To set up a VPN on Windows, first import your subscription, then choose a server and verify the connection. Configure startup last. Avoid enabling every proxy option right after installation: a client showing “Connected” does not guarantee that browser traffic, desktop apps, and DNS requests are all routed as expected.
This guide follows the steps in order. Menu names vary by client, so refer to the Windows guide in your account panel and the current client interface. On a work-managed computer, check your device policy before installing proxy software or a virtual network adapter.
Before you install: check the client and subscription format
Sign in to your VPNHorse account panel and use the download page to get a Windows-compatible client and its setup guide. VPNHorse does not require an email address; create an account with a username and password. The client handles the connection, while the subscription provides server details and authentication settings, and may include routing rules. They are not the same thing.
Before downloading, check your system type in Windows under “Settings → System → About” and choose the matching installer. Use the download link in your account panel or the client developer’s official release channel. If the developer publishes checksums or signature details, verify them before running the installer. Do not disable Windows security protections just to complete setup.
The “Add a VPN” option in Windows Settings is not a general-purpose subscription importer. Protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC usually require a compatible client; you cannot paste a subscription URL into Windows’ built-in VPN settings. Even if a client supports a protocol, it may not support every subscription format.
- ✅ Confirmed the Windows client, system architecture, and import guide in the account panel.
- ✅ Obtained a subscription link compatible with the client—not a pricing page or account sign-in URL.
- ✅ Closed other proxy software that might conflict over the system proxy or virtual network adapter.
- ❌ Never paste a subscription link into public chats, online conversion tools, or unredacted screenshots.
Subscription links often contain access credentials, so protect them like passwords. If a link is exposed, check whether the account panel lets you reset it, then import the new link. Deleting a chat message cannot revoke a link that has already been copied.
Import your subscription: update the configuration, then check your servers
Open the client and look for “Configuration,” “Subscription,” or “Profiles.” If the account panel supports one-click import, your browser may ask to open an external app. Check that it is the correct client before allowing this. Otherwise, copy and paste the link; there is no need to enter each server’s settings manually.
- Copy the subscription link for the right client format from your account panel, and keep the full URL intact.
- In the client, choose “Import from URL” or “Add remote profile,” paste the link, and save.
- Run an update and confirm it succeeded; seeing a new profile name alone is not enough.
- Select the profile you just imported, make it the active profile, then open the servers or proxy groups page.
- Check that server names and groups appear, then choose one that suits your needs for a connection test.
If parsing fails, check whether the link was truncated, contains spaces at either end, or uses a format the client does not support. A URL may open in your browser but still fail to import if it returns a sign-in page or an error page; that does not mean the servers are unavailable. Switching countries repeatedly will not fix a parsing error.
Subscription updates and software updates are separate: the former refreshes servers and configuration; the latter updates the client itself. Updating a subscription may overwrite local changes. For custom rules, use the client’s override, merge, or extension features where available, and consult its documentation.
Proxy modes: choosing what to use for browsers and desktop apps
After importing successfully, decide which traffic the client should handle. If you mainly browse the web, a good starting point is system proxy with rule mode. Consider TUN mode if a desktop app does not follow the system proxy. These are not speed settings, and enabling more options does not necessarily make a connection more reliable.
| Mode | What it does | Best for | Keep in mind |
|---|---|---|---|
| System proxy | Routes traffic from apps that follow Windows proxy settings through the local proxy. | Browsers and apps that support the system proxy. | Some apps have their own network settings and may not follow it. |
| TUN mode | Uses a virtual network interface to capture traffic and route it according to the client’s rules. | Apps that ignore the system proxy, or situations where you need centralized traffic routing. | Often requires driver or service permissions and may conflict with other networking software. |
| Rule mode | Uses domains, addresses, or other conditions to decide whether traffic connects directly, uses a proxy, or is blocked. | Accessing local resources and international websites side by side. | The actual route depends on rule order, match conditions, and proxy group selection. |
| Global mode | Typically sends traffic entering the client through the selected proxy endpoint. | Temporarily checking whether a problem is related to routing rules. | Does not automatically capture traffic from every program on your computer. |
System proxy and TUN describe how traffic is captured; rule and global modes describe routing policies. They are not the same set of switches. With TUN enabled, you may need direct-connection rules for local printers, network shares, or a company intranet. If prompted for elevated permissions, verify the software source and feature documentation. Do not run unrelated programs as an administrator on an ongoing basis.
Get your browser working first, then test the desktop apps you need individually. Set up TUN according to the client’s guide only if you have a specific need to capture their traffic. This makes it easier to identify the effect of each change.
Choose a server for your needs—not just by location
When choosing a server, first check whether the service you want to use requires a particular region, then consider the client’s usage labels and your own experience. Browsing, video streaming, and remote work call for different checks: look for responsive page loads, smooth playback without buffering, and reliable calls with minimal interruptions. A single latency test cannot tell you all that.
A direct connection generally means the client connects straight to an overseas server; a relay routes traffic through an entry server first; IEPL refers to a link segment carried over a dedicated Ethernet line. These describe different network topologies or transport methods, not a universal ranking of performance. An IEPL label does not mean the entire route from your computer to a destination website uses a dedicated line.
VPNHorse offers 90+ countries and 210+ servers. Check the account panel for actual locations, types, and usage labels. Do not assume a particular city is available based on the count alone, or treat a location as a guarantee that a streaming service or AI tool will always be accessible. Platforms may also check account region, payment details, or the reputation of the IP address you connect from.
For apps that need a stable session, stick with a server you have tested rather than frequently switching endpoints. When comparing options, keep the device, local network, and task the same. Rule out local causes—such as a weak Wi-Fi signal or background downloads—before blaming the server.
Verify your connection: check your exit IP, routing, and DNS separately
A client’s “Connected” status usually confirms only that one part of the connection was established. Start testing with the task you actually need to do: can you open the target site, use your account, and connect from your desktop apps? Do not rely only on the system tray icon or a server test result.
- Check your exit IP: Visit a trusted IP lookup site to see the address your browser is using, and check that it matches the selected server’s expected region. An IP lookup reflects only that request; it cannot confirm that every app uses the same route.
- Check routing: Visit sites that should use the proxy and local services that should connect directly. In the client’s connection log, check the matched rule, proxy group, and endpoint.
- Check your apps: Open the desktop app you want to use. If it fails while your browser works, check whether it follows the system proxy or whether you need to enable TUN as described in the guide.
- Check DNS: Use a trusted DNS test alongside your client settings. If the results show a local resolver, first check whether it is expected under your direct-connection rules, then determine whether there is an unintended leak.
A DNS leak occurs when domain lookups that should follow your chosen proxy or DNS policy take an unexpected route. Browser encrypted DNS, client DNS settings, and system resolution can all affect the result. An unfamiliar resolver name alone does not prove a leak. Check what handled the request, which route it took, and whether that matches your routing goals.
VPNHorse’s privacy position is anonymous service with no logs. This does not prevent websites from identifying a signed-in account, cookies, or browser fingerprint. A proxy connection addresses network routing; it does not replace account privacy settings or device security.
Launch at startup: distinguish starting the app from connecting automatically
Set up launch at startup only after you have verified the connection manually. “Start client after login,” “connect on startup,” and “enable system proxy automatically” are often separate options; enabling one does not turn on the others. Desktop clients usually start after you sign in to Windows, not before the Windows sign-in screen appears.
First enable startup in the client settings, then decide whether it should restore the last profile, server, and proxy mode. Next, check “Settings → Apps → Startup” in Windows or the “Startup apps” section of Task Manager to make sure it has not been disabled. Menu names may vary slightly between Windows versions.
After restarting and signing in, do more than check whether the client appears. Verify that the profile loaded, the intended server is selected, the system proxy or TUN is active, and your apps can connect. Check again after waking from sleep or switching networks, as the network interface, routes, or DNS state may have changed.
For features that require administrator permissions, install the service or helper component as described in the client’s official documentation. Do not create a high-privilege scheduled task just to work around a startup problem. If the computer shut down before the client exited cleanly and the client then fails to start, the system proxy may still point to an inactive local endpoint. The result can be a working internet connection but websites that will not load.
Common issues: troubleshoot in order—configuration, traffic routing, then apps
Subscription updates, but websites will not load
First confirm that the active profile is enabled and a server is selected, then check that the system proxy is working. If only some sites fail, review which rules match. You can temporarily switch to global mode for comparison, but restore your original policy after testing. Avoid changing the client, server, and DNS settings at the same time, or it will be hard to tell what helped.
Browser works, but desktop apps do not
Check whether the app has its own proxy settings or is using a stale connection. Quit it completely and reopen it, then check whether the client logs show requests from the app. If no requests appear, start by checking how traffic is captured. If requests appear but fail, check the rules, endpoint, and any restrictions imposed by the destination service.
After closing the client, regular websites will not load
In Windows, open “Network & Internet → Proxy” and check whether the manual proxy is still enabled. If the setting was added by the client you just closed, disable the leftover setting or restart the client and exit it normally. Do not remove proxy settings managed by your organization without permission.
Connection drops after sleep, or TUN will not start
Wait for your local network to reconnect, then reconnect to the current server. For TUN issues, also check the service status, virtual network adapter, and conflicts with other networking software. Keep the error message and use the support page to share the client name, system type, and steps that led to the problem. Hide subscription links and authentication details before sharing screenshots.
Setup is complete only after you have verified that the client starts, the subscription loads, traffic is captured, rules match, and the target apps work. Check plan data separately from connection issues: monthly subscriptions reset on their activation date each month, while data packages never expire. Check your account panel for the available allowance.