How to Reach a Mac's Screen From an iPad Over VPN

The VPN gives the iPad a private path to the Mac. It does not give it a desktop session, and installing a viewer does not configure the Mac. Those are two endpoints and two configurations, and the failure looks identical from the iPad either way: a connection that never completes. Set up the Mac first, then match the viewer to what the Mac actually offers.

The steps below run in the order that avoids a wasted afternoon.

Step 1: enable Screen Sharing on the Mac

Open System Settings, go to General, then Sharing, and enable Screen Sharing. Apple's Screen Sharing instructions cover the same path and the allowed-users restriction. If the Mac is managed and already uses Remote Management, do not replace that arrangement to copy someone else's screenshot, because the two modes are alternatives rather than layers. If the setting is greyed out, a management profile is probably enforcing it, and that is a conversation with whoever owns the Mac.

Note which account is allowed to connect. It is not necessarily the account you use for the VPN.

Step 2: choose a viewer that matches the authentication

A viewer labelled VNC-compatible is not automatically compatible with every authentication extension or session feature. Check what the Mac is offering and what the iPad app supports, including any separate VNC password the Mac can expose for compatible viewers. The VPN account password does not belong in the viewer's login field. The Mac can also require both an account login and the separate viewer password, which is a deliberate choice rather than a fault.

If the app's documentation does not name the method it uses, test it before you depend on it.

Step 3: connect to the private address

With the iPad's approved VPN connected, enter the Mac's documented private hostname or address. An address such as 10.77.0.20 is one the private design assigned to that Mac, not something the VPN invents for every desktop. Then confirm the Mac is awake, the VPN path permits the connection, and the Mac allows the source address and the session.

In a managed per-app deployment, check that the viewer itself is associated with the connection. Another app working through the VPN proves nothing about this one.

Step 4: handle discovery, wake and disconnect

Bonjour discovery is convenience, not a requirement, for a known destination. A routed VPN does not have to carry browse announcements for the viewer to reach a permitted address, and seeing the Mac in a list is not proof that login or display delivery will work. Power is the other half: a sleeping Mac may not wake for a VPN request on every router, so use the organisation's supported wake or availability arrangement.

When you finish, use the viewer's disconnect or the intended Mac sign-out. Ending the view and ending the session are different actions with different consequences.

What the VPN does not do for you

The tunnel does not start a desktop session, does not create a VNC password, and does not grant application permission on the Mac. It also does not make a publicly forwarded screen-sharing service safe, so keep the service private rather than exposing it as a shortcut.

Write the setup down as two rows, one per endpoint, with the account, the authentication method and the private address. The next person to troubleshoot this will need all three.