How to change VPN protocols or select Smart Protocol

Reading: 11 mins
Category: Protocols

All our VPN apps use secure VPN protocols:

You can use OpenVPN and WireGuard® in UDP or TCP modes. UDP is faster, but TCP is more reliable and can be effective at defeating certain kinds of censorship (but not as effective as Stealth).

Windows: OpenVPN, WireGuard, and Stealth
macOS: IKEv2, WireGuard, and Stealth (macOS 12 and less, macOS 13 and 14, macOS 15)
Android: OpenVPN, WireGuard, and Stealth
Android TV: OpenVPN, WireGuard, and Stealth
iOS/iPadOS: WireGuard and Stealth
Linux: OpenVPN and WireGuard

Learn more about VPN protocols

WireGuard TCP is currently available on Android, Windows, Android TV, macOS, and iOS/iPadOS (the default version of WireGuard, which uses UDP, is also available on Linux, but the TCP version is not).

Learn more about the difference between UDP and TCP

Smart Protocol

Our Windows, macOS, Android, and iOS/iPadOS apps also support the Smart Protocol anti-censorship feature. This intelligently probes networks to discover the best VPN protocol configuration required for optimal performance or to bypass censorship.

For example, it can automatically switch from WireGuard to OpenVPN, or OpenVPN UDP to OpenVPN TCP, using different ports as required.

Learn more about how Smart Protocol works

Smart Protocol is enabled by default in all apps that support it and must be disabled to manually change VPN protocols. In this guide, we show you how to enable or disable Smart Protocol and how to manually change VPN protocols.

Windows

1. Open the Proton VPN app and go to Settings → Connection → Protocol.

2. Select your preferred VPN protocol.

macOS 12 (Monterey) or earlier

A system extension is required to use alternative VPN protocols and/or Smart Protocol on macOS.

1. When you first install and run Proton VPN, the System Extension Blocked notification will appear. Click Open Security Preferences.

If you are upgrading from an older version of the app, you will be prompted to do this the first time you select OpenVPN, WireGuard, Stealth, or Smart Protocol in Preferences.

To do this, open the app and go to the menu bar → ProtonVPN → Preferences → Connection tab →Protocol and select Smart, WireGuard, WireGuard (TCP), IKEv2, or Stealth from the dropdown menu.

2. At our onboarding screen, click Open Security Preferences.

Alternatively, you can manually go to the menu bar →Apple icon → System Settings → Security & Privacy → General tab.

3. Click the lock and enter your password or use Touch ID to unlock your Security & Privacy preferences. Then click Details… next to Some system software requires your attention before it can be used.

4. Toggle both Proton VPN switches on and click OK.

5. In the Preferences → Connection tab of the Proton VPN app, you can now select your preferred Protocol from the dropdown menu, or choose Smart Protocol.

The first time you use a new protocol, macOS will ask you to conform that wish to add new VPN configurations.

macOS 13 (Ventura) and macOS 14 (Sonoma)

A system extension is required to use alternative VPN protocols and/or Smart Protocol on macOS.

1. When you first install and run Proton VPN, the System Extension Blocked notification will appear. Click Open System Settings.

If you are upgrading from an older version of the app, a configuration window will open the first time you select OpenVPN, WireGuard, Stealth, or Smart Protocol in Preferences.

To do this, open the app and go to the menu bar → ProtonVPN → Settings → Connection tab →Protocol and select Smart, WireGuard, WireGuard (TCP), IKEv2, or Stealth from the dropdown menu.

At our onboarding screen, click Open System Settings.

Alternately, you can manually go to the menu bar → Apple icon → System Settings → Privacy & Security.

2. Scroll down to Security → System software from application ProtonVPN was blocked from loading and click the Allow button.

3. Verify your identity using Touch ID or your system’s password to allow the Proton VPN system extension.

4. In the Preferences → Connection tab of the Proton VPN app, you can now select your preferred Protocol from the dropdown menu, or choose Smart Protocol.

macOS 15 (Sequoia) and later

A system extension is required to use alternative VPN protocols and/or Smart Protocol on macOS.

1. When you first install and run Proton VPN, the System Extension Blocked notification will appear. Click Open System Settings.

If you are upgrading from an older version of the app, a configuration window will open the first time you select OpenVPN, WireGuard, Stealth, or Smart Protocol in Preferences.

2. Currently, our onboarding screen needs to be updated to reflect changes implemented by Apple in macOS 15. So close the onboarding screen and manually go to the menu bar → Apple icon → System Settings → General → Login Items & Extensions.

3. Go to Extensions → Network Extensions → 🛈.

4. Toggle the ProtonVPN WireGuard switch on and click Done.

macOS 15 (Sequoia) enable WireGuard extension

5. In the Preferences → Connection tab of the Proton VPN app, you can now select your preferred Protocol from the dropdown menu, or choose Smart Protocol.

Is root access or special permissions required to change VPN protocols in macOS?

No. When you first change to the OpenVPN or WireGuard protocols (or Smart Connect), macOS creates a new network service and a new System Extension is installed. As a security feature, macOS asks to authenticate these changes with a password or using Touch ID.

This does not require root privileges, and none are asked for. You can verify that a new Proton VPN network service is created by going to Settings → Network → VPN (Ventura + or Settings → Network (Monterey and earlier).