the Mac woke up. the tunnel did not.

why your vpn disconnects when the Mac sleeps

• sleep tears down the network. the tunnel's session ends, and from the server's point of view you disconnected.
• on wake the interface returns with a new state — maybe a new address, maybe a different network. the old session cannot be resumed even in principle.
• worst case, which is this whole page: the client still displays «connected» because it has not checked. you find out from a page that will not load.

does macOS know the tunnel went away?

no, and you can see that yourself. `pmset -g log` holds what the power subsystem recorded about sleeping and waking — 124 952 lines of it on the Mac this page was written on. filter it with `pmset -g log | grep -i -E 'vpn|utun'` and nothing comes back. not one line. the part of the system deciding what to restore on wake has no idea a tunnel existed.

if the client says connected and pages still fail, that is the other half: a vpn that says connected and carries nothing

what macOS reconnects after sleep on its own

connect on demand, and who actually gets it

connect on demand rebuilds the tunnel when something asks for the network, which covers the wake case well. two conditions come with it: it lives in a vpn payload of a configuration profile — the built-in kind an employer or an mdm hands you — and it needs authentication without a person, in practice a certificate. a configuration you unlock with a typed password cannot use it: nobody is there to type it when the rule fires.

check your own side without changing anything: `scutil --nc show "name of your vpn"` prints a line reading OnDemandEnabled. on the three third-party clients tested here it read FALSE, beside AuthenticationMethod : Password, and no switch in System Settings changes that.

Apple states it plainly: on-demand needs an authentication method that does not involve user interaction. Apple Platform Deployment — vpn overview

the settings that change behaviour, and the ones that do not

1. System Settings → Network → your vpn → Details → Options: turn on «Connect on demand» if it is offered. if the switch is not there, the paragraphs above say why, and no amount of looking will produce it.
2. System Settings → Battery → Options: «Prevent automatic sleeping on power adapter when the display is off» keeps the Mac up while plugged in, so the tunnel is never torn down. the one setting that reliably changes behaviour, and it only helps on power.
3. in a third-party client, look for auto-reconnect and for a kill switch. the kill switch is the part that matters: it stops traffic leaving outside the tunnel while the tunnel is down.

keeping the Mac awake on purpose is its own job: keep a MacBook awake with the lid closed

the same thing as a switch rather than a setting: keep Mac awake

reconnect the vpn from the command line — and on every wake

this is the part missing from most of what is written about the problem, and it is free, built in, and older than every app selling itself as the fix. macOS ships `scutil`, which starts and stops a vpn without opening anything.

the three commands worth knowing

1. `scutil --nc list` prints every vpn the Mac knows about, state in brackets and name in quotes. the quoted name is what the other commands want — copy it exactly, spaces and non-latin characters included.
2. `scutil --nc status "name of your vpn"` prints one word: Connected, Disconnected or Connecting. it comes from the system, not from a client's own idea of itself.
3. `scutil --nc start "name of your vpn"` brings it back up. no sudo, no password prompt, no application launch.

measured here on macOS 26.6.2 as an ordinary user: stopping the tunnel reached Disconnected in about two seconds and the default route fell off utun7 onto en0; starting it put the route back in under a second. check with `route -n get default` — that is the difference between a client claiming success and traffic actually leaving through the tunnel.

one detail matters more than the speed: the configuration tested was a third-party NetworkExtension client, the exact case connect on demand cannot reach. `scutil` does not care who created it, which is why this covers the people the supported mechanism leaves out.

running it automatically on wake

a command you must remember is not much better than a menu you must open, so the useful version runs by itself. put the check in a short shell script — read the status, start the vpn only if it came back Disconnected — and hand it to launchd as a LaunchAgent in ~/Library/LaunchAgents.

the scheduling key is the whole trick. use StartCalendarInterval: a job scheduled that way runs when the Mac wakes up if its time passed during sleep. do not use StartInterval, which looks like the obvious choice and is documented to miss the firing outright if the system was asleep when it came due. the two read as variations of each other and behave as opposites.

Apple documents the wake behaviour for one scheduling key only: a StartCalendarInterval job runs when the computer wakes up, while all other launchd jobs are skipped. Apple — scheduling timed jobs with launchd

check the status rather than starting blindly: a rule that reconnects on every wake can fight the client's own reconnect and loop, and an Apple engineer suggests managing the reconnection deliberately for that reason. Apple Developer Forums — sleep and on-demand rules

a reconnected tunnel is not automatically a working one — move some traffic through it: test your internet speed without installing anything

where hop fits after a vpn drops on sleep

plainly: hop does not reconnect the tunnel for you. it does not hold the connection either — the tunnel belongs to macOS — and an app claiming to keep a vpn alive across sleep is claiming something the system does not offer. if you want the reconnect to happen without you, the section above is the answer, and it costs nothing.

what it changes is the two minutes on either side. every vpn your Mac knows about is a row with a switch, so reconnecting is one click in the menu bar rather than opening a client that wants to be a whole application first. the dot on the icon tells you the state without asking.

• green — the tunnel is up and traffic is moving through it.
• orange — the tunnel is on and nothing is coming back. this is the state after a bad wake, and it is the one clients report as «connected».

what the switch is and what it is not: vpn switcher for Mac

when the vpn drops for reasons other than sleep

it drops when the screen locks, not when the Mac sleeps

the most common follow-up to this question, and a different mechanism wearing the same symptom. the display going dark is not sleep — it lets the Mac fall into idle sleep minutes later, and that step takes the network down. the tell is timing: a tunnel dying the instant you lock is your client reacting to the lock; one surviving a minute or two is idle sleep.

everything else that looks like this

• it also drops when you move between networks. same mechanism — new interface state, dead session — and nothing to do with sleep.
• it drops after a fixed interval while awake. that is a session or key lifetime on the server side, and it is your provider's or your admin's setting.
• it reconnects and there is still no internet. different problem: the tunnel came back and dns or routing did not.
• a corporate vpn refuses to reconnect without you present. many require a second factor per session, by design, and the agent above will fail politely every wake.
• two vpn clients are installed. they fight over the routing table on every wake, and removing the one you stopped using fixes more than any setting will.

removing the client you stopped using, network extension and all: uninstall an app with its leftovers

frequently asked questions

why does my vpn disconnect when my Mac sleeps?

sleep brings the network interfaces down, which ends every open connection including the tunnel. the server sees a disconnect; on wake there is nothing to resume, only something to rebuild.

how do i make my Mac reconnect to vpn automatically?

two ways. connect on demand, if your configuration is a built-in one with certificate authentication. otherwise a small LaunchAgent scheduled with StartCalendarInterval that checks `scutil --nc status` and runs `scutil --nc start` when the status comes back Disconnected. the second works with third-party clients, which the first does not.

can i keep a vpn connected during sleep?

no. the connection cannot survive the interface going away. what you can do is keep the Mac from sleeping while it is on power, or have something reconnect promptly on wake.

does connect on demand fix it?

for built-in configurations that offer it, largely yes — the tunnel is rebuilt when something needs the network. it needs authentication without a person present, so a configuration you unlock with a typed password cannot use it, and neither can a third-party client.

why does my vpn disconnect on the lock screen?

usually it does not — the lock turns the display off, the Mac falls into idle sleep a few minutes later, and that is what kills the tunnel. if it dies the instant you lock, that is your client's own setting rather than macOS.

does power nap keep a vpn alive?

no. Power Nap wakes the Mac briefly for mail, calendar and updates. it does not maintain a vpn session, despite how often it is suggested.

can hop reconnect my vpn automatically?

no, and it does not pretend to. for an automatic reconnect use the launchd agent above — it is free and it works. hop makes the state visible, including the tunnel that is up but carrying nothing, and puts the switch one click away.

the tool behind this

done with vpn

other things people do

• your vpn says connected. nothing loads.vpn switcher
• your vpn says connected. is anything actually going through it?vpn switcher
• 64 gb of ram, and it says it is out of memorysystem monitor