To set up a Windows VPN, first understand the difference between a client, a subscription, and system settings. Then install, connect, verify, and enable startup. Don’t paste a subscription link into Windows’ “Add a VPN connection” form: these usually use different connection methods.
The steps below follow the usual setup sequence. Client names and interfaces can vary by version. Terms such as “Subscription Management” and “System Proxy” refer to features, not necessarily the exact button labels in the current KekeVPN client. If you can’t find an option, follow the client instructions in the dashboard.
Before you install: system VPN or subscription client?
The VPN section in Windows Settings is for connections supported by Windows and requires a compatible server address, authentication method, and protocol. Subscription links from a dashboard are generally meant for compatible clients, which use them to retrieve routes and configuration. Pasting a subscription link into the Windows server address field won’t turn it into a working connection.
| Option | What you need | Where to set it up |
|---|---|---|
| Built-in Windows VPN | A server and authentication details compatible with a protocol supported by Windows | Settings → Network & internet → VPN |
| Dedicated service client | Account details or configuration specifically required by the dashboard | Download the client from the dashboard, then connect using its instructions |
| Third-party subscription client | A subscription link or configuration file compatible with the client | The client’s subscription or configuration settings |
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are distinct proxy protocols or solutions. Support for subscriptions alone doesn’t mean a client supports all of them. Check the client version and core compatibility in particular. This general protocol list also doesn’t indicate which protocols KekeVPN offers; check the dashboard and client for current support.
Get the client: open the Windows download page in the dashboard
KekeVPN accounts don’t require an email address—just a username and password. If you already have an account, sign in to the dashboard, then open the client download page and choose Windows. Don’t download installers from search ads, unfamiliar file-sharing sites, or forwarded chat messages.
- Open the Windows client instructions in the dashboard and check the supported Windows versions and processor architectures. To see your device’s system type, go to Settings → System → About in Windows.
- Download the client using the link provided in the dashboard and wait for the download to finish. If both an installer and a portable version are available, read the instructions for each. Extract portable versions to a fixed folder instead of running them from inside the archive.
- Open the downloaded file. If the installer requests administrator privileges, first verify its source and publisher. Don’t disable system security protections entirely just to install it.
- When installation is complete, open the client from the Start menu or its fixed folder. Make sure the main window appears before signing in or importing a configuration.
A Windows security warning doesn’t confirm that a file is unsafe, but it shouldn’t be ignored either. If the publisher information looks wrong, the source doesn’t match, or security software raises a clear alert, stop and verify the file through the dashboard’s support channel. Successful installation only means the program runs; it doesn’t mean your network connection has changed.
Import a subscription: load the configuration, then choose a route
For a dedicated client, simply sign in as prompted. If the dashboard requires a subscription link, first check which client and subscription format it recommends. Subscription links often contain account-specific credentials, so protect them like passwords. Don’t post them on public forums, online configuration converters, or in screenshots.
- Find the subscription section in the dashboard and copy the link for your client. Don’t copy the dashboard page URL from your browser’s address bar or mistake a traffic usage page for a subscription link.
- Open the client’s “Subscription,” “Configuration,” or similar settings page. Choose the option to import from a link, paste the address, and save. If the dashboard offers one-click import, confirm that the correct app will open before allowing your browser to launch it.
- Update or download the configuration and wait for confirmation. Check that routes appear in the list; don’t rely on the subscription name being saved as proof that the import worked.
- If your client requires manual activation, select the configuration you just imported. Then return to the connection page and choose a route. If the route list is empty, don’t keep clicking Connect.
If the import fails, first check that the link is complete and your account is in good standing, then confirm the format is supported. A parsing error often points to a format or core compatibility issue; a timeout is more likely related to your current network or whether the subscription link is reachable. These need different fixes, and reinstalling usually isn’t the first step.
Connection and split tunneling: start with browser access
Choose an exit region that suits the service you want to access, then compare the actual connection experience. A nearby route isn’t always the best fit, and the region in a route name doesn’t verify your exit location. A direct connection typically links your device straight to a service node; a relayed connection passes through a forwarding node; IEPL refers to a type of dedicated line. These terms describe routes or network resources, not guaranteed speed—and this article doesn’t promise that KekeVPN uses any specific route type.
Click the client’s connection toggle and check its status. If it offers a “System Proxy” option, enabling it routes requests through that proxy for apps that follow Windows’ system proxy settings. Some games, command-line tools, and apps with their own network settings may not follow those settings. Browser access alone doesn’t mean every app is connected.
If the client offers “Rule Mode,” it typically routes traffic directly or through a proxy based on conditions such as domains or addresses. The rules depend on the configuration. Start with the service’s recommended configuration rather than importing rules from multiple sources at once. “Global Mode” generally routes requests handled by the proxy core through the selected exit; it doesn’t cover traffic that never enters the core.
TUN mode typically uses a virtual network interface to handle more traffic and may require administrator privileges or additional components. Routing, DNS, and exclusion rules can still affect what it covers, so it doesn’t guarantee that every app is routed without exception. If only your browser needs to work, there’s no need to enable extra features just for the sake of it. If an app ignores the system proxy, check the client instructions before considering TUN mode.
Verify the connection: check your exit, destination, and DNS
A client’s “Connected” status is just the starting point. Before connecting, open My IP and note your current exit address. Connect, then refresh the page to check again. In Rule Mode, the test site itself may be routed directly. If the exit hasn’t changed, that alone doesn’t prove the client is failing; check which rule matched.
- ✅ Check your exit: Confirm whether the test request used the selected route. Geolocation databases can differ, so don’t draw conclusions from the city label alone.
- ✅ Check the destination: Open the site you actually want to use and test that the page loads or media plays. Loading the homepage doesn’t mean every feature works.
- ✅ Check individual apps: Test your browser and each app that needs a connection separately. Don’t assume results in one app apply to the others.
- ✅ Check after disconnecting: Turn off the connection and visit a regular website to make sure no broken proxy setting remains in Windows.
A DNS check looks at whether domain lookups follow the expected route. If your configuration is meant to handle DNS through the proxy but requests still go to your local network’s resolver, investigate further. With Rule Mode, however, keeping DNS lookups for local sites on your local network may be intentional. Seeing a local resolver in the results doesn’t by itself prove that all requests are leaking.
Browser Secure DNS, client DNS settings, system resolution, and IPv6 routing can all affect the results. Before testing, note your current settings, then adjust them one at a time according to the client documentation. Don’t change every setting at once. Even if your exit address changes, that doesn’t guarantee all DNS and IPv6 traffic follows the same route.
Launch at startup: distinguish opening the app from connecting automatically
Connect manually and verify everything before configuring startup. “Launch the client after signing in to Windows” and “connect automatically when the client launches” are separate settings. The first only opens the app; the second requires a corresponding client feature to be available and enabled. Most everyday clients start after the user signs in, not before.
- Open “Settings” or “Preferences” in the client and look for “Launch at startup,” “Start when I sign in,” or a similar option. If you can’t find one, check the dashboard instructions rather than editing the registry yourself.
- For automatic connections, look separately for “Connect on startup” or a similar option, and check which configuration and route the client will restore. If that feature isn’t available, connect manually.
- In Windows, go to Settings → Apps → Startup and check whether the app is disabled. In some versions, you can also check the Startup apps page in Task Manager. The names and locations of these settings vary by Windows version.
- After saving your settings, restart the device, sign in, and wait for the network to become ready. Check whether the client is running and connected, then repeat the exit and destination checks.
Don’t configure the same app to launch from the client settings, Startup folder, and Task Scheduler all at once. Doing so can create multiple instances or competing proxies. Whether features requiring administrator privileges can launch automatically depends on the client. Don’t use high-privilege startup scripts from untrusted sources.
If the first connection fails after a restart but works when you connect manually later, the network may not have been ready. First check whether the client supports a startup delay or automatic reconnection. Test separately after waking a laptop from sleep: waking isn’t the same as signing in again, so startup items may not run again.
Common issues: troubleshoot based on where they occur
| Symptom | Check first | Next step |
|---|---|---|
| No routes appear after importing a subscription | Format, update result, and whether the configuration is active | Recheck the client recommended by the dashboard; don’t share the full subscription link |
| Connected, but websites won’t load | Original network, system proxy, and selected route | Disconnect and check your basic connection, then try another route. Don’t add other proxy tools yet. |
| Browser works, but other apps don’t | Whether the app follows the system proxy | Check the app’s proxy settings or consider TUN mode as described in its documentation |
| No internet after closing the client | Whether a manual proxy setting remains in Windows | On a personal device, check Settings → Network & internet → Proxy and remove only the setting you added |
| The client launches at startup but doesn’t connect | Whether automatic connection is enabled separately | Check that the configuration is saved, your account is in good standing, and the network is ready |
Work-managed devices may have centrally configured proxies or security policies. Don’t override them without authorization. When contacting support, provide your Windows version, client version, the steps that led to the failure, and a sanitized error message. Logs may contain addresses and credentials; review them before sending, and never include passwords, full subscription links, or access tokens.
Keep an eye on data usage during regular use. KekeVPN monthly subscription data resets on the activation date. Data add-ons don’t expire and remain available until used. Unlimited simultaneous devices doesn’t mean unlimited data; usage across all devices counts toward your account. You can request a full refund for any reason within 7 days of your first payment. See the Plans page for full details.