Setting up a Windows VPN takes more than clicking a “Connected” button. You need to link the client, subscription, route, and proxy mode, then confirm that the apps you care about actually use the selected route before enabling startup. This guide follows the setup process in order. Button names vary by client version and may include “Profiles,” “Subscriptions,” or “Configuration”; follow the Windows instructions provided in your control panel.
Before you install: understand clients and subscriptions
The client runs the connection; the subscription provides the route configuration. A subscription link isn’t a regular website URL or an installer, so pasting it into a browser usually won’t import it. Windows’ built-in VPN settings aren’t a universal subscription client either—you can’t simply paste a proxy subscription link there and expect it to work.
Sign in to the VPNWH control panel, then visit the client download page and choose the Windows version as instructed. Download access is managed through the panel, and you’ll need to sign in to get your subscription too. VPNWH doesn’t require an email address. For account or plan questions, contact support through the support ticket portal.
- ✅ Confirm that regular websites load without a proxy first, ruling out local network problems.
- ✅ In Windows, go to “Settings → System → About” and check your system type. Choose an installer that matches your processor architecture.
- ✅ Get the subscription link from the control panel and make sure you’ve copied it in full, without any extra instructions.
- ❌ Don’t post your subscription link in public forums, screenshots, or online configuration converters.
A subscription link usually contains account access credentials, so protect it like a password. When troubleshooting, obscure the link, account identifiers, and QR codes. If the link has been exposed, check whether the control panel lets you reset it, or contact support through a ticket.
Install the client: launch it before changing network settings
Open the installer provided in the control panel and follow the setup wizard. If you downloaded a portable archive, extract it to a fixed folder before running the main program; don’t launch it from inside the archive. Startup settings refer to the program’s file path, so moving the folder often can break them.
When you open the client for the first time, check that you can see a configuration list, routes page, or settings page. Some clients minimize to the system tray when launched, so check the taskbar notification area. Closing the main window may only hide it; it doesn’t necessarily stop the connection.
If Windows displays a security warning, verify the download source, file details, and control panel instructions. Pause the installation if you can’t confirm the source; don’t disable system protection just to proceed. System proxy mode usually doesn’t require running the client as an administrator all the time. TUN mode may need a service installed or administrator permission, so consider enabling it only after you’ve verified the basic connection.
Ready to move on: The client opens normally, its configuration area works, and it isn’t repeatedly reporting startup failures or a missing core. It’s normal for the route list to be empty at this point; import your subscription next.
Import your subscription and load the route list
- Find the subscription section in the VPNWH control panel and use the import option for your client, if available. If the panel offers a manual copy option, copy the complete subscription URL.
- In the client, open “Subscriptions,” “Profiles,” or a similar section. Choose “Import from URL” or “Add remote profile,” paste the address, and save.
- Select “Update subscription” or “Download configuration.” When it finishes, you should see a configuration name and routes or policy groups to choose from.
- Set the new configuration as the active one, then open the routes page. Saving a link without activating its configuration may leave the old one in use.
If the control panel offers one-click import, your browser may ask whether to open an external app. Allow it only after confirming that the target is the client you installed. If nothing happens, import the link manually rather than clicking repeatedly.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are names of different proxy protocols, not download buttons. Their names don’t mean this service offers all of them. Check the control panel and client documentation to confirm which protocols the client supports and which format the subscription uses. If routes appear but won’t load, the configuration format or core version may be incompatible; changing regions alone won’t fix that.
If an update fails, check the error first. For an invalid URL, copy it again. For an authentication error, check the subscription status in the control panel. For a timeout, first confirm that your current network can reach the subscription URL. Don’t remove URL parameters or repeatedly reinstall the client instead of checking the cause.
Ready to move on: The current configuration is enabled, the route list isn’t empty, and a manual update completes without further errors.
Choose a route and routing mode
Choose an exit region based on the service you want to use, then consider connection performance. A region in a route name usually indicates the exit location; it doesn’t guarantee that data takes the shortest path. IEPL describes a dedicated-line transport method. A relay route passes through a forwarding node, while a direct route generally avoids additional relay nodes configured by the provider. These labels don’t guarantee better performance on every network or at every time.
VPNWH covers 90+ countries and offers 240+ routes; available options are shown in the control panel. You don’t need to test every route during initial setup. Choose one that fits your needs, run the client’s connectivity check, and then open the app you want to use. A successful check only means its test target is reachable; it doesn’t guarantee access to every service.
| Setting | Coverage | When to use it | Keep in mind |
|---|---|---|---|
| System proxy | Apps that follow Windows proxy settings | A good place to start when testing browsers and common desktop apps | Not every app follows this setting |
| TUN virtual adapter | Routes network traffic within the capabilities of the client and routing setup | Consider it when an app ignores the system proxy | May require permissions and conflict with other virtual adapters or VPNs |
| Rule mode | Routes traffic based on domains, addresses, or other criteria supported by the client | Separates direct and proxied traffic for everyday use | Can be used alongside system proxy or TUN |
| Global proxy mode | Sends traffic handled by the client through the proxy policy | Useful for temporarily checking whether a rule is the problem | Doesn’t mean every app on your computer is covered |
In the client settings, enable “System proxy” and select rule mode; this is usually the easiest way to verify your setup for the first time. Routing rules decide where traffic goes, while system proxy and TUN determine which traffic reaches the client. They’re separate settings. Enabling “Global” doesn’t mean every app is using the proxy.
If your browser works but an app still can’t connect, check whether it has its own proxy setting, then review the client’s connection log. If you do need TUN, follow the client’s instructions to install the service and enable the virtual adapter. Pause other software that could compete for routes, and avoid changing several settings at once.
Verify the connection: check your exit IP, apps, and DNS
First, open the site you want to use in a browser and confirm that the page and sign-in flow load normally. Then visit a trusted exit IP checker and compare the results with and without the connection. In rule mode, the checker may be set to connect directly. If the exit IP hasn’t changed, check which rule handled the request before deciding the connection failed.
Next, test the desktop apps you actually use. A website loading in your browser doesn’t prove that an editor, command-line tool, or other standalone program uses the same proxy. If the client has a “Connections” or “Logs” page, find the entry for the target domain and confirm it was sent through the proxy policy—not routed directly or blocked.
A DNS leak occurs when domain lookup requests don’t follow the expected path. For example, a domain you expect to be resolved on the proxy side may still be sent to your local network’s DNS resolver. Enabling the system proxy alone doesn’t prove that DNS is routed correctly. Browser encrypted DNS, the client’s DNS settings, and how TUN handles traffic can all affect the result.
Use a trusted DNS check page to see which resolver is used, then compare the result with the client’s documentation. The resolver’s region shown on a check page doesn’t have to match the exit region, so don’t draw conclusions from the flag alone. If the result isn’t what you expect, start with the configuration recommended in the control panel and check whether an app is overriding DNS. Don’t layer in arbitrary DNS addresses you found online.
Connection checklist: The target site loads, the target app has an expected connection entry, and you can explain the exit and DNS routes. Local services you use every day still work normally. A changed tray icon or “Connected” status is only an indication that the client is running; it doesn’t replace these checks.
A proxy doesn’t replace a website’s own security measures. When signing in or handling sensitive information, check the HTTPS status, domain name, and app source. Encryption in transit can’t stop you from submitting your credentials to the wrong site.
Launch at startup: distinguish opening the app from connecting automatically
After verifying the basic connection, open the client settings and look for “Launch at startup,” “Start on login,” or a similar option. Desktop apps commonly launch after you sign in to Windows; this doesn’t necessarily establish a connection before sign-in.
“Launch client” and “Connect on launch” may be separate options. If you want the proxy to be available after sign-in, check that the current configuration, selected route, and system proxy or TUN state are retained. Some clients restore the previous state; others need a separate auto-connect option. Confirm the behavior in the client itself.
- Enable startup in the client and save the current configuration. Don’t add multiple startup entries for the same app.
- Open Windows “Settings → Apps → Startup” and make sure the client isn’t disabled. If it uses a service or scheduled task, it may not show all its startup details here.
- Restart your computer and sign in. Check the tray icon, active configuration, and connection status.
- Repeat the checks for your target website and app to confirm that the startup connection works as it did when launched manually.
If the client can’t save its startup setting, check the permission prompt and official documentation first. Don’t run every program as an administrator all the time just to make it launch at startup. With a portable version, avoid placing the program in a temporary folder that may be cleared.
If websites stop loading after you quit the client, Windows may still have the system proxy enabled even though the local proxy process has stopped. Reopen the client and turn off the system proxy normally. If the problem persists, check the manual proxy setting in Windows “Settings → Network & Internet → Proxy.” On a managed computer, follow your administrator’s requirements first.
Common issues: troubleshoot the symptoms instead of reinstalling
The subscription works, but no route will connect
First check your plan and configuration status, then try another available exit. If all routes fail, check whether the client supports the protocol used by the subscription, whether its core starts normally, and whether the firewall explicitly blocks the app. Keep the error message; don’t disable all security software.
The browser works, but developer tools keep timing out
Check the tool’s own proxy settings and environment variables first. Some tools only use their own settings; some processes need to restart before they pick up changes. Consider TUN only after confirming that the system proxy doesn’t cover the tool, and follow the client’s instructions. Don’t assume the route is slow just because this happens.
Startup works, but there’s no connection right after sign-in
Network initialization, Wi-Fi connection, and client startup happen in sequence. Check whether the client supports automatic retries, then see if it reconnects once the local network is available. If it continues to fail, note the first error after startup and compare it with the log from a manual connection. For more help, visit the troubleshooting guide.
When submitting a support ticket, include your Windows version, client name and version, proxy mode, the step where the problem occurred, and what you’ve already tried. Obscure subscription links and account credentials in screenshots. A clear description of what happened is more useful than importing the same link repeatedly.