Setting up cross-border access on Windows is easiest when you handle client installation, subscription import, and startup separately. First get a connection working, then configure automatic startup. A tray icon alone doesn't mean every app is using the proxy. This guide walks through each step, what to expect, and how to troubleshoot.
Button names vary between clients. The instructions below refer to features such as “Subscription Management,” “System Proxy,” and “Rule Mode,” rather than assuming every version has the same interface. VPNGF users should follow the client setup instructions in the dashboard. On a work or managed computer, check your organization's network policies first.
Before You Start: Check Your Account and Download Source
A client is software that runs on your computer to establish a connection; a subscription provides the service configuration. Installing a client doesn't automatically give you access to routes, and having a subscription doesn't mean your computer is fully configured. Before you begin, make sure you have an active account, a valid subscription, and a stable local connection so you don't mistake an account issue for an installation problem.
VPNGF doesn't require an email address; create an account with a username and password. Sign in and visit the client downloads section in the dashboard, then follow its instructions to get the client. Active subscribers can access the client and subscription details there. Don't download from unknown mirror sites in search results or use subscription links forwarded by someone else.
Open Windows Settings and check your system type on the About page under System. If downloads are offered for different architectures, choose the installer that matches your computer. Don't rely only on the word “Windows” in the filename. Managed devices may restrict software installation or network changes; ask your administrator about those restrictions.
Install the Client: Make Sure It Starts Properly
If the dashboard provides an installer, save and run it, review the prompts, and follow the setup wizard. If it provides an archive, extract it fully to a permanent folder before launching the program inside. Running it from the archive preview can prevent configuration and update files from being saved correctly.
- Check where the file came from. Make sure it was downloaded from the source specified in the dashboard. If Windows displays a security warning, verify the source and publisher before proceeding. Don't make disabling protection your default fix.
- Finish the installation or extraction. Keep a portable client in a folder you can retain; don't leave it in a temporary folder that may be cleared regularly. An installer usually creates a shortcut for you.
- Launch the client and check the main window. You should see options for configurations, subscriptions, or routes. An empty route list doesn't mean installation failed; it usually means you haven't imported a service configuration yet.
- Keep the default connection settings. Don't run several proxy clients at once or rush to change ports, DNS, or virtual network adapter settings. Fewer variables make the initial setup easier to troubleshoot.
Standard system proxy mode shouldn't require you to run every program as an administrator. Some clients do need elevated permissions to enable a virtual network adapter or install a background service; follow that client's instructions in those cases. If no window appears after launch, check the notification area at the right end of the taskbar. The client may be running in the background, and its tray menu can usually reopen the main window.
The installation is ready when the main window opens, settings can be saved, and the client launches again after you exit. You don't need to test international websites yet: the route configuration hasn't been imported, so access results won't tell you whether the installation was successful.
Import a Subscription: Connect After Routes Appear
Open the subscription details section in the dashboard and follow the import instructions for your chosen client. A subscription link usually points to a configuration that can be updated; pasting it into a browser's address bar won't establish a network connection. A link for a single node and a full subscription are different kinds of import.
- Find the subscription or configuration option. In the client, open Subscription Management, Configuration Management, or Add Configuration. If the interface offers both “File” and “URL,” choose the URL option to import a link.
- Paste the subscription in the matching format. Give the configuration a recognizable name, then save it. If the dashboard offers options for different clients, copy the one that matches yours.
- Update or download the configuration. Saving a link and fetching routes may be separate actions. After you select Update, wait for the download to finish and check for a route list or policy groups.
- Activate the configuration you just imported. If you have multiple configurations, make sure the new one is selected. Then open the routes or proxy groups page to choose an exit route.
After importing, you should see route names or selectable policy groups, not just a subscription name. If an update fails, first check that the link is complete, the subscription is valid, the system date is correct, and your local network can reach the subscription URL. Extra spaces or line breaks, or a missing parameter, can prevent the link from being read.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different protocol families. Check separately whether the client core supports each one and whether the subscription can be converted for it. A client launching successfully doesn't mean it can recognize every protocol. Prefer the import method recommended in the dashboard over generic online instructions. This guide doesn't make assumptions about which protocols VPNGF offers.
Choose a Route: Start with Rule Mode
For your first connection, choose a route in the same region as the service you want to access, then enable the client's rule mode and system proxy. Rule mode uses domains, addresses, or other conditions to decide whether a connection goes through the proxy or connects directly. Global mode sends connections handled by the proxy core through the selected route. “Global” does not mean it takes over all network traffic on your computer.
IEPL, relay, and direct describe how a route is set up, not the protocol used by a client. IEPL typically uses a dedicated link for part of the connection path; a relay forwards traffic from an entry server to an exit server; direct routes generally connect from the local network to the exit server. Performance also depends on your carrier, destination, and current network conditions, so a label alone can't guarantee speed.
| Setting | Scope | Best for | Keep in mind |
|---|---|---|---|
| Rule mode | Selects proxy or direct connections based on configuration rules | Everyday browsing, work, and a mix of local and international services | If a rule matches incorrectly, traffic may use the wrong route |
| Global mode | Routes connections handled by the proxy core through the selected route | Briefly checking whether rules are interfering with access | Apps that don't use the system proxy may still bypass it |
| System proxy | Provides a proxy endpoint to apps that follow system proxy settings | Browsers and desktop apps that support the system proxy | Some games, tools, and background services don't use this setting |
| Virtual network adapter mode | Routes traffic through a virtual network interface and routing rules | Covering apps that don't follow system proxy settings | Depends on client support and may conflict with other networking software |
If routes are grouped by purpose, select the group you actually want to use and make sure it points to a specific route, not a direct or reject policy. For your first test, avoid switching between multiple automatic groups; changing routes makes it harder to reproduce the same app's results.
If a browser works but a game won't connect, don't keep switching regions. First check whether the game uses the system proxy, requires UDP, and whether the client and route support the required transport. A virtual network adapter can cover more apps, but it can't add support for an unsupported protocol or route.
Verify the Connection: Check Apps and DNS
The connection status is a starting point, not proof that everything works. Open a familiar local website first to confirm your basic connection, then try the service that needs an international route. If it loads, test the features you actually need, such as signing in, viewing images, downloading files, or syncing documents. Seeing the page layout doesn't mean every request used the right route.
- ✅ Check the client connection log for the target domain and confirm it matches the expected rule or policy group.
- ✅ Test in both a browser and the app you actually use. A working browser doesn't prove other apps are working.
- ✅ To check the exit region, use a trusted IP lookup tool. Remember that a separate browser proxy extension may affect the result.
- ✅ Disable separate proxy extensions and other proxy clients, then try again with one clearly configured proxy.
- ✅ When testing is done, switch back to rule mode and confirm local services and LAN resources still work as expected.
If global mode works but rule mode doesn't, check the matched rules and selected policy group first. If neither works, check the route, app proxy settings, and local network. Change one setting at a time and note the result before and after, so you can tell a rule issue from a connection issue.
DNS translates domain names into addresses, and proxy traffic and DNS queries may take different routes. A DNS leak generally means queries weren't sent along the intended privacy path and could be visible to other DNS resolvers. Browser Secure DNS, the client's built-in DNS, and Windows system DNS may all be involved. An exit IP alone can't confirm that DNS isn't leaking.
When using a trusted DNS test site, interpret the results alongside the client documentation. A resolver's location doesn't necessarily match the actual exit region, and a single test can't prove how every app handles DNS. Keep the recommended DNS settings during initial setup. If a domain won't resolve, check the client logs before changing anything; don't copy unfamiliar configuration snippets at random.
Configure Startup: Separate Launching from Connecting
“Start the client when Windows starts” and “connect automatically after launch” are different features. The first launches the app when you sign in; the second determines whether it loads a configuration, selects a route, and enables the proxy. Some clients also have a separate “Set system proxy automatically” option. Check each setting rather than assuming one switch does it all.
- Keep the configuration you've verified. Confirm the subscription and policy group are correct, then open the client settings and look for startup, general, or system options.
- Enable launch at startup. If the client offers this feature, use its built-in setting. Then check Startup under Apps in Windows Settings, or verify that it's enabled on the Startup apps page in Task Manager.
- Check automatic connection and proxy settings. If the client offers options to connect after launch, restore the configuration, or enable the system proxy automatically, turn them on if needed. If the client doesn't offer these features, don't assume it will route traffic after startup.
- Test again after restarting. Sign in to Windows and wait for the network connection to come up. Open the main window from the notification area, check the configuration, route, and proxy status, then test the target app again.
If a portable app is set to start automatically, don't move or delete its folder; the startup entry may point to a file that no longer exists. To move it, first remove the old startup entry, then set it up again from the new location. If the client has no built-in startup option, follow its documentation to add a shortcut to your user Startup folder. This only launches the app; it doesn't configure automatic connection.
Some virtual network adapter modes depend on a service or administrator permissions, and may not initialize when launched during a standard sign-in. If you see a permission prompt at every login, check the client's documentation for its supported service mode rather than disabling system controls. A company VPN, virtual machine networking, or other tunneling software may also change routes; coordinate their use with your work requirements.
If your browser stops working after you close the client, first check Proxy under Network & Internet in Windows Settings. If a manual proxy still points to the local client that has exited, restore the setting as the client documentation instructs. Don't remove proxy settings required by your organization. When closing the client normally, use its Exit or Restore system proxy option.
Common Issues: Check Each Step
Subscription Name Appears, but the Route List Is Empty
Return to Subscription Management, check the update result, and confirm the correct configuration is selected and fully downloaded. If the format isn't recognized, check that you chose the client type specified in the dashboard. If you see an authorization or validity error, check the subscription status there. Reinstalling repeatedly shouldn't be your first response to an import failure.
Browser Works, but Desktop Apps Won't Connect
Check whether the app has its own proxy settings and whether it follows the system proxy. Developer tools, command-line apps, and games may use separate network settings. Try a virtual network adapter only if the client documentation says it supports this. After enabling it, check LAN access and other network apps too, not just international websites.
Client Runs After Restart, but Connections Don't Work
Check that the correct configuration loads automatically, the system proxy is enabled, and the local network is ready when the client starts. If connecting manually restores access, focus on the automatic connection setting rather than just the Windows startup list. Check subscription update failures separately from whether an existing configuration can connect.
For help with dashboard steps, see Quick Start. For route details, refer to the Routes page. When contacting support, say whether the issue occurred during download, import, connection, or restart, and include the error message with authorization details redacted. Don't send your full subscription link or account password.