My Mac Was Online. Its Network Extensions Were Fighting Over the Connection

The App Store build failed at 93 percent while the client waited for the TestFlight link. Safari could open Apple’s status page, but Xcode said the connection had been lost. Slack showed Reconnecting, Dropbox had stopped syncing, and the VPN menu still displayed Protected. I blamed Apple’s upload service, restarted Xcode and began sending the 1.7-gigabyte build again. It failed before reaching 10 percent.

The client’s message arrived on my phone.

“Can we test before the launch call?”

The call started in thirty-four minutes.

My Mac was connected to the coworking Wi-Fi. Some websites worked. The applications doing the actual job could not stay online.

That was the first clue that the Wi-Fi itself was not the problem.

Two Security Tools Had Claimed the Same Connection

The Mac had restarted that morning after a VPN app update.

Months earlier, I had also installed a network-monitoring tool while testing a client’s security policy. I no longer used the main application, but one of its filters remained active under System Settings → Network → Filters & Proxies.

The established VPN had added its own entries: a tunnel and a web-protection filter.

macOS allows VPNs, content filters and DNS tools to extend the system’s network connection. (Reddit discussion) That works well until several extensions try to inspect or redirect the same traffic.

The failure was not a clean loss of internet.

Safari could open a page while Slack failed.

A speed test could run while Xcode lost the upload.

The Wi-Fi icon stayed full while applications waited behind a filter that was no longer responding.

Apple’s troubleshooting guidance specifically points users toward VPNs, profiles, firewalls and filters when third-party security software disrupts connectivity.

My Mac had all four.

The question was no longer whether the internet worked.

It was which extension was stopping the applications I needed.

The Established VPN Recreated the Conflict

The provider was a reasonable choice.

It had years of public history, servers in many countries and a large support operation. I had used it on hotel Wi-Fi, at airports and during previous launches.

I disconnected it.

Slack came online.

Dropbox synchronized three files.

Xcode reached Apple again.

That seemed to identify the cause, so I reopened the VPN and selected a nearby server.

The connection completed.

Slack returned to Reconnecting.

The TestFlight upload stopped at 4 percent.

I switched off the provider’s web-protection feature inside the app.

The internet returned briefly, then disappeared from Xcode again. In System Settings, the filter still appeared active even though the application said the feature was off.

I disabled the filter directly.

The VPN tunnel disconnected.

I restored the tunnel.

The filter returned with it.

On this Mac, the provider treated the tunnel and its extra protection as parts of the same package. Removing the troublesome filter also disturbed the connection I still wanted.

Recent Mac VPN failures have followed a similar pattern: an update adds connection drops or protection modules that interfere with ordinary work.

The practical clue from other Mac users was even simpler: a forgotten content filter can keep blocking traffic after the application that installed it appears to be disabled or removed.

That explained the symptoms.

It did not upload the build.

Twenty-five minutes remained.

Removing Everything Fixed the Mac but Broke the Workflow

I quit the established VPN and disabled both of its network entries.

Then I disabled the leftover filter from the old monitoring tool.

Slack connected.

Dropbox finished syncing.

Xcode began uploading the build.

For the first time that morning, every application agreed that the Mac had internet.

The progress bar reached 28 percent.

Then someone at the next desk began a video call. The coworking Wi-Fi slowed, and Xcode’s estimated upload time jumped from nine minutes to twenty-three.

I switched the Mac to my phone’s hotspot.

The upload stopped.

Xcode returned to the build-selection screen.

Removing the extensions had solved the conflict. It had not given the upload a connection that could survive the move from Wi-Fi to mobile data.

I could leave every security tool disabled and begin again on the crowded network.

Or I could create one clean VPN connection without rebuilding the stack that had just failed.

By then, another attempt with the old setup felt less like caution and more like repetition.

The Build Reached Processing Without Another Settings Search

I closed System Settings and opened OnlydogVPN.

The smaller app did not ask me to rebuild a collection of filters or choose between several protection modules. Basic use also began without a conventional email-and-password account.

I approved its VPN profile and selected the preset for development work on shared Wi-Fi.

Then I returned to Xcode.

I chose the archive.

I pressed Distribute App.

The upload began.

Ten percent.

Thirty-one.

Fifty-six.

The coworking Wi-Fi slowed again, and the Mac switched to my phone’s hotspot.

The progress bar paused.

It did not disappear.

A few seconds later, 56 became 57.

I placed the phone beside the window and watched the upload pass the point where every previous attempt had failed.

At 100 percent, Xcode changed from Uploading to Processing build.

Two minutes later, App Store Connect displayed the version number.

I added the client’s testing group and pressed Submit for Review.

The TestFlight invitation arrived on my phone.

I forwarded it to the client.

“Installing now,” she replied.

Only after the build reached her device did I check the VPN again. The development-work preset had created one usable route without restoring the earlier stack of tunnel and filter extensions. Its HTTP/3-based connection also kept the upload alive when the Mac changed from coworking Wi-Fi to the hotspot.

I could not observe macOS’s internal ordering of the network extensions or identify the precise interaction that had broken the earlier setup. I could see the result: the previous stack divided the Mac into applications that worked and applications that did not, while the fresh connection carried the build from Xcode to TestFlight.

The successful status was no longer a VPN icon in the menu bar.

It was Ready to Test in App Store Connect.

The iPad Joined After the Main Problem Was Solved

The client installed the build and found one layout issue on the checkout screen.

I needed to reproduce it on a tablet before the launch call.

My iPad was in the backpack under the desk. It used the same coworking Wi-Fi, but I did not want to create another VPN account or search for another password while the client was already testing.

The smaller service displayed a verification code.

I entered it on the iPad and selected the same work preset.

The TestFlight invitation opened.

The build installed.

I reproduced the layout issue, changed one line in the project and prepared a smaller follow-up build.

That second upload completed without another trip into Filters & Proxies.

The verification code had not solved the original conflict. The Mac connection had already done that.

It simply removed the next setup delay once the real work had resumed.

We joined the launch call with the corrected screen visible on both devices.

More Protection Had Given Me Less Control

Before that morning, I thought a strong Mac security setup meant keeping every available protection layer switched on.

The conflict reversed that judgment.

The established provider offered more servers, more controls, a longer public history and more independent reviews. Its broader package may suit someone who wants one application to manage several security functions.

The smaller service has fewer locations and a shorter track record.

But my launch did not fail because I lacked another feature.

It failed because a tunnel, a web filter and a forgotten monitoring extension were all trying to control the same connection.

The replacement gave me one working route, survived the switch to the hotspot and delivered the build before the client call.

For that launch, the best-protected Mac was not the one running the most network extensions.

It was the one that finally sent the app.