before changing the router or DNS. A three-stage check then confirms whether the fault stays on the Mac or extends to the LAN or internet path.

If your pages load but crawl in specific rooms, the room-by-room guide separates coverage problems from congestion before you spend money on equipment. For the full manual walkthrough of the “connected but no internet” scenario, see Mac Connected to Wi-Fi but No Internet? Check DNS and Proxy Settings.

To inspect the proxy, VPN route, gateway, and internet path on your Mac, see the WiFi Lens feature overview or download the open-source edition.

• Download WiFi Lens from the Mac App Store
• View the open-source code on GitHub
• Encountered a network problem or have feedback? Open an issue