Windows VPN from scratch: Install the Client and Enable Auto-Start

Setting up a Windows VPN breaks down into five steps: download the client, import your subscription, pick a node, verify the connection, and enable auto-start. This guide is written for anyone using a subscription service on Windows for the first time, and each step gives you instructions you can follow along with. If the client is already installed and you only need to fix one part, jump straight to that section.

Before you start: three things to prepare

Confirm these three things are in place before you begin — the steps that follow will go much more smoothly.

1. An account. Creating one only needs a username and password — no email address, and no extra verification steps. Desktop, mobile, and router all share the same account, so you don't need a separate one for each device.
2. A subscription link. Log in to the user panel and copy it from the subscription section. This link is the only credential the client uses to fetch the node list; section three explains what it contains and how to use it.
3. A network that can reach the panel. Downloading the installer and updating the subscription for the first time both require access to the panel page. If the panel is unstable on your current network, download over a different connection and then switch back to your usual one.

As for system version, recent Windows 10 and Windows 11 releases can install the desktop client directly; the installer is available on the panel's download page once you log in. Before installing, close any other proxy software that is running — two programs fighting over the system proxy settings is the most common source of trouble later on.

Download and install the client

Step one: get the installer. Log in to the user panel, open the download page, and choose the Windows version. The installer is a standard exe file — double-click it to begin.

Step two: complete the setup wizard. There aren't many options: install directory, whether to create a desktop shortcut, and whether to launch at startup. For a first install, leave "launch at startup" unchecked and turn it on in settings once you've confirmed the client connects. Keep the default install directory.

Step three: handle the first-launch prompt. On first run, Windows may show a SmartScreen warning with the message "Windows protected your PC". This happens because the installer came from a download. Click "More info", then "Run anyway" to continue.

Step four: check the client's initial state. After the client starts, the node list is empty and clicking connect does nothing. That's normal: node information isn't bundled with the installer — it's delivered through the subscription link. Don't keep clicking connect; move on to the next step. For a visual walkthrough of how the client differs across platforms, see the guides page on this site.

Importing the subscription link

What's inside a subscription link. It's an https address; when the client fetches it, it receives a node list where each entry has a server address, port, encryption method, and protocol type. A single list may include Shadowsocks, VMess, Trojan, VLESS, Hysteria2, TUIC and other protocols at the same time — they differ mainly in transport and resistance to interference. You don't need to understand each one; the client builds the connection automatically. Subscription formats vary slightly between clients, so when importing, choose the generic format or the Clash config format as your client prompts.

Copy the link. Log in to the user panel, find the subscription section, and copy the full link. Make sure you don't miss the trailing characters — paste it into a text editor first and check the length.

Import it into the client. Open the client's "Subscription" or "Profiles" page, create a new subscription, paste the link, give it a name you'll recognise (such as "Main"), save, then click update. Success looks like the node list going from empty to a long list of region names.

Set up automatic updates. Routes are adjusted from time to time, and manual updates are easy to forget. Most clients let you set an auto-update interval; the usual choice is to update on every launch, or once a day. Updating the subscription doesn't interrupt an active connection, but it's worth re-selecting a node afterwards.

Choosing a node by route type

After importing the subscription, the node list usually holds dozens or hundreds of entries grouped by region. VPNFL currently covers 110+ countries with 230+ routes, and there's no limit on simultaneous devices — plenty of choice, but you don't need to try them one by one. Understand the three route types first, then pick by what you need.

How to read node names

Node names usually combine region + route type + number, for example "Japan · IEPL 02". The region decides where your exit IP appears; the route type decides how steady that path is. If you need a fixed region for account logins, pick an IEPL line in that region; if you're just watching video, a relay node marked as high-bandwidth is usually enough.

Which routing mode to use

• Rule mode: uses a built-in rule set — local sites connect directly, while traffic that needs cross-border access goes through the proxy. Recommended to leave on day to day.
• Global mode: all traffic goes through the proxy. Useful for checking whether a particular app is actually proxied.
• Direct mode: nothing goes through the proxy — effectively turning it off temporarily.

Verifying the connection works

Connecting to a node doesn't mean it's taking effect. Browser cache, a system proxy that hasn't refreshed, or a routing rule that sends the target site direct can all make you think you're proxied when your exit IP is still your local ISP. Work through this checklist:

• ✅ The client shows connected, and the current node name matches the one you selected
• ✅ An IP check page shows an exit IP in the node's country or region
• ✅ DNS queries also go through the proxy and don't fall back to your local ISP
• ❌ The exit IP is still your local city — the proxy isn't handling your browser traffic
• ❌ The DNS server shows your local ISP — that's a DNS leak, so check whether the client is taking over DNS

If the exit IP hasn't changed, troubleshoot in this order: refresh the page, or open it in a new browser tab; then check whether the client is in rule mode and the target site is being matched as direct; finally confirm the "system proxy" switch is actually on — some clients need it enabled manually before they take over browser traffic. The IP check page on this site shows your exit IP and DNS location directly, so you don't need to install anything extra.

Spotting a DNS leak is straightforward: if the exit IP is overseas but the DNS server shows your local ISP, domain lookups are going out in the clear and results may still be shaped by your local network. Turning on the client's "take over DNS" option, or switching to TUN mode, usually fixes it.

Setting up auto-start

Once you've confirmed the connection works, go back into settings and turn on the automation options so the client handles its own daily startup routine.

1. Launch at startup. Enable it in the client's general settings and the client starts with the system, with its icon sitting in the taskbar.
2. Connect automatically on launch. With this checked, it connects to the last node used as soon as the system starts — no manual click needed.
3. Automatic node selection. Some clients can pick a node by latency testing. This suits users with many nodes and no fixed region; if you need a fixed exit region, locking one node manually is more reliable.
4. TUN mode. Turn this on when programs that ignore the system proxy — games, some desktop apps, command-line tools — also need to go through it. It creates a virtual network adapter that takes over all traffic, and usually requires administrator rights.

Common troubleshooting

Connection fails or keeps dropping

First switch to another route in the same region to see whether it's a single-route problem; if the whole group is down, update the subscription; if that still doesn't help, change protocol type — the same node over Trojan and over Hysteria2 can behave very differently on different networks. Some networks restrict specific ports, so switching protocol is often more effective than reconnecting over and over.

Speeds slower than expected

Change route type first: direct to relay, relay to IEPL dedicated line. Speed differences at peak hours come mainly from whether the path crosses the public internet. Also check that two proxy programs aren't running at once — when they compete for traffic, speeds drop noticeably.

Browser can't open pages after the client crashes

This is a leftover system proxy setting. Open PowerShell as administrator and run these in order:

# Clear the system proxy settings and restore a direct connection
netsh winhttp reset proxy
# Flush the DNS cache
ipconfig /flushdns

Then restart the client. In everyday use, if every page suddenly stops loading, check whether the client is still running before you suspect the route.

Some apps don't go through the proxy

Turn on TUN mode, or add the relevant domain to the proxy list in the client's rules. Browsers read the system proxy settings, whereas TUN mode applies to every program and covers more ground — at the cost of needing administrator rights and a brief network drop when you toggle it.

That's the whole Windows VPN chain walked through once: install the client, import the subscription, pick a route, verify the connection, enable auto-start. Once it's all set up, day-to-day use needs almost no maintenance — just check now and then that the subscription is updating. If you need a longer term or more traffic, compare options on the plans page before making a change.