Windows VPN Setup Guide: From Client Install to Auto-Start

The whole setup runs in five steps, and each section below covers one of them:

1. Download the client and install it
2. Sign in and get the subscription into the client
3. Pick a route that matches your use case
4. Confirm the exit, DNS and split tunnelling really took effect
5. Turn on auto-start so you never click connect again

Confirm three things before you install

The Windows client takes over system networking, so three things are worth confirming before you install. None of them decide whether the installer runs — they decide whether you end up redoing the work afterwards.

• ✅ 64-bit Windows 10 or Windows 11, with the latest system update already installed. Older builds lack the components the virtual adapter needs, and the installer stalls at the final step.
• ✅ The username and password you signed up with. Registration here needs only a username and password — no email address — so there is no verification mail to hunt for; if you've forgotten them, use the recovery flow in the dashboard.
• ✅ The current account can obtain administrator rights. The installer has to create a virtual network adapter, and there is no way around that step.
• ❌ Don't take the installer from forum attachments or reposted cloud-drive bundles. The most common problem with packages of unknown origin isn't malware — it's that they replace the client's config directory, so every subscription update afterwards fails.
• ❌ Don't rush to hand-edit system DNS or add hosts entries before installing. When something breaks, you won't be able to tell whether it's the route or your own edits.

The third one is the most overlooked. Managed company machines often block driver installation, and the symptom isn't a clear error dialog — the installer rolls back halfway through, so it looks like “it finished but nothing happened”.

Download the client and install it

Sign in to the dashboard and open the download page, choose the Windows column and grab the current installer. Keep two things apart here: the client is the shell, the subscription is the route list inside it. On a new machine you only sign in once — the list syncs back on its own, with no new request needed.

1. Double-click the installer. When Windows shows the User Account Control prompt, choose Yes — otherwise adapter creation will fail later.
2. Choose an install location. The default path is fine; if you must change it, avoid directories with non-ASCII characters, spaces or very deep nesting.
3. The installer creates a virtual network adapter. If Windows asks about the network location, choose Private network, not Public network.
4. When installation finishes, the client minimises to the tray and an icon appears at the bottom right of the taskbar.

Can't find the tray icon

Windows 11 tucks new icons into the overflow area of the tray by default; click the expand arrow at the bottom right of the taskbar to see them. To keep it visible, drag the icon out of the overflow area — the setting follows the system account.

Sign in and get the subscription into the client

Open the client and sign in with your username and password. Registration needs only a username and password — no email address — so there is no “click the link in your inbox” step; a successful sign-in is all it takes. In most cases the client pulls the subscription automatically and the route list appears within seconds.

Manual import when the automatic pull fails

1. Go back to the dashboard and copy the subscription link.
2. In the client, find the Subscription or Configuration entry and choose Import from link.
3. Paste the link, give the subscription a name you'll recognise, and save.
4. Click Update once, wait for it to finish, then look at the route list.

A subscription isn't a one-off snapshot either. Routes being added or removed and protocol changes all land in the same link, and the client refreshes it on every launch. Leave it un-updated long enough and the usual result is a route that still appears in the list but won't connect when you click it.

How the client reads the protocols in a subscription

A single subscription usually mixes several protocols. Shadowsocks and Trojan are simple in structure with fast handshakes; VMess and VLESS carry more configuration fields and are sensitive to system time; Hysteria2 and TUIC run over UDP, which holds up better against jitter on weak or long-distance links but depends on UDP forwarding on your local network. The client builds connections per protocol, so you never pick one by hand — if one route in a region won't connect, another usually will.

Choose a route by use case, not by name

The 210+ routes on the routes page are spread across 90+ countries, and the names all look alike. What decides the experience isn't the name — it's the path that route takes to the international internet.

To pick one, match the scenario:

• Peak-hour video and long video calls: IEPL dedicated first, then a relay in the same region.
• Everyday browsing, AI tools, software downloads: a relay is enough — pick whichever looks smoothest in the same region.
• Quick lookups: direct or any working route will do; no need to hunt for the best one.

Rule mode or global mode

Clients generally offer two ways to take over traffic. Rule mode decides by split tunnelling rules: domestic sites go direct, overseas sites go through a route, and only matching traffic is proxied. Global mode pushes all traffic through the route. Use rule mode day to day — domestic sites keep their speed and you don't burn traffic for nothing; only when a particular site won't open and you suspect a missing rule should you switch to global temporarily to check whether the rule is the problem.

Verify the exit really took effect

The client showing Connected doesn't mean traffic is actually going through the route. A minute spent on three checks saves you from later mistaking “not working” for “slow route”.

DNS is the one most often skipped. Browser cache, system DNS cache, the client's own resolver cache — any layer holding a stale answer will keep producing “connected, but the page still won't load”. After changing settings, flush the cache first:

:: flush the local DNS cache
ipconfig /flushdns

:: show the resolver currently in use and the lookup result
nslookup www.example.com

:: check the routing table to confirm the virtual adapter took over the default route
route print

With TUN mode on, the output of route print shows a virtual adapter holding the default route. If it doesn't, the client only changed the system proxy, and software outside the browser (some desktop clients, command-line tools) won't go through the route automatically. This is the most common reason for “the browser works, everything else doesn't”.

Turn on auto-start and hand off the repeat work

By now the connection works; the remaining problem is clicking connect by hand every time you boot. Client settings usually have two switches: Launch at startup and Connect on launch. Both need to be on — with only the first, the program starts but the route stays down.

1. Client settings → General, tick Launch at startup.
2. On the same page, tick Connect on launch and pick a default route.
3. Open Task Manager → Startup apps and confirm the client's status is Enabled.
4. Reboot once and check whether the tray icon appears on its own and shows connected.

Laptop users have one more: whether to stay connected on battery. Most clients disconnect automatically at low battery by default, and that behaviour can be changed in settings. If you carry the laptop between meetings, turning it off saves you trouble.

Troubleshooting order for common problems

When something breaks, don't start with “try a different client”. Work through the order below — in most cases the first three steps locate the problem.

1. Check the client status: does it show connected, and which route is in use?
2. Switch routes: another one in the same region, then one of a different type (dedicated → relay → direct).
3. Check the exit: did the location on the IP lookup page change with it?
4. Check DNS: does the resolver returned by nslookup follow the route?
5. Check the system proxy and TUN: does route print show a virtual adapter holding the default route?
6. Restart the client; if that doesn't help, disable and re-enable the network adapter once.

Connected, but pages won't load

Try an incognito window first. Incognito rules out extensions and cache; if it works there, the problem is a browser extension or the DNS cache, not the route. Next check the clock: VMess and VLESS are sensitive to system time, and a large offset fails the handshake outright — just turn on Windows' Set time automatically.

Virtual adapter driver installation failed

Errors like this come down to permissions or security software. Confirm the account is an administrator, temporarily stop the security software's driver blocking, and run the installer again; restore the blocking afterwards.

Plan tiers and when to upgrade

Once the client is set up, only one choice is left: whether your monthly traffic is enough.

All three tiers are monthly subscriptions; traffic resets each month on your activation date, and upgrading mid-cycle converts the difference into remaining days. The number of devices isn't limited, so one plan can cover several computers at home. If you only back up large files now and then, a traffic pack (use it up, never expires) fits better than moving up a tier.