How do you use a VPN on Windows? Install a client compatible with your service, sign in to get your subscription, import the routes, and enable the proxy. Verify it by visiting a website, then configure the client to start with Windows. Avoid changing the proxy, DNS, and firewall settings all at once. Check each step as you go so you know where to troubleshoot if something goes wrong.
First, understand the difference: Windows VPN and subscription clients
The “Add a VPN connection” option in Windows Settings is for VPN protocols supported by Windows. You’ll need the server address, credentials, and connection parameters from your provider. It isn’t a general-purpose subscription importer. If you have a proxy subscription link, don’t paste it here.
Other tools use dedicated clients to read subscription configurations, then route traffic through the system proxy or a virtual network adapter. Configurations for Shadowsocks, VMess, Trojan, VLESS, and other protocols require a compatible client core. Hysteria2 and TUIC also have their own compatibility requirements. Being able to import a file doesn’t mean every protocol in it will work. Choosing a client recommended by your provider is more likely to result in a successful setup than downloading one at random.
| Method | Requirements | Traffic coverage and considerations |
|---|---|---|
| Built-in Windows VPN | Server settings and credentials for a supported protocol | Coverage depends on the connection’s routing; it can’t directly import common proxy subscriptions |
| Client system proxy | A compatible client and a valid subscription or configuration | Useful for testing in a browser first; apps that don’t follow the system proxy may connect directly |
| Client TUN mode | Client support, relevant drivers, or service permissions | Routes more traffic through a virtual network adapter, but routing, rules, and exclusions still apply |
Here, “VPN” is used in its everyday sense; follow the instructions for the client you’re using. A corporate VPN and a personal proxy are different setup scenarios. On a managed computer, follow your organization’s network policies and don’t replace existing settings without authorization.
Before you install: get your account, subscription, and client
VPNKiss doesn’t require an email address. Create an account with a username and password, then sign in to get the Windows client and subscription. Open the client section in the user dashboard and select the Windows version as instructed on the page. Don’t mistake the webpage URL for a download link.
- In Windows, go to “Settings → System → About” to check your system type, then choose an installer or portable version marked as compatible on the download page.
- Check the download source and release information. If you see a security warning, verify the file’s source and compatibility first. Don’t disable your security protection just to continue the installation.
- After installing or extracting the files, launch the client. Keep portable versions in a permanent folder; don’t move them after configuring startup.
- Sign in to the dashboard to get your subscription, then import it using the client instructions provided there. If the client supports account sign-in, use that process first.
You usually don’t need to grant administrator privileges for every feature the first time you launch a client. Only grant permission when a clearly identified action, such as installing a virtual network adapter or background service, requires it—and check what the permission is for. Keep the Windows Firewall enabled and allow access only for the relevant program path when needed.
Subscription links may contain account-specific credentials. Don’t post them on public forums, unfamiliar conversion sites, or in chat screenshots. Before reporting an import issue, hide the link and any tokens. If you suspect a link has been exposed, check whether the dashboard lets you reset it.
Import a subscription: check the configuration, then choose a route
Open the client’s subscription or configuration manager and look for an option such as “Import from URL” or “Add subscription.” Menu labels vary by app, so don’t rely on button position alone. Paste the complete link from the dashboard, save it, refresh the subscription, and set the new configuration as active.
After a successful import, you should see available routes or a policy group. If the list is empty, check that you copied the entire link, that it’s still valid, and that its format is compatible with the client. Being able to sign in to the website only confirms that the account portal is reachable; it doesn’t prove that the subscription was retrieved and parsed successfully.
For your first route, filter by the regions supported by the service you want to use, then test the connection. Labels such as a city name, direct, relay, or IEPL describe different things. Direct usually means a connection from your local network to an overseas node; a relay routes traffic through an additional forwarding node; IEPL refers to an international Ethernet private line provided by a carrier. These labels don’t guarantee a particular speed or that a website will always be available.
VPNKiss offers 100+ countries and 160+ routes. Check the dashboard for current options. For your first setup, stick to one route and confirm that websites work in your browser before comparing performance in your target app. Switching regions repeatedly makes it harder to identify problems and may trigger extra sign-in checks on the platform you’re using.
Enable the proxy: choosing between rule mode and TUN
A client showing “Connected” or a selected node doesn’t always mean app traffic is going through the proxy. Check the system proxy toggle, operating mode, and active policy group too. For an initial setup, enable the system proxy and visit a site you use regularly in your browser to verify the basic connection.
Rule mode routes traffic according to domains, addresses, or other matching criteria. A common setup sends local services directly and routes services that need an international connection through the proxy. Global mode usually sends traffic that reaches the client through the selected proxy, but it won’t automatically take over apps that bypass the system proxy. Global mode can help diagnose rule issues temporarily, but it doesn’t prove that all system traffic is covered.
If websites work in your browser but a desktop app can’t connect, check whether the app has its own proxy settings, whether it needs to restart, and whether client rules are routing it directly. If the app doesn’t follow the system proxy, consider TUN mode. Read the client’s instructions before enabling it, install any required components, and avoid running other tools that take over network traffic at the same time.
For a first setup: Start with the system proxy and confirm that your browser works. Enable TUN only if your apps need it. Rule mode determines where traffic goes; the system proxy or virtual network adapter determines how it reaches the client. They’re not interchangeable.
Verify the connection: IP address, DNS, and target apps
Don’t rely on the client’s connection icon alone. Check your browser’s public IP address and confirm that its location is consistent with the route you chose. Then open the website you actually plan to use and try signing in, loading a page, or completing another everyday task. IP geolocation databases can disagree, so the reported region is only one piece of evidence.
- ✅ The target website loads in your browser, and the reported location is broadly consistent with your selected route.
- ✅ The desktop apps you actually use work too—not just the browser test.
- ✅ Check the DNS resolution path and confirm it matches your proxy and split-tunneling settings.
- ✅ Disconnecting and reconnecting restores access, while local websites and work resources remain available.
A DNS leak occurs when domain lookups use an unexpected route—for example, when queries you expected to be handled by the proxy are sent through your local network instead. Secure DNS in the browser, the client’s DNS module, and system resolver settings can all affect the result. If a test shows multiple resolvers, check where they come from; don’t draw conclusions based only on the country where a resolver is located.
Also check IPv6. If your network supports it but the client handles only some traffic, your traffic may take inconsistent routes. Check the client’s IPv6 and DNS support, then adjust its traffic coverage or rules as needed. Don’t disable system features by default. A service may still determine eligibility based on your account region, payment details, and its own policies; a proxy connection doesn’t override those requirements.
Start with Windows: launching the app isn’t the same as connecting automatically
Once you’ve confirmed that a manual connection works, open the client settings and look for options such as “Start with Windows,” “Connect on launch,” or “Set system proxy on startup.” These options do different things, and not every client offers them. Enable only what you need, then fully close and reopen the app to see whether it loads the expected configuration.
If the client has no startup option, you can use the Windows Startup folder for your account. Press Win + R, enter shell:startup, and add a shortcut to the client executable. Add a shortcut, not a copy of the whole program. If the software provides a dedicated launcher, follow its instructions. This method usually runs the app after you sign in; it doesn’t mean the computer is connected as soon as it powers on.
In “Task Manager → Startup apps,” make sure the relevant entry isn’t disabled. For clients that need administrator privileges or a background service, use the service installation method provided by the client. A regular startup shortcut can’t bypass permission prompts, and creating a high-privilege scheduled task just to launch the app isn’t recommended.
After restarting and signing in to Windows, check the tray icon, active configuration, and proxy status, then revisit the target website. If the network connects slowly, the client may have launched before the connection was ready. Check whether it can reconnect when the network returns. Also test local access after quitting the client to make sure the system proxy hasn’t been left enabled.
Common issues: troubleshoot where they occur
Subscription won’t update or the route list is empty
First check the subscription status in the dashboard, whether the link is valid, and the client’s format requirements. Then determine whether the error is a network retrieval failure or a configuration parsing failure; the fixes differ. Don’t repeatedly import results from unknown conversion services. If the old configuration still works, save a copy before updating.
No websites load after enabling the proxy
Quit the client and check whether a manual proxy is still set in Windows under “Settings → Network & internet → Proxy.” Turn it off and test your regular connection. If you still can’t connect after disconnecting, troubleshoot your local network first. If only the proxied connection fails, check the selected route, system time, client logs, and security software alerts. Don’t reset all network settings right away, as this could affect other work configurations.
The browser works, but apps don’t
Check the app’s own proxy settings, which client routing rules match, and how much traffic TUN is taking over. Some apps read proxy settings only at launch, so fully quit and reopen them after making changes. Corporate networks may also impose restrictions; don’t use a personal client to override your organization’s requirements.
The app appears after restart, but it isn’t connected
Check in order that a valid configuration is selected, the system proxy toggle is enabled if needed, any required service permissions are in place, and the client reconnects when the network returns. Change one setting at a time, then restart and test again. Startup automation should reproduce a connection you’ve already verified, not conceal a problem with the manual setup.
Keep the client and subscription up to date, and note your current configuration name and key settings before updating. VPNKiss supports unlimited devices, but you’ll need to import and verify the configuration on each one. Setup steps for Windows may not apply to other platforms. For details on data usage and billing, see the plan pricing details.