People who connect to many customers' VPNs every day.
IT consultants, integrators and support teams use one app instead of a client per firewall.
ICM VPNOne Mac app for your corporate VPNs.
ICM VPN connects your Mac to the VPNs organizations use, from the menu bar. It supports Palo Alto GlobalProtect today, with Fortinet and others next. The interface stays simple, errors say what went wrong, and security comes first in every decision.
Join the open betamacOS 14 or later
Supported VPNsFree plan: 100 successful connections a day during the beta.
ICM VPNNot connected
Connecting…Acme Corp
Acme CorpGlobalProtect · vpn.acme.example10.20.0.15 · 00:12:48
- Acme CorpGlobalProtect · vpn.acme.example
- Example LtdGlobalProtect · gp.example.net
7 / 100connections todayFree plan · beta
Try it: click ConnectIllustrative preview
Who it's for
For everyone who connects to a VPN from a Mac
People who reach their company VPN from a Mac.
Anyone whose company runs a supported VPN can connect with a simple, clear client.
Highlights
Simple to use. Clear when something goes wrong.
One app, many VPNs
Each organization or customer is a profile. A server address and a username are enough; everything else is under Advanced.
Lives in the menu bar
A list of profiles, a Connect button, the status. While connected you see your address and how long you have been connected. If the server limits the session, ICM VPN warns you before it ends.
Errors that explain
It does not just say “Unreachable”. It tells you which step failed, why, and what to do: “The username or password was not accepted.”
Comes back on its own
It reconnects after your Mac wakes or the network changes. If its background service restarts, your session comes back without asking for your password.
DNS that keeps working
Internal names resolve through the tunnel. Your Mac's own DNS settings are never rewritten. If a connection drops unexpectedly, your network settings are put back the way they were.
Honest about certificates
The server's certificate is checked by macOS itself, including the root certificates your organization installs. When macOS does not trust a certificate, you see:
- who issued it;
- which names it is for and the dates it is valid between;
- whether it is a genuine certificate that expired or a self-signed one.
You decide on every connection. If the certificate changes, ICM VPN warns you.
Passwords stay in the Keychain
If you want, your password is kept in the macOS Keychain, on this Mac only. Logs and diagnostics never contain passwords or session details.
Details for those who want them
There is a log window and a one-click diagnostics bundle. You can send the bundle to your IT team or to support; it holds no passwords, no session details and none of your Mac's hardware addresses.
English and Turkish
The interface comes in both languages; choose one in Settings.
Supported VPNs
GlobalProtect today. Fortinet next.
What works with GlobalProtect today
- Portal and gateway sign-in, gateway selection
- Username and password
- Sign-ins that ask for a one-time code (OTP)
- A fast tunnel over UDP (ESP). If the server does not offer it, ICM VPN uses TLS and says so.
Not yet: SAML/SSO sign-in and client certificates. Both are on the roadmap.
| VPN | Status |
|---|---|
| Palo Alto Networks GlobalProtect | Supported |
| Fortinet FortiGate SSL VPN | Next |
| Cisco Secure Client (AnyConnect) | Planned |
| Ivanti Connect Secure (Pulse Secure) | Planned |
| F5 BIG-IP | Planned |
| Array Networks | Planned |
| OpenVPN (.ovpn), Sophos SSL VPN, WatchGuard Mobile VPN with SSL | Planned |
| Check Point, IPsec/IKEv2, WireGuard | Planned |
How it works
Connected in three steps
- 1
Download and open it
On first launch, macOS asks you once to allow the background service that sets up the tunnel: System Settings → General → Login Items.
- 2
Add a profile
Choose the VPN type, then enter the server address and your username.
- 3
Connect
Click Connect and enter your password, and a code if asked. The status shows in the menu bar.
Security
Security comes first in every decision
Administrator rights in one place
Only a small background service has them. It sets up the tunnel, routes and DNS, and does nothing else.
The service listens only to ICM VPN
It takes commands only from the ICM VPN app, after checking its code signature.
The engine runs from a verified copy
Before it runs with administrator rights, the VPN engine is moved to a protected copy whose signature is checked.
Secrets never sit in the open
Passwords, session details and one-time codes never appear on the command line, in log files or on disk in plain text.
The tunnel is pinned to the certificate
The server's certificate is checked by macOS, including the server name. The tunnel is pinned to the full fingerprint of the certificate that was verified or that you approved.
Open-source engines run on their own
Engines such as OpenConnect run as separate processes. Their versions are pinned, and they are built from sources whose signatures are verified.
Free plan
How the daily quota works
The Free plan is built around a simple daily quota. During the open beta, it's generous on purpose.
- 1
Connect
Each successful connection uses one from your daily quota.
- 2
Resets every day
Your quota refills every day.
- 3
Generous during the beta
During the open beta, Free includes 100 connections a day. After the beta, Free continues with 3 a day, forever.
Plans
Start free. Upgrade when you're ready.
Licenses are billed yearly at an affordable price. Prices will be announced before launch.
Free
Open beta$0
Forever
With a daily connection limit.
Join the open beta- 100 successful connections a day during the beta
- 3 connections a day after the beta, forever
- All app features included
Pro
Coming soonComing soon
Billed yearly
A license for unlimited connections.
Notify me- Unlimited connections
- Everything in Free
Teams
Coming soonComing soon
For teams, billed yearly
Licenses for teams and businesses.
Contact sales- Everything in Pro
- Licenses for your whole team
Prices for paid plans will be announced before they launch. Taxes may apply.
Requirements
- macOS 14 Sonoma or later
- A Mac with Apple silicon or an Intel processor
- An administrator password may be needed once, to allow the background service.
- A Windows version is planned.
Frequently asked questions
Can ICM VPN replace my organization's VPN client?
For supported VPNs, yes. ICM VPN connects to your organization's server with that VPN's own protocol; nothing changes on the server. Check with your IT team whether your organization allows other clients.
Our GlobalProtect gateway checks HIP. What happens?
ICM VPN does not send a HIP report. If the gateway asks for one, ICM VPN says so on the connection screen. Organizations that limit access based on HIP reports may keep some resources out of reach.
What about servers that sign in with SAML/SSO?
Not supported yet; it is on the roadmap. On such a server, ICM VPN tells you clearly that it cannot connect.
Where is my password kept?
Only if you ask, in the macOS Keychain. It stays on this Mac and can be used only while your Mac is unlocked. Otherwise, ICM VPN asks for it on each connection.
What if the server's certificate is not trusted?
ICM VPN shows who issued the certificate, which names it is for and until when, and what the problem is. You decide whether to connect, and it asks again on every connection. If a certificate you connected with before changes, you see a red warning.
What happens when my Mac sleeps or the Wi-Fi changes?
ICM VPN reconnects on its own.
Does quitting the app end the VPN connection?
By default, ICM VPN asks first and then disconnects. If “Stay connected when ICM VPN quits” is on in Settings, the tunnel stays up. When you open the app again, it shows the connection where it left off.
What is the limit of the free version?
During the open beta, 100 successful connections a day. After the beta, 3 connections a day, forever. A license makes it unlimited.
What is the open beta?
ICM VPN is open to everyone while we polish it. Beta versions may change often, and your feedback directly shapes the product.
Why is it not on the Mac App Store?
Apps on the Mac App Store must run in a sandbox. The background service that sets up ICM VPN's tunnel cannot be installed that way. So ICM VPN is distributed directly from this site.
Is there a Windows version?
It is planned.
What if something goes wrong?
Export a diagnostics bundle from the Logs window and send it to hello@icm.sh. It contains no passwords or session details.
Join the ICM VPN open beta
Get the Free plan with 100 successful connections a day while the beta lasts.
ICM VPN uses these open-source components: OpenConnect (LGPL-2.1), OpenSSL (Apache-2.0), vpnc-script (GPL-2.0 or later) and cJSON (MIT). License texts and source code.