How to Set Up a VPN on Windows (Step-by-Step)

The official app from your VPN provider is the easiest setup and gives you the kill switch, leak protection, and protocol selection that the built-in Windows client doesn't include.

1. Sign up for a VPN — see our reviews for recommended providers.
2. Download the Windows app from the provider's website.
3. Run the installer and follow the prompts. Allow the app to install its network adapter when prompted.
4. Open the app and sign in with your account credentials.
5. Click Connect — most apps will pick nearby recommended server automatically.
6. (Recommended) Open settings and enable Kill Switch and IPv6 leak protection.
7. Verify the connection with our What Is My IP tool — your IP and ISP should now match the VPN.

Most providers also offer a one-click WireGuard option, which is a modern protocol option. See our VPN protocols guide for details.

Windows 10 and 11 include a built-in VPN client that supports IKEv2, L2TP, and PPTP. This is useful if you want to connect to a corporate VPN or if your provider gives you raw configuration files.

1. Get the connection details from your VPN provider: server address, protocol (IKEv2 recommended), and your VPN username/password.
2. Open Settings → Network & Internet → VPN.
3. Click Add VPN.
4. Set VPN provider to *Windows (built-in)*.
5. Enter a connection name (anything you like).
6. Enter the Server name or address from your provider.
7. Set VPN type to *IKEv2*.
8. Set Type of sign-in info to *User name and password*.
9. Enter your VPN username and password.
10. Click Save.
11. Click the new connection in the list and click Connect.

The built-in client doesn't support WireGuard. For WireGuard, install the official WireGuard for Windows app from wireguard.com and import the .conf file your provider gives you.

For users who want WireGuard but don't want to use a provider's full app:

1. Download the official WireGuard client from wireguard.com/install.
2. From your VPN provider's dashboard, generate a WireGuard configuration file (.conf).
3. Open WireGuard for Windows.
4. Click Add Tunnel → Import tunnel(s) from file and select the .conf you downloaded.
5. Click Activate to connect.

WireGuard for Windows is open-source, reported, and significantly faster than IKEv2 or OpenVPN on most connections. NordVPN, Mullvad, ProtonVPN, and Surfshark all support manual WireGuard configuration.

After connecting, run these three checks:

1. IP check — Visit What Is My IP. The IP, ISP, and location shown should match the VPN, not your home ISP.
2. DNS leak test — Visit DNS Leak Test. Every resolver shown should belong to your VPN provider.
3. WebRTC leak test — Visit WebRTC Leak Test. Your real IP should not appear.

If any test shows your real IP or ISP, the VPN is leaking. Solutions: enable kill switch, switch protocol (try WireGuard), enable IPv6 leak protection, or disable browser-level DNS-over-HTTPS.

'No internet' after connecting: Usually a DNS issue. Open the VPN app settings and toggle 'Use VPN's DNS servers' off and back on. Or restart the Windows DNS Client service: open Services → DNS Client → Restart.

Connection drops repeatedly: Try a different protocol. WireGuard is most stable on stable Wi-Fi; IKEv2 is best for switching networks (Wi-Fi to cellular).

Slow speeds: Switch to a closer server. Switch to WireGuard. Compare with the VPN off at the same hour. Do not treat a single speed-test screenshot as a review score.

Windows Update breaks the VPN: Reinstall the VPN's network adapter. In the VPN app, go to settings → reinstall driver. If that fails, uninstall and reinstall the app.

Kill switch stuck off-internet: That means it worked. Disable the switch, reconnect, then turn it back on. See kill switch.

These steps are the consumer setup path. Dated first-party Windows notes, when we have them, appear on each provider’s How-we-tested section. Until then, your refund-window leak checks are the evidence that matters.