Profiles Switcher › Blog

How to Run Automations When Your Mac Connects to a VPN

By the Profiles Switcher team. Published September 26, 2026.

To make your Mac do something when a VPN or wired network connects, add a "Network service active" rule to a Profiles Switcher profile, pick the VPN or network from the list, and add the actions to run: mount a share, set a printer, open your intranet or run a Shortcut. The profile turns on as soon as the connection has an IP address, and your other profiles take over again when it disconnects.

Set this up with Profiles Switcher on the Mac App Store, or start from a ready-made recipe.

What does the Network service trigger do?

It watches your Mac’s network connections and turns a profile on while the connection you picked is up and has an IP address, which is the moment it is ready to use. It sees three kinds of connections:

• Network services from System Settings > Network: Wi-Fi, Ethernet adapters and docks, Thunderbolt Bridge and iPhone USB.
• VPNs added in System Settings > VPN, such as Tailscale. They are listed even while they are disconnected, so you can set up the rule first and connect later.
• Tunnels from VPN apps that run their own connection, such as Tunnelblick or Windscribe. They appear under Tunnels as soon as they connect, with their address and, for Tunnelblick, the name of your configuration.

The list shows each entry with what it is and whether it is connected, for example Tailscale · VPN · Not connected or utun7 · 10.8.0.4 · Tunnelblick (WorkVPN).

How do you set it up?

1. Click the Profiles Switcher icon in the menu bar, choose Preferences… and create a profile, for example Work VPN.
2. Click Add Rule…, choose Network service active and pick your VPN or network. Using a VPN app such as Tunnelblick? Connect it first, and its tunnel shows up in the list right away.
3. Click Add Action… and add what should happen: mount a share, set a printer, open a URL, run a Shortcut.
4. That is it. The next time the VPN connects, the profile switches on by itself, and the menu bar shows it as the active profile.

The rule needs no permission, and it follows the service even if you rename it later in System Settings.

What can you automate when the VPN connects?

A VPN usually means “I am working now”, which makes it a great signal for a work setup wherever you are:

• Mount the team file share with the Mount a network share action (SMB, AFP, NFS or WebDAV). Company shares are often reachable only over the VPN, so this is the perfect moment. The mount a network drive recipe shows the same action on a Wi-Fi trigger.
• Set the office printer as your default, so printing just works. See change the default printer by location.
• Open your intranet or dashboard in the browser you choose with Open a URL.
• Run a Shortcut, for example one that turns on a Work Focus or changes your DNS. Any Shortcut you have can run here; run Shortcuts automatically explains how.
• Launch your work apps and show a notification so you know the setup is ready.

Which entry should you pick?

Pick the entry that matches how your VPN or network connects. VPNs set up in System Settings are listed by name, VPN apps show their tunnel, and docks show their Ethernet adapter:

For a VPN app, the IP address / range rule is the most durable choice: a Tunnelblick connection that always hands out addresses in 10.8.0.0/24 matches that range every time it connects.

How is it different from the Ethernet and IP address triggers?

Three triggers watch your network, each at a different moment:

• Ethernet cable connected fires the instant a cable is plugged in, before the connection is set up. Good for things that do not need the network itself, like switching audio at a dock.
• Network service active waits until the connection has an IP address, so the network is ready. Good for mounting shares and opening internal sites.
• IP address / range matches the address itself, such as your office subnet or your VPN’s range. Good when the same network can arrive over different adapters.

Can you combine it with other rules?

Yes. Set the profile to All are true and add more rules. For example, the VPN plus an external display makes a “Remote desk” profile that only switches on when you are connected to work and sitting at your big screen. With Any is true, the profile turns on when either the VPN or your office Wi-Fi is connected, so the same work setup follows you from the office to home. Exactly one profile is active at a time, and its priority decides which one wins when several match.

Frequently asked questions

Ready-made automations for this

• Mount a network drive automatically when you join your Wi-Fi
• Use the right default printer in every place
• Run a shortcut automatically when your Mac gets home

vpnhome-and-officehow-to