Setting up a Windows VPN takes more than installing an app. Your subscription, selected route, and traffic routing mode all need to work together. This guide covers everything from downloading the client to launching it at startup, and shows how to check that your browser is using the route you chose. Test the connection manually first, then configure automatic startup to make troubleshooting easier.
Button names vary between clients. This guide refers to common options such as “Profiles,” “Subscriptions,” and “System Proxy.” If your client provides its own instructions, follow those and the setup guide. Don’t download software from unknown sources just to match a button name.
Before you install: understand clients, subscriptions, and accounts
The client reads configuration settings and establishes the connection. A subscription link retrieves route configurations. The account dashboard lets you view your plan, manage subscriptions, and access downloads. A subscription link isn’t a regular webpage or your login password, but anyone who has it may be able to use the service associated with your account. Treat it like a credential and keep it secure.
VPNShunshun doesn’t require an email address; you can create an account with a username and password. Sign in to download the Windows client and access your subscription. Go to the client downloads, choose the Windows version, and don’t rename an installer for another platform to use it on Windows.
- ✅ Make sure the download comes from the dashboard on this site, and check the filename against the dashboard’s instructions.
- ✅ In Windows, go to “Settings → System → About” to check your system type, then choose the matching architecture listed in the dashboard.
- ✅ Note where you save the configuration. Don’t post your subscription link in public forums or include it in screenshots.
- ✅ Pause other proxy clients that are routing network traffic to avoid conflicts over routes and system proxy settings.
Windows’ built-in “Settings → Network & Internet → VPN” isn’t a general-purpose subscription importer. Proxy protocols such as Shadowsocks, VMess, Trojan, and VLESS can’t be set up by pasting a subscription link into this Windows page. Use a client that supports the relevant protocols and configuration formats.
Install and launch a Windows client for the first time
- Open your browser’s downloads list, find the file you just downloaded from the dashboard, choose “Show in folder,” and check its source and file type.
- If you downloaded an installer, double-click it and follow the setup wizard. For a portable archive, extract all files to a permanent folder before launching the app. Don’t run it from the archive preview.
- When Windows asks for permission, verify the publisher and check the installation instructions. Stop if the publisher doesn’t match or the source is unknown. Don’t disable system protection to force an installation.
- After launching the app, check the notification area on the taskbar. Some clients minimize to the system tray when you close the main window. Click the tray icon to reopen them.
Administrator access may not be needed for standard system proxy mode, but installing a virtual network adapter or enabling TUN or a system service may require it. Grant permissions as directed by the client. “Always run as administrator” isn’t a fix for every problem.
Import a subscription: check the configuration before choosing a route
Return to your account dashboard and look for the subscription options. If there’s an “Import to client” button, make sure it’s for the app you installed. If the dashboard offers a copyable subscription link, add it manually in the client. Subscription links aren’t published in public articles on this site.
- In the dashboard, click “Copy subscription link” or the equivalent option. Don’t mistake the account page URL in your browser’s address bar for a subscription link.
- Open the client’s “Profiles,” “Subscriptions,” or “Profile management” page, then choose the option to add a remote profile or import from a link.
- Paste the link, enter a name you’ll recognize, save it, then update or download the configuration.
- Return to the profile list and select the newly imported configuration. Open the routes or proxy groups page and check that the route names appear correctly.
A successful import doesn’t always mean the configuration is active. Some clients require you to click “Use” or set it as the current profile. Avoid creating duplicates when you already have a remote subscription; duplicates make it easier to select the wrong one during updates. If the dashboard says the subscription has been reset, replace the old link instead of refreshing an expired one.
If you see a “format error,” first check whether the dashboard offers a format specifically for your client. Support for YAML, JSON, and URI lists varies between apps; supporting a protocol doesn’t mean a client can read every subscription format. Don’t submit credentials to an unknown online conversion service.
Choose a route and mode: send the right traffic through the right exit
Choose a route based on the region required by the service you want to use. If there’s no regional requirement, start by comparing nearby routes, but a shorter distance doesn’t guarantee better performance. The latency shown in a client usually reflects a specific probe; it can’t replace testing the websites, videos, or work apps you actually use.
IEPL, relayed, and direct routes describe how traffic is transported—not the client’s traffic-routing mode. Dedicated lines generally use carrier-provided private links; relayed routes pass through an intermediate server; direct routes typically connect from the local network to an overseas entry point. Actual performance still depends on your local connection, the exit, and the destination website, so don’t judge by the route label alone.
| Feature | What it does | When to use it |
|---|---|---|
| Rule-based routing | Uses rules such as domains and IP addresses to decide whether traffic connects directly or through a proxy. | Check this first for everyday use. Actual routing depends on the configuration rules. |
| Global proxy mode | Typically sends traffic handled by the proxy core through the selected proxy. | Useful for temporarily troubleshooting routing. It doesn’t automatically capture traffic from every app. |
| System proxy | Provides a proxy for Windows apps that follow the system proxy setting. | A good starting point for testing in a browser, but some apps won’t follow it. |
| TUN mode | Routes traffic through a virtual network interface and routing rules. | For scenarios that need broader traffic routing. Routes and exclusions can still affect what’s captured. |
For your first setup, try rule-based mode with the system proxy enabled, then test in a browser. If the browser works but a specific app doesn’t, check the app’s own proxy settings first. Enable TUN if needed, following the client’s instructions. Don’t enable TUN in multiple clients at once; they may conflict over routes, DNS, or virtual network adapters.
In short: “Global” describes how routing decisions are made, while system proxy and TUN describe how traffic is captured. To check whether a program uses a route, consider both the traffic capture scope and the program’s actual requests.
Check that it works: verify your exit, destination service, and DNS separately
Once connected, open IP lookup and refresh the results to compare your exit details before and after connecting. If the test request goes through the selected proxy, you’ll usually see a change in the exit information. Geolocation databases can be inaccurate, so the displayed location doesn’t have to match the route label exactly.
Next, open the actual website or app you need and test sign-in, page loading, and key features. A website working in your browser doesn’t mean a desktop app uses the same exit. Browser proxy extensions can also override the system proxy setting. Keep the access method consistent while testing.
Understanding DNS leaks
DNS translates domain names into IP addresses. Routing page traffic through a proxy doesn’t automatically mean every DNS query follows the same route. Whether a DNS leak is a concern depends on your intended setup: if a domain that should be resolved through the proxy is instead sent to your local resolver, investigate further.
Check whether the client has enabled the DNS settings recommended by its configuration, and whether your browser’s “Secure DNS” is set to use a different resolver. Rule-based routing may intentionally resolve local domains locally, so seeing a local resolver doesn’t prove that the entire configuration has failed. The resolver location reported by a test website also doesn’t reveal the actual path your traffic takes.
Launch at startup: configure app launch and auto-connect separately
After you’ve verified the connection manually, open the client’s “Settings” and look for “Launch at startup” or “Start when I sign in.” What people call launching at startup often means starting the app after you sign in to Windows—not connecting before sign-in.
- Enable the client’s built-in startup option. Choose to minimize to the system tray on launch if you prefer.
- Check for separate options such as “Connect on startup,” “Restore system proxy,” or “Enable TUN automatically.” These may not be enabled with the startup option.
- In Windows, go to “Settings → Apps → Startup” and make sure the client hasn’t been disabled. You can also check the Startup apps page in Task Manager.
- Save your settings and restart your computer. After signing in, check the system tray icon, selected route, and proxy switch, then test the destination service again.
If your client doesn’t have a startup option, follow its official instructions to use the Windows Startup folder: press Win + R, enter shell:startup, then place a shortcut to the app in the folder that opens. Don’t add the installer or subscription file, and don’t set up a second startup entry if the client already has one. Apps that require elevated permissions may not work through a standard startup shortcut.
Your network may not be ready when the client starts. If the connection fails briefly after you reach the desktop, wait for your local network to come online, then try again. Starting the app, selecting a configuration, restoring the proxy, and connecting are separate steps. Check each one during troubleshooting instead of relying on the icon alone.
Common issues: troubleshoot one symptom at a time
Subscription update fails or no routes appear
Check your account status and that the link is valid. Confirm the system date and time, then check the subscription format. If your current network can’t reach the subscription page, follow the dashboard’s help instructions; don’t change the link’s domain yourself. When submitting a support ticket, include the error message and client version. Hide subscription credentials in screenshots.
Browser works, but desktop apps don’t
Check whether the app follows the system proxy or has its own proxy settings. Then check the routing logs to see whether the destination was marked as direct. If you need TUN, configure it according to the client’s instructions and test again. Don’t disable the entire firewall. If you see a specific blocking alert, verify the app’s file path before adjusting its permissions.
Network stops working after you close the client
Reopen the client, turn off the system proxy, then exit normally. If the problem continues, go to “Settings → Network & Internet → Proxy” in Windows and check for a leftover manual proxy. Work-managed devices may have required settings. Record the current values and check with your administrator before making changes; don’t clear them without checking.
Once your connection is restored, revisit the startup and auto-connect settings. Use a single traffic-routing client, keep your subscription up to date, and distinguish between local network, configuration, and route issues when something goes wrong. For more help, visit the Help Center or go to support tickets.
You’re all set when: the configuration updates, your destination service works, traffic routing matches your expectations, and you can verify the setup again after a restart. Once these checks pass, keep auto-connect enabled if you want—it’s easier to maintain than turning on every option from the start.