Start with the basics of Windows VPN setup: understand clients, subscriptions, and system proxies, then install, import, choose a route, verify the connection, and enable startup launch. VPNFish monthly plans start at ¥9.9 and include IEPL routes and a 7-day no-questions-asked refund policy. Installing a client does not automatically route every app through an international connection.
You don’t need prior experience with network settings to follow this guide. Menu names vary by client, so look for the equivalent option. On a computer managed by your employer or school, check its device-use policy first. If you don’t have administrator access, don’t try to bypass those restrictions.
Before you install: understand clients, subscriptions, and connection modes
The client reads configuration and handles traffic. A subscription link provides routes and related settings, while the account dashboard is where you manage the service. Pasting a subscription link into a browser does not connect you, and a successful import does not mean Windows is routing traffic through the client.
A Windows VPN can mean the built-in Windows VPN feature or a proxy client. The latter can handle traffic through the system proxy or a virtual network adapter, and may not appear in Windows Settings under “VPN.” Its absence from that list does not mean the software failed to install.
| Setting | What it does | Common misconception |
|---|---|---|
| Subscription link | Provides route configuration to the client; the server determines the specific contents | It is neither an installer nor an ordinary public sharing link |
| System proxy | Lets apps that follow system proxy settings use a local proxy | This does not mean every program is routing traffic through the client |
| TUN mode | Uses a virtual network adapter to handle a wider range of network traffic | May require extra permissions and is still affected by routing and split-tunneling rules |
| Rule mode | Routes traffic through a proxy, directly, or another method based on domains, addresses, and other conditions | Some sites may connect directly by design; that isn’t necessarily a problem |
Step 1: Get and install a Windows client
Get a Windows-compatible client from the client download section of your account dashboard, then read the installation instructions provided there. Check your processor architecture under Windows “Settings → System → About” and choose the matching version. Don’t install a file just because its name includes “Windows.”
An installer version usually guides you through setup. A portable version often needs to be fully extracted before you run it from a permanent folder. Don’t launch the program from inside an archive or store it in a temporary folder that may be deleted; otherwise, updates, saved settings, and startup launch may stop working.
If a security warning appears, check the download source, file properties, and release notes before deciding whether to continue. Turning off system protection is not a standard installation step. A client may request administrator access to install a virtual network adapter or background service; grant it only to software from a source you’ve verified.
Step 2: Copy the subscription link and import the configuration
Sign in to your account dashboard and copy the link from the subscription or connection settings section. VPNFish does not require an email address. Keep your username and password safe after creating your account. In the client, look for “Subscription,” “Configuration,” or “Import from URL,” paste the complete link, and update it.
First, check that the client supports the subscription format. Protocol names such as Shadowsocks, VMess, Trojan, and VLESS are not the same as subscription file formats. A client’s support for a protocol does not mean it can parse every provider’s subscription. Follow the import method specified in the dashboard instead of editing the link yourself.
- Copy the full subscription URL. Make sure no spaces, line breaks, or punctuation added by a messaging app were included when you pasted it.
- Add the subscription in the client and update it. Check that route names appear, rather than just an empty configuration name.
- If you have multiple configurations, select the one you just imported, then check that its route group is available.
- If an update fails, check the error type to distinguish a network timeout, an account issue, and a parsing error.
Being able to open the dashboard in a browser doesn’t mean the client reaches the subscription endpoint the same way. If an old configuration has stopped working while the proxy is still on, the update request may be sent through an unavailable route. Temporarily stop the old connection, restore your normal network connection, and try again. Repeatedly refreshing won’t fix a format error.
Step 3: Choose a route and connect
Choose a location suited to your needs, then check that the connection is stable. For services with location requirements, consider your account region, the platform’s policies, and the exit location. A matching location name does not guarantee that a third-party service will work. For your first setup, stick to one route while testing so automatic switching doesn’t keep changing what you’re troubleshooting.
IEPL, relay, and direct describe how a route is set up, not client protocols. Direct usually means the client connects to an overseas entry point; a relay forwards traffic through an intermediate node; IEPL refers to the dedicated transmission resources used. Actual performance still depends on your local network, entry-point load, and the rest of the route, so a label alone can’t tell you what to expect.
Once you’ve chosen a route, enable the system proxy as described by your client and keep a suitable rule mode. First, test basic access in a browser. If the browser works but a particular app behaves differently, that app may not follow the system proxy. Check the TUN mode documentation before enabling multiple traffic-handling features at once.
TUN mode can conflict with other VPNs, virtual network adapters, and enterprise security software. If access to local devices or your work network fails after enabling it, check your rules and routes. Don’t delete direct-connection rules just to send “everything through the proxy”; local network access and system services may depend on them.
Step 4: Verify your exit location, routing rules, and DNS
A client’s “Connected” status usually means only that one part of the connection is ready. To verify it, check the exit location, the destination site, and the app you plan to use. Before and after connecting, check my IP and compare the exit location with your chosen route, then open the service you actually want to use.
An IP check shows the exit used for that particular web request. In rule mode, the check page may connect directly, so an unchanged exit IP doesn’t necessarily mean the proxy has failed entirely. Conversely, a changed browser IP doesn’t prove that other apps are using the client. Check the client’s connection logs to see which rule matched the destination domain.
- ✅ The target site opens, and the client shows the corresponding connection or rule match.
- ✅ Frequently used local sites and local network resources still work as expected; you haven’t disrupted existing routing rules just to test the connection.
- ✅ You’ve tested the app you’ll actually use, not just a page in your browser.
- ✅ The network recovers when you disconnect, with no system proxy setting left pointing to a stopped client.
DNS translates domain names into network addresses. If a query that should have gone through the proxy is unexpectedly sent to your local network’s resolver, it may reveal the domain being queried. But local DNS for sites routed directly by design is not automatically a leak. Assess DNS behavior against your intended routing rules rather than relying only on whether a test page shows a local resolver.
Your browser’s secure DNS, the client’s DNS settings, and DNS handling in TUN mode can affect one another. If some domains won’t load, check these settings against the client documentation and note their original values before making changes. Don’t change DNS in your browser, system, and client all at once; otherwise, even if things start working, it’ll be hard to know why.
Step 5: Set the client to launch at startup and check after restarting
Launching the client at startup, connecting automatically after launch, and enabling the system proxy automatically are separate settings. Selecting “Launch at startup” alone may only put the app in the system tray, without routing any traffic. Check each option you need and make sure your configuration and route selection are saved.
A client’s startup option usually launches it after you sign in to Windows; it doesn’t provide a connection before sign-in. For system services or features requiring elevated permissions, follow the client’s official instructions. Don’t create startup scripts with elevated permissions from unknown sources just to avoid an authorization prompt.
After saving your settings, check the status under Windows “Settings → Apps → Startup” or on the Startup apps page in Task Manager, then restart your computer. After signing in, check the system tray icon, configuration name, proxy status, and actual access. If you moved the portable app’s folder, its old startup shortcut may no longer work; set it up again in the client.
Your network environment may also change after waking from sleep. If the connection drops, first make sure your local network is working, then reconnect to the route. Launching at startup reduces manual steps but doesn’t replace checking network availability or guarantee that every app uses the proxy as soon as Windows starts.
Common problems: troubleshoot by scope instead of reinstalling repeatedly
Web pages load, but one app won’t connect
Check the app’s own proxy settings, the client’s routing logs, and its traffic-handling mode. Some apps use their own network stack and ignore the system proxy; others read the settings only when they start, so you may need to fully quit and reopen them. Once you’ve checked these factors, consult the documentation to see whether TUN mode is needed.
The computer loses internet access after you quit the client
The system proxy may still point to a local listening port that has stopped. Restart the client and quit it using its normal exit option. If needed, check the proxy settings in Windows network settings. On a managed device, don’t clear settings without permission; ask your administrator first.
Only some sites show certificate or time errors
First, check that your system date, time, and time zone are correct, then review the specific error reported by your browser. Don’t ignore certificate warnings to test a connection. If the issue occurs only on one route, save the error details and compare with another route. If it happens on multiple networks, continue troubleshooting your computer’s environment.
For more information on where to find settings, see the user guide. For service or account issues, visit the FAQ or submit a support ticket through your account dashboard. When reporting an issue, say whether it occurred during installation, subscription import, connection, or verification, and hide account details such as your subscription URL.