Windows VPN from Scratch: Installation, Subscription Import, and Startup Setup

Setting up a Windows VPN involves more than installing a client and clicking Connect. To route your browser, developer tools, and other apps through international routes as intended, you also need to import the subscription correctly, choose a proxy mode, review split-tunneling rules, and verify your exit IP and DNS. This guide walks through the process from a clean system and explains what each option actually controls.

What to check before installing the Windows client

The client is the local program that reads your subscription, establishes connections, and applies split-tunneling rules. The service provides routes and configurations; Windows cannot read a subscription link directly, so you need a client that supports the relevant protocols. Prefer the version recommended in the service dashboard, since its core, subscription format, and default rules are usually preconfigured for compatibility.

When downloading, distinguish between an installer and a portable version. An installer places the program in the system applications directory and typically provides better Start menu, uninstall, and startup integration. A portable version usually runs after extraction, making it easy to move, but it should not be stored in a temporary folder, download cache, or location subject to automatic cleanup. Neither format changes route quality; the main difference is file management and system integration.

✅ Get the client from the service dashboard or the project's official release channel. Avoid repackaged files from unknown sources.
✅ Check that the client supports the Shadowsocks, VMess, Trojan, VLESS, Hysteria2, or TUIC protocols used by the subscription.
✅ Exit other proxy clients before installation to prevent multiple programs from changing the system proxy, routes, or DNS at the same time.
✅ Keep the subscription link in its original form. Do not edit it with a document editor, which may automatically replace characters.
❌ Do not paste the subscription link into online parsing websites or provide configuration data to unfamiliar scripts.

How to assess a Windows security prompt

Some clients need to create a virtual network adapter, add routes, or enable the system proxy, so Windows may request permission. Check the program name, publisher, and download location before deciding whether to continue. Requiring administrator permission does not mean the program must always run as administrator; elevation depends on whether the client uses system proxy or virtual adapter mode.

After installation, open the main interface first rather than changing every setting at once. Confirm that you can find subscription management, the route list, proxy modes, connection status, and logs. Different clients may place these features in a sidebar, tray menu, or settings page, but their functions are the same.

Installation check: First-time users should prioritize a client that is clearly recommended in the dashboard, actively maintained, and compatible with the current subscription format. More interface features do not guarantee a more stable connection; core compatibility and configuration sources matter more.

Import the subscription link and update routes

A subscription link is not the address of a single route. It is the entry point the client uses to retrieve a set of nodes and their parameters. After import, the client parses server addresses, ports, protocols, transport methods, and authentication details, then creates a selectable route list. When the provider changes routes, you usually only need to update the subscription instead of editing each one manually.

Copy the subscription link. Open the subscription or client configuration section in the service dashboard and use the Copy button to get the complete link. Do not copy only the portion visible on screen if it has been truncated.
Open subscription management. In the client, look for “Subscriptions,” “Configuration,” “Profiles,” or “Remote Configuration.” The exact wording varies between programs.
Create a remote subscription. Paste the link into the address field. You can use the service name as a label to identify it later, but do not alter the link itself.
Run an update. Save it, then click Update, Refresh, or Sync. A successful update should display a route list. If the list is empty, check the logs first instead of importing repeatedly.
Choose a route. Start by selecting the appropriate destination region, then compare the route type and actual connection performance. Enable the system proxy or virtual adapter mode only after making your selection.

Why new routes do not appear after a successful import

Common causes include the client still showing an old configuration, the subscription group not being selected, or the update request being routed through an inactive route by the current proxy settings. Disconnect first, disable the system proxy, and update the target subscription once more. If logs are available, look for “download failed,” “parse failed,” “unsupported protocol,” and certificate-related messages.

Some clients store subscription files separately from the active configuration. Updating a subscription only means the remote content was downloaded; you may still need to apply the configuration or switch to the new profile group. If route names have changed but the active selection still points to an old profile, select an available route again.

How to choose protocols and routes

A protocol determines how the client encapsulates and transmits data, while a route type describes the network path from your local connection to the exit server. They are not the same thing. The same protocol can run over a direct, relay, or dedicated route, and the same network path may offer entry points for multiple protocols.

Protocol	Key characteristics	Windows considerations
Shadowsocks	An encrypted proxy protocol with a relatively simple configuration and broad client compatibility.	Confirm that the client core supports the encryption method and plugin parameters specified by the subscription.
VMess	Commonly used in configurations based on the V2Ray ecosystem and compatible with different transport methods.	An inaccurate system clock can affect authentication, and transport parameters must match the server exactly.
Trojan	Typically transmitted over a TLS connection and dependent on the domain, certificate, and server configuration.	Do not casually remove server-name indicators or certificate-related parameters from the subscription.
VLESS	Combines authentication and transport layers flexibly and is often supported by newer proxy cores.	An outdated client may not recognize transport or security parameters in the subscription.
Hysteria2	Built on QUIC and UDP, with an emphasis on maintaining transmission efficiency on complex networks.	If the current network restricts UDP, the connection may fail. Keep routes using other protocols available.
TUIC	Also built on QUIC and UDP, with support for multiplexing and congestion control.	It requires a compatible client core, and the firewall and local network must allow UDP.

You do not need to choose a protocol simply because its name is newer. If UDP is available and the client supports it, you can test Hysteria2 or TUIC; on restricted networks, TCP-and-TLS-based options are often easier to connect. The real-world performance of Shadowsocks, VMess, Trojan, and VLESS also depends on transport parameters, entry quality, exit-server load, and the destination site, so speed cannot be judged by protocol name alone.

Direct, relay, and IEPL dedicated routes compared

Direct routes usually access an overseas server directly from the local network. The path is simple, but performance across networks and during peak periods is more affected by public routing. Relay routes connect to a nearby entry point first, which then forwards traffic to the destination exit. This can reduce the impact of some unstable public paths, but the quality of both the entry point and relay segment directly affects the final experience.

IEPL dedicated access typically carries key sections of cross-border traffic over a private link to reduce the impact of changes in public routing. This does not mean every segment—from the endpoint to the entry point or from the exit to the destination website—avoids the public internet, nor does it guarantee the same latency at all times. Consider the destination region, application type, and actual connection logs when evaluating it.

Route selection: Choose an exit region suitable for the target service first, compare route types second, and test protocols last. Web browsing, code repositories, real-time communications, and large-file transfers have different requirements, so do not lock yourself to one route based only on its name.

Configure system proxy, virtual adapter, and split-tunneling rules

After a route connects successfully, the client still needs to determine which traffic enters the proxy. Windows clients commonly offer system proxy mode and virtual adapter mode. Understanding the difference explains issues such as “the browser works, but one application does not.”

System proxy mode changes Windows proxy settings. Browsers and applications that follow the system proxy hand requests to the client, but some games, command-line tools, and software with its own network stack may ignore it. This mode makes fewer changes and is suitable for initially testing web access.

Virtual adapter mode creates a virtual network interface and uses routing rules to take over a broader range of traffic. Different clients may call it TUN, virtual adapter, or enhanced mode. It covers more applications that do not read system proxy settings, but it is also more likely to conflict with firewalls, other virtual adapters, enterprise networking software, and older proxy programs.

Mode	Best for	Common limitations
System proxy	Browsers and desktop applications that follow Windows proxy settings	Some command-line programs, games, and standalone network components may bypass it
Virtual adapter	Taking over traffic from more applications or applying routing rules consistently	May require additional permissions and conflict with other virtual network components
Application proxy	Using a proxy only for a specific developer or download tool	The local proxy address and port must be entered separately in each application

Global, rule-based, and direct modes

Global mode generally sends all traffic within the client's interception scope through the selected route. It is the clearest option for troubleshooting, but local services and sites in mainland China may also take a longer path. Rule-based mode uses domains, IPs, processes, or rule sets to decide between proxy and direct access, making it better for everyday use. Direct mode bypasses the proxy and is commonly used to pause the connection or determine whether the proxy is causing a problem.

During the first setup, briefly use global mode to verify the route itself, then switch to rule-based mode. If an application works in global mode but fails in rule-based mode, the issue is usually route splitting rather than protocol connectivity. Check whether the target domain was incorrectly assigned to a direct rule and whether the application connects to a subdomain not covered by the rules.

Verify that the VPN is actually working

A client showing “Connected” only means that the local program has established some form of connection with a route. It does not prove that all application traffic is using the expected exit. Reliable verification should check the exit IP, DNS, target application, and the comparison result after disconnecting.

Record the pre-connection state. Disable the client proxy, open this site's IP Lookup page, and note the current exit region and network details.
Connect to the target route. Select a route and enable system proxy or virtual adapter mode, then wait for the client status to stabilize.
Run the lookup again. Open the IP Lookup page in a new browser window and confirm that the exit information has changed to the region associated with the selected route.
Check the target application. Fully quit and reopen the program that needs the route. Confirm that login, synchronization, downloads, or persistent connections can be established normally.
Disconnect for comparison. Pause the proxy and run the lookup again. If the exit returns to the local network, the path change can be observed consistently.

Check for DNS leaks and resolution paths

DNS resolves domain names to IP addresses. Even when web traffic uses a route, DNS requests may still be resolved directly by the local network, making the lookup path inconsistent with the exit path. Some sites may also return unsuitable endpoints when the resolution region differs from the exit region.

If the client offers “remote DNS,” “proxy DNS,” or “DNS hijacking” settings, follow the service configuration rather than entering a resolution method that conflicts with your split-tunneling rules. Virtual adapter mode often handles DNS more consistently, but you should still verify the result. A browser's own Secure DNS feature may also bypass client settings, so include browser configuration in your checks.

In Windows, you can use a terminal to inspect network adapter and DNS settings. The commands below only read the current state and do not change system settings:

ipconfig /all
Get-NetIPConfiguration
Get-DnsClientServerAddress

If multiple virtual adapters appear, do not identify the active one by name alone. Check the default route, DNS addresses, client logs, and the change in exit information before and after connecting. A virtual adapter left by an old client may still exist without being enabled.

✅ The exit IP changes consistently between the disconnected and connected states.
✅ The target application works as expected after a full restart.
✅ The DNS resolution path matches the current proxy mode.
✅ In rule-based mode, local resources and international services follow the expected paths.
❌ Do not judge whether it works solely by the taskbar icon or client animation.

Set up startup launch and automatic connection

Startup behavior involves two separate actions: launching the client and restoring the proxy state after the client starts. Enabling only “Start with Windows” may leave the client running without a connection; enabling only “Auto-connect” will do nothing if the program does not launch with Windows.

In the client settings, look for “Launch at startup,” “Start with Windows,” or a similar option. After enabling it, confirm in Windows startup app settings that the client has not been disabled. Installed versions usually register a startup entry automatically; portable versions may require the program path to remain unchanged. Moving the folder can invalidate the original startup entry.

Next, check options such as “Connect on startup,” “Restore previous state,” or “Auto-select route.” If the computer frequently moves between networks, let the client wait for network availability before connecting and keep a manual route switch available. Automatic selection may not understand the region of the target service, so explicitly choose the corresponding group when a fixed exit region is required.

Virtual adapter mode also requires attention to permissions. If the client stops at a permission prompt every time it starts, automatic background connection cannot complete. Use the service mode or official installation method provided by the client to handle permissions instead of using scripts from unknown sources to bypass system prompts.

Troubleshooting common issues in order

The client says it is connected, but websites do not open

Switch to direct mode first to confirm that the local network itself works. Then restore the proxy and try another route. If every route fails, check whether the system proxy still points to an old client that has been closed and whether the firewall is blocking the current program. If only the browser fails, inspect browser extensions, custom proxy settings, and Secure DNS. If every application fails, focus on the client core logs, routes, and DNS.

The browser works, but developer tools or games do not

This usually means the target program does not read the system proxy. Check whether the application offers HTTP, SOCKS, or system proxy settings; if broader interception is needed, consider virtual adapter mode. Do not configure inconsistent proxies in both the application and system layers, or requests may be forwarded twice or form a loop.

The original route disappeared after a subscription update

The remote configuration determines the subscription contents, so the local list changes when the provider removes or renames a route. First confirm that the selected subscription group is correct, then review the update log. If you manually changed generated nodes, those changes may be overwritten during an update. Keep persistent local rules in the client's dedicated override or custom-rules section.

The network cannot be restored after running for a while

Exit the client normally first so it can clean up the proxy and routes. Then check in Windows settings whether the system proxy is still enabled. In virtual adapter mode, temporarily disable that mode and reconnect to the local network. Do not start by deleting all adapters or resetting every network setting, as this can also affect enterprise networks, virtual machines, and other working components.

Change only one item at a time during troubleshooting: route, protocol, proxy mode, DNS, or split-tunneling rules. Changing several options at once may solve the problem without revealing the actual cause. Record when the error occurred and keep relevant log excerpts; this is more useful than simply reporting that the connection failed.

Final check: Windows setup is complete only when you can consistently reproduce a local exit before connecting, the selected exit after connecting, and the local exit again after disconnecting, while the target application follows the expected split-tunneling rules. A successful connection status is only one signal.