Guide
How to set up a VPN on Windows
The installer, the three settings worth checking before you use it, and how to confirm the tunnel is actually carrying your traffic rather than sitting there looking connected. Written against Windows 11, version 26H2.
Before you start
This guide does not pick one for you
Every step below is the same whichever provider you use, which is why none is named here. Choosing is a separate job and it is done on the register, where the choice is made against a published score rather than against a download page.
Install the client from the provider's own site or from the Microsoft Store, never from a search result or a download portal. A VPN client runs a network driver with system privileges; a repackaged installer is the single worst thing you can give those privileges to.
Install the client
- Sign in on the provider's website first and download the Windows client from the account area. That way the file you run came from the same session that proved you have a subscription, and there is nothing to search for.
- Run the installer and accept the driver prompt. Windows will ask once to install a network adapter — that is the tunnel interface, and refusing it leaves you with an app that cannot connect. It appears in
Network Connectionsafterwards under the provider's name. - Sign in to the client using the same account. Most clients offer a device name at this point; it is stored by the provider, so give it something that does not identify you personally.
- Do not connect yet. Open the settings first. Two of the three settings below are off by default in most clients, and connecting before you set them is how the first session leaks.
The three settings worth checking
Client menus differ, the settings do not. Every one of the three has an entry in the glossary if the name is unfamiliar.
The kill switch
Blocks all traffic if the tunnel drops, instead of quietly letting the connection fall back to the ordinary network. It is usually off by default because it makes the product feel less reliable — a dropped tunnel becomes a dead connection rather than an unnoticed one, which is the entire point of it.
Turn it on. If the client distinguishes between a switch that only applies while connected and one that applies at boot, take the second: the gap between Windows starting and the client connecting is a real window, and on a laptop that resumes from sleep on strange networks it is the one that matters.
DNS inside the tunnel
Name lookups can leave the machine outside the tunnel even when everything else is inside it, which tells your network exactly which sites you visited and hides only what you did there. Look for DNS leak protection, use provider DNS, or a custom DNS field.
Set it to the provider's own resolver rather than a third-party one. You are already trusting the provider with the traffic; adding a second party who sees only the lookups increases the number of parties without reducing what any of them knows.
The protocol
Leave it on the modern default unless something is broken — the protocol page lists which are current and which are legacy. If the client offers an older option to fix a connection problem, that is a trade you should make knowingly and then undo: the register marks the weakest protocol a provider still offers, and selecting it by hand is choosing that mark for yourself.
Confirm it is actually working
Connect, then check rather than assume. Three checks, in this order, all of them free and none of them requiring software:
- Your address changed. Open any “what is my IP” page and confirm the country matches the exit you chose. If it shows your own country while the client says connected, the client is running and the traffic is not going through it.
- Lookups are inside the tunnel. Run a DNS leak test and read the resolvers it reports. Anything belonging to your internet provider means the DNS setting above did not take.
- The kill switch does what it says. With a download running, end the client’s background service in Task Manager, so the tunnel drops without the client being asked. The transfer should stop dead. If it carries on, the switch is decorative.
What those checks prove
+Your traffic is leaving through the exit server, in the country you selected
+The network you are sitting on can no longer read which sites you reach
+A dropped tunnel fails closed rather than quietly falling back
What they do not
−They say nothing about what the provider keeps — that is a documents question, answered on the retention pages
−They do not make you anonymous: your browser and your logins are unchanged, see what a VPN does not do
−A passing leak test today is not a promise about tomorrow's client update
When the app itself is the problem
A client that will not install, crashes the adapter, or refuses to connect on one network while working on another can usually be bypassed: most providers publish configuration files you can load into the official WireGuard or OpenVPN client instead of theirs. You lose the kill switch and the server picker, and you keep the tunnel.
When it does not work
Everything is slow after connecting
Expected, to a point: your traffic is taking a longer path. Pick an exit closer to you and try a second server in the same country before blaming the provider — a single overloaded exit is the common cause and the cheapest thing to rule out.
If every exit is slow on one network and fine on another, the network is shaping VPN traffic rather than the provider being slow.
The connection drops every few minutes
Usually the network rather than the client: hotel and captive-portal Wi-Fi frequently interrupts long-lived connections. Switching protocol in the client is the first test, since the modern one uses a different transport and often survives what the older one does not.
With the kill switch on, these drops are visible as dead connections instead of silent fallbacks — that is the switch working, not failing.
A site says it can see I am using a VPN
It can. Exit server addresses are published and widely listed, so any site that wants to know can look yours up. A VPN hides your traffic from the network carrying it; it does not disguise itself from the site you arrive at.
Nothing in the client fixes that, and a provider promising it does is selling something the mechanism cannot deliver.
Windows says the network is unidentified
Normal for a tunnel adapter. It affects the network profile Windows applies to that interface, not whether traffic is encrypted.
If file sharing or a printer stops working while connected, that is the profile change, and split tunnelling — sending local addresses outside the tunnel — is the setting that restores it.
Same steps, other machines
The rest of the platforms
Every platform has a guide of its own rather than a tab on this one. The steps diverge as soon as the installer opens, and a page that answers three platforms at once answers none of them properly.