Setting up a VPN on Windows takes more than installing an app. Your subscription, route, and app traffic all need to work together. This guide walks through installation, import, connection, verification, and startup in order. Complete each step before moving on so you can pinpoint problems as they arise.
Button names vary between clients. This guide refers to features such as “subscription,” “configuration,” and “system proxy” rather than assuming a particular app is available in your dashboard. If the interface looks different, check the dashboard download page and the client’s documentation. You can also review the guides for compatibility details.
Before you install: verify the client and subscription source
First, sign in to the MHZVPN client download dashboard and find the Windows download. Sign in to the Windows client to get access. If the page lists different system architectures, check “System type” under Windows Settings → System → About and choose the matching version. Don’t guess based on the filename alone.
If the download page offers an installer, run it and follow the prompts. If it offers a portable archive, extract all files to a dedicated folder before launching the app. Don’t run it from the archive preview. Keep the folder in place if you enable startup later.
- Open the dashboard download page and check the platform, version notes, and supported operating system.
- Launch the client. On first run, you’ll usually see its main window; after minimizing it, the app may remain in the notification area.
- If Windows displays a permissions or firewall prompt, verify the app’s source and purpose before proceeding. Don’t disable system protection without checking.
- Quit any other proxy or tunneling clients for now to prevent them from changing network settings at the same time.
Import a subscription: get your route list
A subscription link isn’t a regular bookmark; it’s usually used to retrieve routes and configuration. If your client signs in and syncs automatically, follow its prompts—you won’t need to look for an import button. Use the steps below only with clients that require a manual subscription.
- Find the subscription or configuration section in the dashboard and copy a link compatible with your client. If there are multiple formats, check the format notes before choosing one.
- Return to the client and look for “Add,” “Import from URL,” or a similar option under “Subscription,” “Configuration,” or a related section. Paste the link and save.
- Update the subscription and check for a success message and route list. If the app asks you to enable the configuration, set the one you just imported as the active configuration.
- Open the route selection page. Make sure the list isn’t empty before connecting.
If the import fails, check for extra spaces, make sure the link is complete, and verify that the subscription format is supported. Shadowsocks, VMess, Trojan, and VLESS refer to different proxy protocols or configuration types; not every client supports the same combinations. These names also don’t indicate that a route is a dedicated line.
A successful update means the configuration was retrieved, not that your connection is working. If routes appear but don’t work, troubleshoot the route and proxy settings instead of repeatedly creating the same subscription. If the update itself fails, restore your regular internet connection, check your account status and dashboard messages, then contact support.
Choose a route and proxy mode
Start with a route that matches the region of the website or service you want to use, and note its name for comparison. A nearby region isn’t necessarily faster, and the exit region doesn’t tell you the full path your traffic takes. A direct route typically connects your local network to an overseas access point; a relayed route adds forwarding nodes; an IEPL dedicated line uses a dedicated transport link. The exit region and the destination website’s availability still need to be checked separately.
Look for the connection toggle and settings such as “System proxy,” “Proxy mode,” or “Routing mode” on the client’s main screen. Some clients combine these controls; others require you to enable them separately. A “Connected” status doesn’t mean every app is using the route.
| Setting | What it does | What to check |
|---|---|---|
| System proxy | Provides a proxy entry point for apps that follow Windows proxy settings | Whether the app reads system settings or has its own proxy configuration |
| Rule-based routing | Uses rules such as domains and addresses to choose between direct and proxied connections | Which rule matched the target app’s request |
| Global proxy | Applies a single proxy policy to requests that enter the proxy client | Doesn’t automatically route all system traffic through the proxy |
| TUN mode | Uses a virtual network interface to route traffic from more apps | Whether the client supports it, plus permissions, routes, and DNS settings |
For everyday browsing, start with the rule-based mode recommended by your client. If a specific website has problems, switch to global mode temporarily to see whether routing rules are the cause, then restore your previous setting. Games, command-line tools, and some work apps may not use the system proxy. Check the app’s documentation first, then see whether the client’s TUN mode is appropriate.
Verify it’s working: check your exit IP, DNS, and apps
Once connected, visit a working IP lookup page in your browser. If possible, check it once before connecting too, then compare the results. Make sure the lookup request follows your proxy rules; otherwise, seeing your local exit IP alone doesn’t prove the client is broken.
IP geolocation databases can be inaccurate, so a city name isn’t definitive proof of a route’s location. Also open the service you want to use and try a normal action, such as searching, signing in, or loading content. A working homepage doesn’t mean every resource it depends on is reachable.
- ✅ Check your exit IP: Confirm the test page uses the proxy, compare the IP before and after connecting, and check that it’s consistent with the selected region.
- ✅ Check DNS: Review the DNS test results and confirm your browser’s secure DNS, client DNS, and routing rules are set as expected.
- ✅ Check apps: Test your browser and the app you actually want to use separately. Review the client’s connection log for the destination and routing result.
- ✅ Check recovery: Disconnect the proxy and make sure your regular internet connection still works. This helps prevent a broken proxy setting from remaining after you quit the app.
If a DNS test shows a local resolver, first check whether that’s expected under your direct-connection rules. Investigate a possible leak only if requests that should use the proxy are still going to your local network’s resolver. The resolver’s location alone isn’t enough to draw a conclusion. Encrypted DNS in your browser also doesn’t mean every app’s DNS requests follow the proxy.
If your browser works but another app doesn’t, check the app’s own proxy settings and the client’s connection log. If there are no requests in the log, the app may not be using the proxy route. If requests appear but fail, check the matched rule, selected route, and destination service restrictions.
Configure startup: distinguish launch, connection, and traffic routing
Verify that the connection works manually before configuring startup. Launching at startup runs the app when you sign in to Windows; auto-connect determines whether it reconnects to a route; system proxy or TUN settings determine how app traffic enters the client. These features may have separate controls.
- Open “Settings” or “General” in the client and look for “Launch at startup” or “Start on login.” Enable it only if the client provides that option.
- Check for separate options such as “Connect on launch,” “Restore last configuration,” or restoring proxy settings, and enable them as needed.
- Check startup apps under Windows Settings → Apps → Startup. If the client uses Task Scheduler, it may not appear in the startup list; check the client’s documentation.
- Save your settings, restart the computer, and sign in. Check the tray status, active route, and proxy mode, then repeat the exit IP and app checks.
“Start minimized” only controls how the window appears; it doesn’t mean a connection has been established. If the network isn’t ready, the client may launch but fail to connect. Check whether it supports retrying once you’re online. Features that require administrator permissions may have additional startup requirements. Don’t work around them by disabling Windows access controls.
If the client has no built-in startup option, its documentation may describe how to add a shortcut to the Windows Startup folder. This won’t resolve permission elevation or reconnect issues by itself. If you move a portable app, install an update, or change its path, test startup again.
A troubleshooting order for common problems
Websites stop loading after you close the app
First check whether the client has quit while leaving its proxy address configured in Windows. Reopen the client, turn off the system proxy from its menu, and then quit. If needed, check Settings → Network & internet → Proxy in Windows. Don’t change settings managed by your organization. For other settings, note the original values before making changes.
A website worked yesterday but won’t open today
First confirm that your regular internet connection works. Then update the subscription and check that the route is still listed and your account and traffic status are in order. Keep the destination website the same, try another available route, then switch proxy modes temporarily to check whether routing rules are involved. Change one setting at a time so you can tell what made a difference.
What to include when contacting support
Note your operating system and client versions, when the issue occurred, the selected route, proxy mode, and exact error message. Redact subscription credentials and personal account details in screenshots, and inspect logs before sharing them. Contact us via support and describe specific symptoms, such as “the browser works but an app doesn’t” or “the subscription update failed.” That’s more helpful than just saying “it won’t connect.”
A checklist for your finished setup
Routine maintenance rarely requires changing network settings. Keep a known-working setup, and update the app and subscription according to the client’s instructions. After changing networks, updating the app, or editing routing rules, check your exit IP, DNS, and commonly used apps again. Route coverage alone can’t confirm that a particular service works.
If you’re still choosing a service, check the plan prices and traffic rules. MHZVPN monthly subscriptions reset each month on the activation date. Data add-ons never expire, and there’s no limit on the number of devices connected at the same time. You can request a full refund for any reason within 60 days of your first payment. See the FAQs for more details.