First, measure
Don't change settings yet. Four commands find the broken link, and each one points at a different fix. Open Terminal (⌘ Space, type Terminal, Return).
Rung one — does your Mac have an address?
When you join a network, your router hands your Mac a numbered address so the two can talk. No address, no internet, no matter how strong the signal. First find what your Wi-Fi is actually called — it's en0 on most Macs, but not all, and checking the wrong one will send you down the wrong path:
% networksetup -listallhardwareports | grep -A1 Wi-FiHardware Port: Wi-Fi
Device: en0The Device line is the name to use below. If yours says en1, use en1 everywhere this guide says en0.
% ifconfig en0 inet 192.168.86.151 netmask 0xffffff00 broadcast 192.168.86.255
status: activeRead the inet line. Something starting 192.168 or 10. is a normal home address. If you see 169.254 — or no inet line at all — go straight to the self-assigned address section below.
Rung two — can your Mac reach the router?
Your router is the box everything in your house talks through. Find its address, then knock on it.
% route -n get default route to: default
destination: default
gateway: 192.168.86.1
interface: en0The “gateway” line is your router — but check the “interface” line matches your Wi-Fi first. If it names something else (a utun is a VPN, another en is Ethernet or a dock), your Mac is sending traffic somewhere other than the Wi-Fi, and that is itself the problem — see the VPN section below. If the command reports nothing at all, your Mac has no way out: that's the self-assigned address problem.
% ping -c 3 192.168.86.13 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 3.662/3.702/3.741/0.039 msUse whatever gateway address the command above printed. Replies mean your Mac and the router are talking fine, and the break is further out.
Rung three — can the router reach the internet?
Now step past the router. This address belongs to a public service that always answers, and using the number skips name lookups entirely — so this tests the connection and nothing else.
% ping -c 5 1.1.1.164 bytes from 1.1.1.1: icmp_seq=0 ttl=55 time=17.9 ms
...
round-trip min/avg/max = 16.8/18.3/21.6 msReplies mean your internet works. If the router answered but this doesn't, the break is on your provider's side — nothing on your Mac will fix it.
Rung four — can your Mac look up names?
Before your Mac can load a site it has to turn the name into a numbered address, the way you'd look up a phone number before dialling. That step is called DNS. When it breaks, everything else works perfectly and no page opens — which is exactly what “connected but no internet” usually is.
% ping -c 5 apple.com64 bytes from 17.253.144.10: icmp_seq=0 ttl=56 time=18.1 ms
...
round-trip min/avg/max = 14.0/18.4/20.9 msIf the numbered address answered a moment ago and this one hangs or says “cannot resolve”, your lookups are broken. That's the most common cause of this exact symptom.
The first rung that fails is your answer. Find its section below.
The lookup is broken
ping 1.1.1.1 works. ping apple.com hangs or can't resolve. Every page sits on “Connecting…” forever.
Your connection is healthy; your Mac just can't translate names into addresses. Usually the lookup service your router handed over is unreachable or wrong — often after a router restart or a provider change.
Fixgive your Mac a lookup service you know answers: System Settings > Wi-Fi > Details > DNS, and add 1.1.1.1 at the top of the list. Then clear the old answers out:
One exception. On a work, school, or VPN network, don't. Those networks run their own lookup service on purpose — it's what resolves internal addresses like your intranet or a shared drive, and a public one can't see them. If this is a managed Mac, put the original setting back and ask whoever runs the network.
% sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponderClears your Mac's saved lookups so the new setting takes effect immediately. Asks for your password; nothing permanent changes.
A self-assigned address
The inet line reads 169.254.something, or there's no inet line at all.
When a Mac asks the router for an address and gets no answer, it invents one starting 169.254. That's macOS telling you it gave up waiting. The Mac is on the Wi-Fi but has no valid identity on the network, so nothing can reach it and it can't reach anything.
Fixrenew the address first — System Settings > Wi-Fi > Details > TCP/IP > Renew DHCP Lease. If that doesn't take, forget the network (Details > Forget This Network) and join it fresh. If it still won't, restart the router: this is one of the few symptoms that genuinely is often the router's fault.
A login page you never saw
On hotel, café, airport or campus Wi-Fi. Connected, and every site redirects or times out.
Public networks hold you in a waiting room until you accept their terms on a login page — a captive portal. If that page never appeared, or you dismissed it, you're connected to the Wi-Fi and permitted to go precisely nowhere.
Fixopen http://neverssl.com in a browser. It's a plain, unencrypted page, which forces the network to show you its login screen instead of silently failing. Turning Wi-Fi off and on again also re-triggers the prompt.
A VPN that quit halfway
It broke when you closed a VPN, put the Mac to sleep, or switched networks.
A VPN routes all your traffic through itself. When one disconnects badly it can leave its routing behind — so your Mac keeps sending everything to a tunnel that no longer exists. Some VPNs do this deliberately, as a “kill switch” meant to protect you.
Fixreconnect the VPN properly and then disconnect it from inside its own app rather than force-quitting. Check System Settings > VPN for anything still switched on, and System Settings > Network > Details > Proxies for a proxy you didn't set.
A dead connection sitting in front
Everything stalls for several seconds, then sometimes works. There's an old adapter, dock, or virtual machine on the Mac.
Your Mac keeps a ranked list of ways to get online and tries them top to bottom. A dead entry at the top gets tried first, every time, and has to time out before Wi-Fi gets a turn.
% networksetup -listnetworkserviceorderThe order your Mac tries. Wi-Fi should be at or near the top; anything you no longer use shouldn't be above it.
FixSystem Settings > Network > ••• > Set Service Order…, drag Wi-Fi to the top, and delete what you don't use.
NoahNoah found exactly this on one real Mac — an old T-Mobile USB modem sitting first in the network order, which macOS tried before Wi-Fi on every single connection. No cleanup app looks there.
The clock is wrong
Secure sites fail with a certificate or privacy warning, while plain ones load.
Encrypted connections depend on certificates that are only valid between two dates. If your Mac's clock is far off — usually after a dead battery or a long shutdown — every certificate looks expired or not-yet-valid, and your Mac refuses to connect.
FixSystem Settings > General > Date & Time, and switch “Set time and date automatically” off and back on.
When it's not the Mac
Your phone and everything else in the house are offline too.
Then it was never a Mac problem. Either the router has lost its connection, or your provider is down.
Fixunplug the modem and router for 30 seconds and plug them back in — modem first, and give it a couple of minutes before the router. Check your provider's status page from your phone's mobile data. If a restart fixes it for a while and it keeps returning, an ageing router or a weak line is usually the reason.
The short version
ifconfig en0— an address starting169.254means you never got one. Renew the lease.route -n get default, then ping the gateway — no reply means the break is between Mac and router.ping 1.1.1.1— fails here and the break is at your provider.ping apple.com— works above but fails here, and it's the lookup. Add1.1.1.1as your DNS and flush the cache.- On public Wi-Fi, open
http://neverssl.comto force the login page.