Setting Up a VPN With the Windows 11 Built-In Client
how to set up vpn on windows 11: learn what to check, what the result means, common mistakes, and how to verify the setup with MyIPScan.
Quick Answer
Understanding how to set up VPN on Windows 11 requires separating the configuration steps from what actually changes when you connect. Windows 11 includes a built-in VPN client that works with third-party VPN services, but Windows does not provide its own VPN service. You supply the server address, authentication credentials, and protocol type from your VPN provider, then Windows handles the connection. The visible result is typically a changed public IP address and different DNS resolver, but account logins, browser fingerprints, and app-level signals remain separate layers that a network change alone does not reset.
This guide walks through the practical setup process, explains what each configuration option controls, and shows how to verify the result using MyIPScan and related diagnostic tools. The goal is a working connection that matches your privacy expectations, not a single impressive looking test result.
What Windows 11 VPN Support Actually Provides
Windows 11 includes a VPN client interface under Settings > Network & internet > VPN. This client can establish connections using several protocols—IKEv2, L2TP/IPsec, PPTP, and SSTP—but it does not include a VPN service, server infrastructure, or subscription. You need an existing VPN account from a provider that supplies server addresses, authentication credentials, and protocol details.
The built-in client is suitable for corporate VPNs, self-hosted servers, and some consumer VPN services that publish manual configuration details. Many commercial VPN providers offer dedicated Windows apps that handle configuration automatically, but the native client remains useful when you want direct control over protocol selection, DNS behavior, or split tunneling rules.
Supported VPN Protocols
Windows 11 supports four main VPN protocols through the native client:
- IKEv2/IPsec: Modern, fast, handles network changes well, widely supported by enterprise and consumer VPN services.
- L2TP/IPsec: Older protocol with broad compatibility, requires pre-shared key or certificate authentication.
- PPTP: Legacy protocol with known security weaknesses, not recommended for privacy-sensitive use.
- SSTP: Microsoft-developed protocol that tunnels over HTTPS, useful when other protocols are blocked by firewalls.
Most privacy-focused setups use IKEv2 or rely on a provider’s dedicated app that uses OpenVPN or WireGuard. The native client does not support OpenVPN or WireGuard directly; those require separate software.
Step-by-Step: How to Set Up VPN on Windows 11
Before starting, gather the required information from your VPN provider: server address (domain name or IP), VPN protocol type, authentication method (username/password, certificate, or pre-shared key), and any DNS or routing preferences.
Step 1: Open VPN Settings
Click Start, then Settings (the gear icon). In the left sidebar, select Network & internet, then click VPN on the right. You will see a list of existing VPN connections (if any) and an Add VPN button.
Step 2: Add a New VPN Connection
Click Add VPN. A configuration window appears with several fields:
- VPN provider: Select Windows (built-in) unless you are configuring a third-party client.
- Connection name: Choose a recognizable label, such as “Work VPN” or “Privacy VPN.”
- Server name or address: Enter the server address provided by your VPN service. This can be a domain name (vpn.example.com) or an IP address.
- VPN type: Select the protocol. IKEv2 is the default and recommended choice for most setups.
- Type of sign-in info: Choose the authentication method. Options include username and password, smart card, one-time password, or certificate. Most consumer VPNs use username and password.
- Username and Password: Enter your VPN account credentials if using password authentication. Check Remember my sign-in info if you want Windows to store the credentials.
Click Save when all fields are complete.
Step 3: Configure Advanced Options (Optional)
After saving the connection, it appears in the VPN list. Click the connection name, then Advanced options to access additional settings:
- Edit: Modify server address, protocol, or credentials.
- Advanced settings: Configure proxy use if required by your network.
- Connection properties: Adjust DNS settings, IPv6 behavior, and whether to use the VPN for all network traffic or only specific routes (split tunneling).
For privacy-focused use, ensure Use this connection for all network traffic is enabled unless you have a specific reason to route only certain traffic through the VPN.
Step 4: Connect to the VPN
Return to Settings > Network & internet > VPN, select your connection, and click Connect. Windows attempts to establish the connection using the saved credentials and protocol. A successful connection shows a Connected status and a small VPN icon in the system tray.
If the connection fails, check the server address, credentials, and protocol type. Some networks block VPN traffic on certain ports; switching from IKEv2 to SSTP can help in restrictive environments.
What Changes When You Connect
A successful VPN connection changes the network path your traffic follows, which affects several visible signals. Understanding what changes—and what does not—helps you interpret diagnostic results correctly.
Public IP Address
The most obvious change is your public IP address. Before connecting, your traffic exits through your ISP’s network, and websites see your ISP-assigned IP. After connecting, traffic exits through the VPN server, and websites see the VPN server’s IP instead.
Check this by visiting MyIPScan before and after connecting. The displayed IP address, network name (ASN), and approximate location should reflect the VPN server’s network, not your ISP. This change affects how websites and services identify your network endpoint, but it does not automatically change account identity, browser fingerprints, or app-level tracking.
DNS Resolver
DNS queries translate domain names into IP addresses. By default, Windows uses the DNS resolver provided by your network connection. When a VPN is active, Windows should use the DNS resolver provided by the VPN server, preventing your ISP from seeing which domains you visit.
Verify DNS behavior using a DNS leak test. If the test shows your ISP’s DNS servers instead of the VPN provider’s servers, DNS queries are leaking outside the VPN tunnel. This can happen if Windows is configured to use a third-party DNS service (such as Cloudflare or Google DNS) or if the VPN connection does not override the system DNS settings.
To fix DNS leaks, disable any custom DNS settings in Windows network adapter properties and ensure the VPN connection is configured to push DNS settings to the client.
What Remains Visible
Changing your network path does not reset all identity signals. Signed-in accounts, cookies, browser storage, payment history, and app telemetry remain linked to your identity even when your public IP changes. If you sign into the same Google, Microsoft, or social media account before and after connecting, those services can still associate your activity with that account.
Browser fingerprints—patterns created by screen size, time zone, language, installed fonts, and extensions—also persist across network changes. For high-risk situations, use a clean browser profile, avoid signing into personal accounts, and verify that multiple diagnostic layers show consistent results.
Verification Checklist
A proper verification process checks multiple signals, not just the public IP address. Use this checklist after connecting:
| Signal | What to Check | Tool or Method |
|---|---|---|
| Public IP address | Does it match the VPN server’s network? | MyIPScan public IP checker |
| DNS resolver | Are queries going through the VPN provider’s DNS? | DNS leak test |
| IPv6 traffic | Is IPv6 disabled or routed through the VPN? | IPv6 leak test |
| WebRTC leaks | Does the browser expose your local or ISP IP? | WebRTC leak test |
| Connection stability | Does the connection drop or reconnect frequently? | Monitor system tray icon and run repeated checks |
Run each check immediately after connecting, then repeat after 10 to a short test window to confirm the connection remains stable. If any result looks inconsistent, disconnect, change one setting, reconnect, and test again.
Common Configuration Issues
Connection Fails with “The remote connection was not made”
This error usually means Windows cannot reach the VPN server or the authentication failed. Check the server address for typos, verify your username and password, and confirm the protocol type matches your provider’s requirements. If you are on a corporate or public network, firewall rules may block VPN traffic; try switching from IKEv2 to SSTP, which tunnels over HTTPS and is harder to block.
DNS Queries Leak Outside the VPN
If a DNS leak test shows your ISP’s resolvers, Windows may be using a manually configured DNS server that overrides the VPN’s DNS settings. Open Settings > Network & internet > Ethernet (or Wi-Fi), click Edit next to DNS server assignment, and set it to Automatic (DHCP). This allows the VPN connection to control DNS behavior.
Some browsers, including Chrome and Edge, use DNS-over-HTTPS (DoH) by default, which can bypass the VPN’s DNS settings. Check your browser’s privacy settings and disable DoH if you want all DNS queries to go through the VPN tunnel.
IPv6 Traffic Bypasses the VPN
Many VPN services support only IPv4 traffic. If your network and the websites you visit support IPv6, that traffic may bypass the VPN tunnel entirely, exposing your ISP-assigned IPv6 address. Run an IPv6 leak test to check. If IPv6 leaks appear, disable IPv6 in Windows network adapter settings or choose a VPN provider that routes IPv6 traffic through the tunnel.
Split Tunneling Causes Inconsistent Results
Split tunneling routes some traffic through the VPN and some through your regular ISP connection. This is useful for accessing local network resources while connected to a VPN, but it can create confusing diagnostic results. If you see mixed signals—some checks show the VPN IP, others show your ISP IP—review the VPN connection’s advanced settings and disable split tunneling unless you specifically need it.
When to Use the Built-In Client vs. a Dedicated App
The Windows 11 built-in VPN client works well for corporate VPNs, self-hosted servers, and situations where you want direct control over protocol and DNS settings. It is lightweight, does not require additional software, and integrates cleanly with Windows network management.
However, most consumer VPN services provide dedicated Windows apps that offer easier setup, automatic server selection, kill switch features, and support for OpenVPN or WireGuard protocols. If your provider offers a native app, it usually provides a better user experience and more robust leak protection than manual configuration through the built-in client.
Use the built-in client when:
- Your VPN provider does not offer a Windows app.
- You need to connect to a corporate or self-hosted VPN server.
- You want to control protocol selection, DNS behavior, or routing rules directly.
- You prefer minimal software installation.
Use a dedicated app when:
- Your provider supports OpenVPN or WireGuard, which the built-in client does not.
- You want automatic server switching, kill switch protection, or split tunneling managed by the app.
- You prefer a simplified interface without manual configuration.
How to Interpret Diagnostic Results Safely
A good diagnostic result is consistent across multiple checks and matches your expectations for the connection type. The public IP address should reflect the VPN server’s network, DNS queries should resolve through the VPN provider’s resolvers, and IPv6 or WebRTC should not leak your ISP-assigned addresses.
A confusing result does not always mean the VPN is broken. It may indicate that your browser is using secure DNS, your network is using carrier-grade NAT, the VPN is configured for split tunneling, or the IP geolocation database has stale information. When results look inconsistent, repeat the same checks after changing one variable at a time: switch protocols, disable browser DoH, turn off IPv6, or test from a different browser profile.
Separate Network Signals from Account Signals
Network-level changes (IP address, DNS resolver) are separate from account-level signals (signed-in services, cookies, payment history). A VPN changes the network path, but it does not log you out of accounts or erase browser storage. If you sign into the same accounts before and after connecting, those services can still link your activity to your account identity.
For privacy-sensitive tasks, use a clean browser profile, avoid signing into personal accounts, and treat the VPN as one layer of protection, not a complete identity reset.
Location Accuracy Limits
IP-based geolocation is approximate. It can identify the city, region, or data center associated with an IP address, but it should not be interpreted as a precise physical location. IP addresses identify network endpoints, not exact street addresses. If a location check shows a nearby city or an unexpected region, compare the result with the VPN server’s documented location and check whether the network name (ASN) matches your VPN provider.
Advanced Configuration Options
Forcing Specific DNS Servers
If you want to use a specific DNS service (such as Cloudflare’s 1.1.1.1 or Quad9) while connected to the VPN, you can configure custom DNS servers in the VPN connection’s advanced settings. This overrides the DNS servers provided by the VPN server, which can improve privacy if you trust the third-party DNS service more than your VPN provider’s resolvers.
However, using custom DNS can also create DNS leaks if the VPN connection does not route DNS queries through the tunnel. Test DNS behavior after making changes to confirm queries are not leaking to your ISP.
Configuring a Kill Switch
The Windows 11 built-in VPN client does not include a native kill switch feature. A kill switch blocks all internet traffic if the VPN connection drops, preventing accidental exposure of your ISP-assigned IP address. If you need kill switch protection, use a dedicated VPN app that includes this feature, or configure Windows Firewall rules to block traffic on your physical network adapter while allowing traffic only on the VPN virtual adapter.
Creating firewall rules manually requires careful configuration to avoid blocking all traffic or creating persistent connection issues. Most users are better served by a VPN app with built-in kill switch support.
Using VPN on Demand
Windows 11 supports VPN on-demand triggers through enterprise policies, but this feature is not exposed in the consumer Settings interface. On-demand VPN automatically connects when you access specific domains or networks, which is useful for corporate environments but rarely needed for personal privacy use.
FAQ
Does Windows 11 include a free VPN service?
No. Windows 11 includes a VPN client that can connect to third-party VPN services, but it does not provide a VPN service, server infrastructure, or subscription. You need an existing VPN account from a provider that supplies server addresses and credentials. Microsoft’s official documentation explains how to configure the built-in client, but you must supply the VPN service separately.
Why does my IP address show the wrong location after connecting?
IP geolocation databases are approximate and can be outdated. The location shown in a diagnostic tool reflects the database’s best guess for the IP address’s network, not a precise physical location. If the location looks wrong, check whether the network name (ASN) matches your VPN provider and whether the result is consistent across multiple checks. Small location discrepancies are normal and do not indicate a problem with the connection.
Can I use the built-in VPN client with OpenVPN or WireGuard?
No. The Windows 11 built-in VPN client supports IKEv2, L2TP/IPsec, PPTP, and SSTP, but it does not support OpenVPN or WireGuard. To use those protocols, install the official OpenVPN client or WireGuard app, or use your VPN provider’s dedicated Windows application if it includes support for those protocols.
How do I know if my DNS queries are leaking?
Run a DNS leak test before and after connecting to the VPN. Before connecting, the test should show your ISP’s DNS resolvers. After connecting, it should show your VPN provider’s resolvers. If the test still shows your ISP’s DNS servers after connecting, DNS queries are leaking outside the VPN tunnel. Fix this by setting Windows DNS configuration to automatic (DHCP) and disabling any custom DNS settings in your browser or network adapter.
What should I do if the VPN connection keeps dropping?
Frequent disconnections can be caused by unstable network conditions, firewall interference, or protocol incompatibility. Try switching from IKEv2 to SSTP, which is more resistant to network interruptions. Check your router’s firewall settings to ensure VPN traffic is not being blocked. If you are on a mobile or shared network, carrier-grade NAT or aggressive timeout policies may interfere with long-lived VPN connections. Contact your VPN provider’s support team for protocol-specific troubleshooting steps.
Does using a VPN hide my activity from websites and apps?
A VPN changes your public IP address and can prevent your ISP from seeing which domains you visit, but it does not hide your activity from websites and apps you sign into. If you log into an account, that service can still track your activity and associate it with your account identity. Browser fingerprints, cookies, and app telemetry also remain separate from the network-level changes a VPN provides. For comprehensive privacy, combine a VPN with other measures: use a clean browser profile, avoid signing into personal accounts during sensitive tasks, and verify results using multiple diagnostic tools.