Windows 11 VPN Setup Guide: Import a Subscription and Connect

Before you begin: client and subscription compatibility

Clash Verge Rev is a Windows desktop client for managing proxy profiles. It is not the same thing as entering a server into Windows’ built-in VPN settings: a subscription is normally imported into the client, which then manages the selected profile and proxy behavior. Windows’ native VPN page generally expects connection details for a supported VPN protocol, not a subscription URL intended for a third-party client.

Before downloading anything, sign in to the service account that provides your subscription and locate its current client and setup options. If you are using VPNEP, the client download page lists available options after login. Avoid installation packages from unfamiliar download sites or old forum posts; an outdated build may have different controls, lack support for the profile format, or introduce security risks. For general account and setup steps, you can also view the setup guide.

Check that the subscription is intended for a Clash-compatible client and that the client version can read the configuration format and proxy protocols it contains. Shadowsocks, VMess, Trojan, Hysteria2, and WireGuard are distinct protocols; support depends on the client’s current core, profile type, and configuration. Do not assume that every Clash-based build supports every protocol, or that a provider offers a protocol simply because the client has a field for it. If the provider supplies a configuration for a different client, ask for the appropriate subscription format rather than editing unknown fields.

Install Clash Verge Rev on Windows 11

Download the Windows build from the client source or account page you have verified. If the service requires you to sign in before downloading, do so through its normal account flow; do not treat a login page as a subscription URL. When the installer opens, review the publisher information and Windows security prompt. If Windows reports that the file is unrecognized, pause and confirm its source rather than bypassing the warning automatically.

Follow the installer prompts and open Clash Verge Rev from the Start menu. Depending on the build and the features you later enable, Windows may ask for permission to install or start a network component. Grant only the permissions needed for the client’s proxy or TUN function, and make sure you understand the prompt. TUN mode may require elevated privileges or an additional service, while ordinary system-proxy mode may not require the same setup.

On first launch, look over the main interface before importing anything. Find the sections for profiles, proxies or nodes, settings, and the system proxy or TUN controls. Their names and placement can change between releases. If the interface differs from a guide you found, use the current app’s help or release notes instead of following instructions for an older build literally.

Close other proxy clients before testing. Two clients can both try to change Windows proxy settings, create competing routes, or leave a stale setting behind when one exits. If you already use another VPN, firewall, DNS filter, or corporate network agent, note its current state so you can identify conflicts without removing software that your organization requires.

• ✅ Get the installer from a source you can verify and check that it is intended for Windows.
• ✅ Keep a note of any existing proxy or VPN settings before changing them.
• ✅ Allow a network component only when the client needs it for the mode you intend to use.
• ❌ Do not run multiple proxy clients at once while diagnosing a connection problem.

Import the subscription URL

Sign in to your provider’s account page and open the subscription or client-configuration area. Copy the URL specifically labeled for Clash or the compatible format recommended for Clash Verge Rev. A subscription URL is sensitive: anyone who obtains it may be able to use or refresh the configuration associated with it. Do not post it in screenshots, public support threads, shared documents, or chat messages. If you think it has been exposed, use the account controls or provider support to replace or revoke it if that option is available.

In Clash Verge Rev, open the profiles area and choose the control for adding or downloading a profile from a URL. The exact wording differs by version; it may be shown as adding a remote profile, importing a subscription, or entering a URL. Paste the copied address into the URL field, give the profile a recognizable name if the app offers that option, and confirm the import. Do not paste your account password into the subscription field, and do not use the provider’s website address in place of the URL.

After import, select the new profile and use its update or refresh control if the app does not fetch it automatically. Wait for the client to report an update result. A successful import should leave a profile available for selection, but the number and names of entries depend on the configuration supplied by the provider. Profile names are labels, not measurements of speed, reliability, or geographic accuracy.

If the client rejects the URL, first copy it again from the account page and check for missing characters, spaces, or line breaks. Confirm that you chose the correct format and that the account subscription is active. Some account pages may present several client-specific URLs; choosing the wrong one can cause a parsing error even when the URL itself is intact. Avoid manually altering query parameters or replacing parts of the address unless the provider’s instructions explicitly say to do so.

Select a profile, route, and proxy mode

Once the profile is loaded, open the proxy or node view and select a route. Some configurations organize entries into groups, such as an automatic selector, a region group, or a list of individual nodes. If the profile provides a group intended for choosing a route, use that group and select an available entry. If it provides individual nodes only, choose one entry directly. The node label is provider-defined; it does not guarantee that every website will identify the exit IP as the same place shown in the label.

Next, choose the routing mode that matches your task. Rule-based mode generally applies the profile’s rules to decide which requests use a proxy and which use a direct connection. Global mode typically sends more traffic through the selected proxy, while direct mode bypasses it. The precise behavior depends on the imported configuration and client version. If you are unsure, begin with the profile’s recommended or rule-based mode and check the client’s connection log for how a test request was handled.

Enable the system proxy control if you want Windows applications that respect the operating system’s proxy settings to use the client. This does not guarantee that every application will follow those settings: some programs use their own network stack, ignore system proxy configuration, or require separate proxy settings. TUN mode can capture a broader range of device traffic by creating a virtual network interface, but it is a different operating mode and may require additional permissions or service setup. Do not enable both modes blindly; follow the client’s current instructions and test one change at a time.

After changing a profile, mode, or route, check that the selected state is reflected in the interface. If the client provides connection logs, open them and look for recent requests and their routing decisions. A green status indicator or a selected node is useful context, but neither alone proves that a particular browser or application used the intended route.

Verify that Windows traffic is using the proxy

Test the connection from outside the client as well as inside it. First, note your normal network state with the proxy disabled if you can do so safely. Then enable the intended profile and mode, open a browser, and use a reputable IP-check page to inspect the public exit address. Compare the result with the selected route at a broad level. IP geolocation databases can disagree, so a mismatch in a city label alone does not prove the connection failed; focus on whether the public address changed as expected and whether the page completed successfully.

For a second check, try the specific website or application you need. A browser test does not prove that a separate desktop program uses the same route. If a site continues to show the original connection, review the client’s connection log while reloading it. Check whether the request appears, whether it matches a proxy or direct rule, and whether the connection reports an error. This narrows the problem to routing, application behavior, or the route itself.

Test DNS cautiously. A DNS test can help identify whether name lookups follow the expected path, but results depend on the browser, system resolver, client mode, and profile rules. A displayed DNS resolver is not by itself proof that all application traffic is proxied. If your goal includes preventing DNS requests from bypassing the intended route, consult the client’s current documentation and the profile provider’s settings rather than changing random DNS fields.

When you have finished testing, confirm that the mode and profile are still the ones you intended. If you turn the system proxy off, Windows should no longer send supported applications through that proxy setting; if you used TUN, disable it using the client’s control so its network interface or service is released correctly. Recheck ordinary browsing afterward, especially if another proxy or VPN was active before the test.

• ✅ Check the public exit address in a browser while the intended profile is active.
• ✅ Test the actual application you plan to use, not only the client’s status panel.
• ✅ Review connection logs to distinguish direct routing from proxy routing.
• ❌ Do not treat a node name, a successful import, or a single status icon as proof of end-to-end connectivity.

Troubleshoot common setup problems

The profile will not import

Check that the URL came from the correct subscription section and is intended for the client format you are using. Copy it again rather than retyping it, confirm that the account can still access the subscription, and try the profile’s refresh control. If the client reports a parse or download error, note the exact message and app version before contacting support. Do not send the full subscription URL in a public post; redact it if support asks for a screenshot.

The profile imported, but there is no traffic

Confirm that the imported profile is selected, that a route is selected within any proxy group, and that the chosen mode is not set to direct. Then check whether the system proxy or TUN function is enabled, depending on which applications you are testing. Use the logs to see whether a request reaches the client. If the app records no request, it may not use the Windows proxy setting; test with another browser or review whether TUN is supported and correctly configured for your setup.

The browser still shows the original address

Check whether the browser has its own proxy, secure DNS, or privacy settings that affect the test. Confirm the client’s routing mode and inspect whether the test site’s request matched a direct rule. If the profile uses rule-based routing, switching to a different mode for a brief controlled test can help separate a rule issue from a route issue. Restore the preferred mode after testing, and do not assume that changing DNS alone will route all traffic.

The connection stops after changing networks

Wi-Fi changes, sleep and wake, captive portals, and switching between Ethernet and wireless can interrupt existing connections. Reconnect to the network first, then refresh or reconnect the profile and retry the same verification steps. If Windows reports that a captive portal needs attention, complete that network sign-in before testing the proxy. Change one setting at a time so you can tell whether the issue comes from the local network, the selected route, or the client.

Windows or another app reports a conflict

Close other proxy clients and check whether a work VPN, firewall, DNS filter, or endpoint security tool controls network traffic. If you enabled TUN, review its permission or service status in the client rather than repeatedly restarting Windows. On a managed device, do not remove corporate security software or override workplace policy; ask the administrator whether third-party proxy clients are allowed. After troubleshooting, disable the mode you no longer need and verify that normal connectivity returns.

Practical summary: A reliable setup is one you can explain and verify: the correct subscription format is imported, the intended profile and route are selected, Windows is using the mode you chose, and an external test confirms the expected exit behavior. If one of those checks fails, isolate that step instead of repeatedly changing nodes or editing configuration files without a clear reason.