Manual VPN setup — macOS
Recommended: the VPN Pink app
Start with our VPN Pink app for your device. Manual setup is an alternative if the app cannot be used or you prefer your own VPN client.
Get the VPN Pink app →These instructions are an alternative to our recommended VPN Pink app. Choose your platform.
Before you start
You need an active VPN entitlement. Use only a server assigned to your account. Signing into the website does not itself activate VPN access.
Find your VPN username, VPN password and assigned server in My Dashboard. The VPN password may differ from your website password. A customer reference is not your VPN username.
IKEv2 / IPsec
| Server address | Example: Germany — Choose a server address: hostname or IP Hostname: de-fkb-sha-vps3.vpn-pink.comAlternative IPv4: 212.227.45.10Alternative IPv6: 2a01:239:304:6900::1 |
|---|---|
| Server Identity / Remote ID | vpn-pink.com |
| VPN username | My Dashboard → |
| VPN password | My Dashboard → |
Leave Client Identity / Local ID empty. If your client requires it, use your VPN username.
Setup steps
- Open System Settings → VPN → Add VPN Configuration → IKEv2 (the menu may be under Network on older macOS).
- Enter a connection name and the server values below. Choose username/password authentication and enter your VPN credentials. Leave Local ID empty.
- Save, authorize the change if prompted and connect. Keep server certificate validation enabled.
Choose a server address: hostname or IP
Enter exactly one value in Server address: the hostname or, alternatively, the IPv4 or IPv6 address of the same assigned server. If DNS fails, replace the hostname with its fixed IP. IPv6 requires working IPv6 connectivity. If the client has a separate Remote ID field, keep vpn-pink.com there. A fixed IP bypasses DNS lookup of the server address, but does not replace certificate validation.
| VPN | Hostname | Alternative IPv4 | Alternative IPv6 |
|---|---|---|---|
| AT | at-sha-vps1.vpn-pink.com | 5.132.162.69 | 2a03:3180:4001:106::473d:989b |
| DE | de-fkb-sha-vps3.vpn-pink.com | 212.227.45.10 | 2a01:239:304:6900::1 |
| ES | es-mad-sha-vps1.vpn-pink.com | 82.223.83.18 | 2001:ba0:253:6000::1 |
| US | us-sha-vps1.vpn-pink.com | 198.71.58.244 | 2607:f1c0:f04f:f200::1 |
If connection fails
IKEv2 uses UDP 500 and 4500. Replies must be allowed; home-router port forwarding is normally unnecessary. No captured packets is not proof that a port is blocked.
An EAP_NAK followed by EAP_FAILURE means the EAP negotiation was rejected; it does not prove a wrong password. “Recovery remains armed” is an app status, not an administrator-permission request or proof of a working VPN. Ask support with the time, platform, server and log.
Do not share passwords, private keys, tokens, QR codes or complete WireGuard configurations. Review logs before sharing.
Contact support →VPN
Check that your system reports the tunnel connected, internet access works and your public IP has changed. Opening the app or importing a profile alone proves no connection.
IP →