Windows VPN Setup: Install a Client, Import a Subscription, and Launch at Startup

Windows VPN setup: choose the right connection method

To set up a Windows VPN, first identify whether you need Windows' built-in VPN or a proxy client that supports subscriptions. For CPUVPN, the process is to get a client from the dashboard, sign in to retrieve your subscription, import the configuration, choose a region and route, then check the traffic path. Don't start by entering an arbitrary server address in Windows settings.

Windows Settings > Network & internet > VPN is for configuring VPN connections supported by Windows. A subscription link usually contains node or routing configuration for a specific client; it is not the server address requested by Windows' VPN settings. Pasting a subscription URL there does not import it.

Choose an option based on the configuration you have, not its name
Option	Configuration required	What to check
Windows built-in VPN	The relevant VPN type, server address, and authentication details	Whether the provider explicitly supplies setup instructions for Windows VPN
Subscription client	A subscription link or configuration file compatible with the client	Supported protocols, subscription formats, and import results
Browser proxy extension	Connection settings specified by the extension	Usually affects only that browser; it does not mean other apps are connected

This guide uses generic interface labels. Depending on the client version, you may see labels such as “Configuration,” “Subscription,” or “Profiles.” Follow the dashboard guide and the labels in your current client. To confirm which connection method to use, start with the setup guide; don't follow screenshots for a different app.

Install the client: source and permissions

Open the download page. Go to the CPUVPN client download dashboard, sign in, and select the Windows download. Don't download installers from mirror sites in search results or as chat attachments.
Check your system architecture. In Windows, go to Settings > System > About and check “System type.” If the dashboard offers builds for different architectures, choose the matching one. If you're unsure, follow the download page instructions rather than choosing based only on your computer's brand.
Run the installer. Choose an installation folder in the setup wizard and complete the installation. If User Account Control appears, check the program's source and name before allowing it to run. If you downloaded a portable client as an archive, extract it to a permanent folder before running it.
Make sure the interface opens. After launching the client, look for the configuration or subscription manager. Not having a configuration yet or seeing no regions listed doesn't usually mean the installation failed.

System proxy mode and virtual network adapter mode require different permissions. The latter may install a network service or virtual adapter and ask for administrator approval. That doesn't mean every client needs to run as administrator at all times. Grant only the permissions required for the feature, following the official instructions.

If Windows Security blocks the file, stop the installation and check the download source, file details, and dashboard instructions. Don't disable security protection or add an exclusion just to run a program from an unknown source.

Import a subscription: you're done when routes appear

A subscription link is a credential the client uses to retrieve configuration, not an ordinary sharing URL. Sign in to the dashboard and find the subscription or connection settings for your client. If the dashboard offers an “Import to client” option, follow the prompts to open the installed app. Otherwise, copy the link and import it manually.

Copy the subscription link from the dashboard, switch to the client, and open its “Subscription” or “Configuration” manager.
Choose the option to add a remote configuration or import from a link. Paste the full URL and give the configuration a recognizable local name.
Download or update the configuration. When it succeeds, you should see a configuration entry, a route list, or a policy group—not just a blank name.
Set the configuration as the active one. Some clients separate “Import” from “Enable,” so a successful save doesn't mean the configuration is in use.

If the client reports a format error, check for leading or trailing spaces, a truncated link, or an incorrect subscription format. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocol names, and clients don't all support the same protocols. Their presence here doesn't mean CPUVPN offers all of them, and changing a file extension won't add protocol support to a client.

If retrieval fails, check your local network, subscription status in the dashboard, and the client's error message separately. Don't create repeated configurations with the same name to mask the problem. When contacting support, you can share the error text and client version, but hide subscription links, tokens, and account credentials. Redact any expanded links in screenshots, too.

How to tell the import is complete: the configuration updates, routes appear, and the configuration is selected. Seeing only “Link saved” doesn't mean you're ready to connect.

Choose a region, select a route type, and connect

Choose an exit region that works for the service you want to use, then select a route currently listed in the dashboard. A region name isn't a speed ranking, and the nearest region isn't automatically the best choice for your app. Service region policies, account requirements, and your ISP's routing can all affect the result.

Route types describe how a connection is carried. A direct route usually means the client connects straight to a service node. A relayed route typically goes through an access node before being forwarded to the exit. An IEPL route uses an international Ethernet private line for part of the path. Check the service documentation for how access and exit points are combined; the name alone doesn't tell you the full route or guarantee better performance.

Select a region or node in the client, then find the control to start, connect, or enable the proxy. If your configuration uses policy groups, make sure the group for the service you want uses the selected route, not “Direct” or another automatic option. Note the configuration name and region so you have a clear reference when testing.

Test one route in the same region first, then compare alternatives. Change one variable at a time—for example, switch nodes while keeping the routing mode unchanged. If you change the region, rules, and mode together, you won't know which setting made the difference, even if access starts working again.

System proxy, routing rules, and virtual network adapters

The system proxy provides a proxy for apps that follow Windows proxy settings, but not all software does. Some games, command-line tools, and built-in networking components may use their own connection methods. So if a website opens in your browser, that doesn't mean all traffic from your computer uses the selected route.

Virtual network adapter modes such as TUN route more network traffic through the client and usually cover more apps, but behavior still depends on routes, exclusion rules, protocol support, and DNS settings. This isn't a switch that guarantees every app will use the proxy. For your first setup, follow the dashboard guide and use its default settings. Once the basic connection works, configure apps that don't follow the system proxy, if needed.

Rule-based mode uses criteria such as domain, address, or process to decide whether traffic goes through the proxy or connects directly. Global proxy mode usually sends requests within the client's routing scope to the selected proxy policy; it doesn't necessarily cover every app. If a website's home page loads but sign-in or images fail, different domains may match different rules, or the remote service may have its own restrictions.

✅ Keep the current working configuration so you can restore it, then adjust one rule at a time.
✅ Check whether your browser has a separate proxy extension that could override the system proxy.
✅ Use the client on a network where you have permission; ask your administrator to handle policy issues on managed work devices.
❌ Don't run multiple clients that take over the system proxy or routes at the same time to compare results.

Check that it works: exit IP, DNS, and apps

A client showing “Connected” only confirms a connection state; it doesn't prove the target app is using the expected route. Check the browser's exit IP, DNS resolution, and the app's actual behavior separately. Each result applies only to what you tested.

Note your exit IP before connecting. Open the IP lookup page in your browser and note the displayed exit details. Connect, refresh the page, and compare them with your selected exit region. IP databases may take time to update, so don't draw conclusions from a single location label.
Check the DNS path. Use a trusted DNS test page to see which resolver is detected and where it is located. The result reflects the DNS path for that browser's current request; it doesn't automatically represent every app on your computer.
Test the app you want to use. Reopen it and test sign-in, content loading, or file transfers. Check browser behavior and standalone apps separately; one can't stand in for the other.
Retest with your usual rules. If you temporarily switched to global proxy mode while troubleshooting, switch back to the rules you plan to use and test again. Otherwise, you may mistake a temporary setup for the final result.

A DNS leak usually means that DNS requests expected to follow a particular protection route were sent to a resolver outside that route. Routing rules may intentionally send local domain lookups to a local DNS resolver, so detecting one doesn't necessarily mean something is misconfigured. Consider the domain being queried, the intended rules, browser Secure DNS settings, and how the client handles DNS.

If the old status remains after switching routes, close and reopen the target app to rule out connection reuse and caching. If only the browser behaves unexpectedly, check its extensions and Secure DNS settings. Don't start by resetting the entire Windows network stack: that adds variables to troubleshooting and may disrupt existing work network settings.

Launch at startup: startup doesn't mean connected

Launch at startup usually means the client opens automatically after you sign in to Windows. It doesn't provide a network connection before sign-in or guarantee that the client selects a route and connects automatically. Clients may offer separate options such as “Start at startup,” “Connect on launch,” “Restore system proxy,” or “Background service.” Read the description for each option.

Find the startup options in the client settings and enable launch at system startup. Enable a separate connection option only if you want the client to connect automatically.
In Windows, open Settings > Apps > Startup, or check the Startup apps list in Task Manager. The location varies by Windows version, and some service-based startup methods may not appear there.
Save your configuration and exit normally. Reopen the client and check whether the active configuration, region, and mode are preserved.
Restart your computer and sign in. Once the network is ready, check the client status in the notification area, then repeat the exit IP and app checks. Don't rely on whether a window appears on the desktop.

If no window appears after sign-in, check the taskbar notification area; the client may be set to run minimized. If the client starts but doesn't connect, check whether the network is ready, the active configuration is valid, and the selected mode needs additional permissions. Moving a portable client to a different folder may also break its startup shortcut.

When you exit, check whether the system proxy is restored. An unexpected shutdown can leave proxy settings pointed at the local client, preventing browsers from accessing the network after the client closes. Check Windows Settings > Network & internet > Proxy. Change only settings you enabled yourself; don't remove configurations managed by your employer or school.

You're set when: after a restart and sign-in, the client runs as expected, the configuration and route are preserved, the exit IP matches your rules, and the target app works. Your regular network should also work as expected after you exit the client. Once all these checks pass, you can use the configuration as your regular setup.

Common issues: narrow down the cause by symptom

Subscription updates successfully, but nodes won't connect

Updating a configuration and establishing a proxy connection are separate processes. First check the service status in the dashboard, your system date and time, and the selected route. Then try another available route in the same region. If every route fails, save the client error message and report it through a dashboard support ticket. Don't share the full configuration file publicly.

The browser works, but other apps can't connect

First check whether the app follows the system proxy, has its own proxy settings, and which rules match its requests. If needed, configure virtual network adapter mode using the client guide. Don't use browser results as a substitute for testing the app, and don't enter a local proxy port found online without verifying it.

Local services or shared devices become unreachable after connecting

Check LAN bypass options, route exclusions, and relevant rules. Enabling a virtual network adapter or changing global routing can change how local devices are reached. Restore the last working configuration to confirm the cause, then add the necessary exceptions using the client documentation. Don't disable the firewall just to regain access.

For ongoing maintenance, keep configuration sources clear, changes reversible, and tests easy to compare. After updating the client or subscription, recheck your frequently used apps and startup behavior. For current plan details and service limitations, see the plans and FAQ; don't treat old screenshots as current instructions.