How to Set Up a VPN on Windows 11: App vs Manual, Protocols, Kill Switch and Fixes

Windows 11 gives you two genuinely different ways to run a VPN: install the provider's own app, or build a connection by hand in the built-in Windows VPN client. The app is right for almost everyone; the manual client is for connecting to a specific server your provider or workplace gives you. This guide covers both, plus protocols, the kill switch, split tunneling and the errors that actually come up.

The two ways to run a VPN on Windows 11

Before you touch any settings, it helps to know which of the two paths you are on, because the steps diverge completely from there. One path installs a full application that manages everything for you. The other path uses the connection manager that Microsoft ships inside Windows, where you type in server details manually. They solve different problems.

• The provider app — you download a program from the VPN company, sign in, pick a location and click connect. It handles protocols, encryption, the kill switch and server selection automatically. This is the option most people want.
• The built-in Windows client — you open Settings and enter a server address, a connection type and your credentials by hand. There is no app to install. It is meant for connecting to one specific server, typically a work network or a self-hosted server, not for browsing a menu of countries.

The practical difference: the built-in client is a manual dialer. It cannot show you a list of cities, it will not rotate servers, and it does not include modern features like an automatic kill switch or ad blocking. If your goal is privacy on public Wi-Fi or reaching content while travelling, the app path is the one that gets you there. If your employer handed you a server address and a shared key, the manual path is what you need. Our main best VPN roundup is organised around the app path, since that is what the vast majority of Windows users end up using.

Method 1: installing a provider app (the easy path)

For everyday use — securing a coffee-shop connection, keeping your ISP out of your browsing, or reaching a service while abroad — the provider app is faster to set up and far more capable than the manual client. The whole process takes a couple of minutes and requires no networking knowledge at all. Here is the full sequence.

1. 1Go to the provider's official website in a browser and download the Windows app. Avoid third-party download sites and app-store clones, which are a common source of tampered installers.
2. 2Run the installer and approve the Windows User Account Control prompt. The app installs its own network driver, which is what makes the kill switch and split tunneling possible.
3. 3Open the app and sign in with the account you created when you subscribed.
4. 4Pick a server location. Choose one physically near you for the fastest speeds, or a specific country if you need an address in that region.
5. 5Click Connect. Within a few seconds the app confirms you are protected and shows your new virtual location.

That is the entire setup. The app has already selected a modern protocol for you, enabled encryption and, on most providers, turned on the kill switch by default. If you want to confirm everything is actually working after connecting, run a quick VPN speed test and check for a DNS leak or a WebRTC leak — those are the two ways an otherwise-connected VPN can still expose you.

Method 2: configuring the built-in Windows VPN client manually

The manual route lives in Settings and asks you to type in server details yourself. Use it when someone has given you a specific server address, a connection type and login credentials — a workplace network, a NAS box, or a server you host. You will need those details in hand before you start, because Windows cannot guess them.

Adding the profile

1. 1Open Settings, then go to Network & internet and select VPN.
2. 2Click Add VPN.
3. 3Set VPN provider to Windows (built-in).
4. 4Give the connection a name you will recognise under Connection name.
5. 5Enter the address you were given in the Server name or address field.
6. 6Choose the VPN type — the drop-down offers Automatic, IKEv2, SSTP, L2TP/IPsec with a pre-shared key, L2TP/IPsec with certificate, and the legacy PPTP.
7. 7Enter your sign-in info (usually username and password, or a pre-shared key for L2TP), then Save.

Once saved, the profile appears in the VPN list; click Connect to dial in. If you do not know which VPN type to pick, IKEv2 is the safest default on modern networks, and SSTP is the fallback when a restrictive firewall blocks everything else, because it rides over the same port as normal HTTPS traffic. Avoid PPTP — Microsoft keeps it only for backward compatibility and it is considered insecure. The next section explains those choices in more depth.

Choosing a protocol: what the options actually mean

A protocol is the rulebook that decides how your device and the VPN server talk and encrypt data. It affects speed, stability and how well the connection survives hostile networks. Provider apps and the built-in client expose different sets of protocols, so it is worth knowing what each one is good for before you commit.

In a provider app

Modern apps typically default to WireGuard or an in-house variant of it, and that default is almost always the right call. WireGuard is the fastest widely-used protocol — independent testing in 2026 puts it roughly 15–30% ahead of OpenVPN and modestly ahead of IKEv2 — and its small, audited codebase makes it easy to trust. OpenVPN remains the battle-tested fallback for networks that block WireGuard's traffic.

• WireGuard — fastest, lean and modern; best default for streaming, gaming and general use.
• OpenVPN — slower but extremely mature and good at slipping through restrictive networks; switch to it if WireGuard won't connect.
• IKEv2 — very stable when you move between Wi-Fi and mobile hotspots, so it shines on laptops that roam.

In the built-in client

The Windows client does not offer WireGuard or OpenVPN. Your realistic choices there are IKEv2 for a fast, stable modern connection, or SSTP when you are behind a firewall that blocks standard VPN ports — SSTP runs over TCP 443, the same port as HTTPS, so it usually gets through. L2TP/IPsec still turns up on older appliances and needs a pre-shared key or certificate. Treat PPTP as off-limits.

Enabling the kill switch

A kill switch is a safety net: if the VPN tunnel drops unexpectedly, it cuts your internet instead of letting traffic fall back to your exposed connection. Without it, a momentary drop can leak your real IP address and location for exactly as long as it takes the VPN to reconnect — which is more than enough for a tracker to notice.

This is a clear area where the provider app wins. Most apps ship with a kill switch you toggle in the settings menu, and many enable it by default. Some offer two modes: a full switch that blocks all traffic until the tunnel is back, and a selective one that only cuts specific apps. The built-in Windows client has no equivalent feature of its own — you would have to build blocking rules in Windows Firewall by hand, which is fiddly and easy to get wrong. If a reliable kill switch matters to you, that alone is a strong reason to use an app.

Split tunneling: routing only what you want through the VPN

Split tunneling lets you decide which apps or destinations go through the encrypted tunnel and which use your normal connection. It is genuinely useful: you can route your browser through the VPN while letting a banking app that flags foreign logins, or a local network printer, stay on your ordinary connection. That mix keeps speed high where you don't need protection.

• App-based split tunneling — pick specific programs to include in or exclude from the tunnel. Common in provider apps.
• Route-based split tunneling — the built-in Windows client can be told, via PowerShell, to send only certain routes over the VPN while everything else uses the physical adapter.
• Inverse split tunneling — protect everything by default and exclude a named few apps; handy when only one or two programs misbehave over a VPN.

In a provider app, split tunneling is a menu toggle where you tick the apps to include or exclude. Historically, some Windows apps forced you to choose between split tunneling and the kill switch, but providers have been closing that gap — a 2026 Proton VPN update, for example, let Windows users run split tunneling, the kill switch and ad-blocking together for the first time. Check that your provider allows both at once before relying on it.

Using your Windows 11 VPN to watch from anywhere

One of the most common reasons people set up a VPN on a laptop is to keep their usual streaming going while travelling. Connecting to a server back home gives your Windows machine an IP address in that region, so region-locked libraries and live sports behave as though you never left. It is the same setup you already did above — just pick a server in the right country.

This is where the app path pays off again, because you can hop between server locations in a click. From a single laptop you can reach your home Netflix catalogue, catch up on BBC iPlayer, or follow a match on Peacock. For a full walkthrough of which services work and how to pick a server, see our streaming VPN guide, and if you're planning around a specific fixture, the World Cup 2026 hub covers broadcaster-by-broadcaster access. You can also check any given title or event against our can I watch tool before you travel.

Troubleshooting common connection errors

When a VPN won't connect on Windows 11, the failure almost always shows up as a numbered error, and each number points at a specific cause. The three you are most likely to see are 809, 691 and 800 — mostly on the built-in client, since provider apps handle these situations internally. Here is what each means and how to clear it.

Error 809 — server not responding

This means the connection between your PC and the VPN server could not be established, usually because a firewall, router or your network is blocking the VPN's ports. IKEv2 and L2TP need UDP 500 and 4500 open. Try switching the VPN type to SSTP, which uses port 443 and slips through most firewalls. If both ends sit behind NAT routers, an L2TP/IPsec connection may need the AssumeUDPEncapsulationContextOnSendRule registry value added. Temporarily disabling the Xbox Live Networking Service can also resolve L2TP failures.

Error 691 — credentials rejected

The server refused your username and password, or the authentication method your client is offering isn't permitted. Retype your credentials carefully, confirm Caps Lock is off, and make sure the account is still active. If those are correct, the authentication protocol selected on your side may not match what the server allows — check with whoever provided the server.

Error 800 — connection could not be made

A broad error meaning the tunnel simply couldn't be built. Confirm you have a working internet connection first, double-check the server address for typos, verify the VPN type matches what the server expects, and update your router firmware. If you are on the built-in client and can't resolve it, installing the provider's app usually sidesteps the whole class of problem, because the app negotiates the connection for you.

If the tunnel connects but something still feels off — sites loading in the wrong language, or content that should be unblocked staying blocked — the issue is usually a leak rather than the connection itself. Test for a DNS leak, and if privacy is your main concern, our privacy VPN guide covers what to look for.

So which approach should you use?

For the overwhelming majority of Windows 11 users, the provider app is the right answer. It is quicker to set up, uses faster and more modern protocols, includes a real kill switch and split tunneling, and handles server switching and errors that would otherwise send you into registry edits. Reserve the built-in client for the narrow case it was built for.

• Use a provider app if you want privacy on public Wi-Fi, faster speeds, a kill switch, easy server switching, or to watch content while travelling.
• Use the built-in client only when connecting to one specific server you've been given — a workplace network or a self-hosted box — and you have the exact address, type and credentials.

If you've decided on the app route, our best VPN for Windows guide compares the current options on speed, features and price, and the live VPN price index shows what each is actually charging right now so you don't overpay on a first-year deal.