How to set up a VPN on Windows 11

Windows is the platform where VPN apps differ most — the mobile versions are all fairly similar, but the desktop clients are where kill switches, split tunnelling and leak protection either exist or do not. It is also the platform with the most notorious DNS leak, which is worth understanding even if the fix is a single checkbox.

Use the app. Here's the two-minute version.

1. 1

   Download from the provider's own site

   Get the installer from the provider's website or the Microsoft Store. Not from a download portal — those wrap installers in their own bundles, and a VPN client is the last piece of software you want repackaged by a third party.

2. 2

   Install, and allow the network adapter

   Run the installer. Windows will ask permission to install a network adapter — this is expected. The VPN creates a virtual adapter and routes your traffic through it; without it there is nothing to connect to.

3. 3

   Sign in and connect

   Open the app, enter your subscription login, and hit Connect. For general use, the nearest server. For a streaming library or a specific country, pick it from the list.

4. 4

   Turn the kill switch on

   In the app's settings. Several apps ship with it off, which is the wrong default and the reason to check rather than assume.

5. 5

   Confirm DNS leak protection is on

   Same settings screen, usually one line below. This is the Windows-specific one — see the next section for why it matters more here than anywhere else.

   A VPN client's DNS leak protection setting on Windowspublic/screenshots/windows-11-vpn-setup/01-dns-leak-setting.png

6. 6

   Verify

   With the VPN connected, load our IP checker and confirm the country and ISP changed. Then run a DNS leak test and confirm your own ISP does not appear in the results.

The Windows DNS leak, and why it is a Windows problem

Windows has a feature called smart multi-homed name resolution. When your PC needs to look up a domain, it does not ask one DNS server and wait — it asks every network adapter simultaneously and uses whichever replies first.

With a VPN running, you have two adapters: the VPN's virtual one, and your real network card. Your ISP's resolver is usually physically closer, so it usually wins the race. Your traffic goes through the tunnel; the list of every domain you looked up goes to your ISP.

The app shows "Connected" the whole time. Nothing looks wrong.

Every VPN we rate has a setting that forces DNS through the tunnel and blocks the other adapter from answering. In the good apps it is on by default. Check it anyway, and then verify with a leak test — that check takes fifteen seconds and it is the single most useful thing on this page.

A DNS leak test showing only the VPN provider's resolverspublic/screenshots/windows-11-vpn-setup/02-leak-test-clean.png

The built-in Windows VPN client

Settings → Network & internet → VPN → Add VPN. It exists, it works, and for a commercial VPN it is the wrong tool.

What it is for: connecting to a workplace or university network, where IT gave you a server address, a protocol and credentials. For that job it is fine and it is what it was designed for.

Against a provider's own client, the gap is not close:

VPN	Kill switch	Split tunnelling	Stealth mode	Avg speed
NordVPN	Yes	Yes	Yes	712 Mbps
Surfshark	Yes	Yes	Yes	655 Mbps
ExpressVPN	Yes	Yes	Yes	598 Mbps
Proton VPN	Yes	Yes	Yes	541 Mbps
PIA	Yes	Yes	Yes	480 Mbps

What it lacks for commercial use:

• No kill switch. If the connection drops, Windows quietly falls back to your normal connection. You will not be told.
• No DNS leak protection. The problem above applies with nothing to stop it.
• No WireGuard. It supports IKEv2, L2TP/IPsec, SSTP and PPTP. PPTP has been cryptographically broken for over a decade — never use it for privacy.
• No server list. One server per configuration. Switching countries means adding a whole new entry by hand.
• No obfuscation, no split tunnelling, no auto-connect.

If you want to set it up anyway — for a work network, or because your provider only supplies configuration files — you will need the server address, the protocol, and either a username and password or a certificate, all from whoever runs the VPN.

Settings worth changing after setup

Launch on startup, plus auto-connect. Both in the app's settings. Without them there is a window after every reboot where the machine is online and unprotected, and that window is exactly when Windows does its updates and telemetry.

Split tunnelling, if you need it. Windows apps handle this per-application, which is more useful than the mobile equivalents. Common uses: a bank that blocks VPN IP ranges, a work application that needs your real location, or a game you want connecting directly while a download stays in the tunnel.

Protocol: WireGuard. Or NordLynx, or Lightway. If the app is set to "Automatic", it may pick OpenVPN on some networks — set it explicitly.

IPv6 handling. Some VPNs tunnel IPv6, some block it, and a few ignore it, which is a leak. If your app has an IPv6 setting, "block" is the safe choice unless you specifically need it.

Troubleshooting

Connects, then no internet. Usually a leftover adapter from a previous VPN. Uninstall any old VPN clients, restart, and reinstall. If it persists, run ipconfig /flushdns and netsh winsock reset in an admin Command Prompt, then restart.

Connection fails on one network only. Some networks block VPN ports. Try a different protocol — TCP-based options like OpenVPN TCP or a stealth mode get through restrictive firewalls that block UDP.

Slow after a Windows update. Updates sometimes reset network adapter settings. Reinstall the VPN client; it is faster than diagnosing it.

Kill switch blocks everything and will not release. Some kill switches keep blocking after the app crashes, because that is the point. Reopen the app and connect, or disable the kill switch, restart, and re-enable it.

Two VPNs installed. Do not. Uninstall one.

Check it once, properly

Four checks, two minutes, and you never have to wonder again.

1. 1

   Confirm the IP changed

   Our IP checker should show a different country and a different ISP. A changed country with your own ISP still listed means something is half-configured.

2. 2

   Run a DNS leak test

   No resolver belonging to your ISP should appear. This is the Windows-specific failure and the one most worth checking.

3. 3

   Run a WebRTC test

   Our WebRTC test should show no real IP. Your ISP learns nothing new from this leak, but every site you visit does.

4. 4

   Test the kill switch

   Start a download, kill the VPN from the app, and watch the download stop. If it keeps going, the kill switch is not working and the other three checks do not matter.

If all four pass, Windows is configured correctly. If any fails, fix that before comparing providers — a leaking premium VPN protects you less than a correctly configured cheap one.