When choosing a Windows VPN setup, first consider how your PC apps connect, then decide between a global proxy and rule-based routing. Rule-based routing usually works well for everyday browsing and work; global mode can help diagnose an exit route temporarily. If games, command-line tools or background processes do not follow the system proxy, check whether you need a TUN virtual network adapter rather than simply changing the mode name.
How global proxy and rule-based routing differ
In a client, “Global” usually means that connections already handled by the proxy core all use the selected proxy exit. It does not necessarily mean that every connection on your PC has entered the client. If only the Windows system proxy is enabled, apps that ignore this setting may still connect directly.
Rule mode uses the domain, destination address and sometimes process information to decide whether to connect directly, use a proxy or reject the connection. Rules are generally matched in order, with a fallback rule handling the remaining requests. So “rule-based routing is better for everyday use” comes with a condition: the rules must come from a trusted source, update properly and cover the apps you actually use.
| Setting | Main purpose | Suitable for | What to check |
|---|---|---|---|
| System proxy | Provides a proxy address to apps that follow system settings | Browsers and some desktop apps | Games and background services may not follow it |
| TUN mode | Uses a virtual network adapter and routing to capture more IP traffic | Apps that do not follow the system proxy | Check permissions, DNS, routes and exclusions |
| Global mode | Routes all captured traffic through the selected proxy exit | Temporarily checking an exit or diagnosing rule issues | May route local traffic unnecessarily |
| Rule mode | Selects direct or proxy connections based on matching conditions | Using international websites and local services together | Incorrect rules may route traffic the wrong way |
Global mode and TUN are not mutually exclusive. A client can use the system proxy with rule mode, or TUN with rule mode. Interface labels may vary, so follow the client documentation on capture scope and exit strategy.
Checking Windows clients and subscription imports
Windows’ built-in VPN settings are not the same as a general-purpose subscription client. Subscription links provided by a service usually need to be parsed by a compatible client; they cannot simply be pasted into any system VPN configuration field. Start at the client downloads to see available apps, then check system compatibility and setup instructions.
Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC are different proxy protocols or protocol schemes. A client’s ability to import a link does not mean it fully supports every node in that link. Check the core version, transport method and UDP support in particular. Protocol compatibility is also not the same as route quality; a protocol name alone does not prove that it will be faster.
- Get the subscription link from the service panel and make sure you copied it in full. Do not use unknown configurations forwarded by others.
- Choose import by link on the client’s subscription or configuration page. After updating, check that nodes and rules appear.
- Select a route in your target region, then start with system proxy and rule mode while keeping the default security settings.
- Visit a website you actually plan to use, then check the client connection log for the matched rule and selected exit.
- If the target app does not appear in the connection log, check whether it uses its own proxy. Configure TUN according to the documentation if needed.
If a configuration imports but no nodes appear, common causes include an expired link, an incompatible format or a failed update request. Check the update error first instead of repeatedly changing network settings. If you need help, share the error message and client name, but not your account password.
Choosing settings for games, work apps and browsers
Browsers and everyday browsing
If your browser needs to reach international websites while you also use local shopping sites, online banking or an intranet, try rule mode first. It can route different destinations appropriately and avoid unnecessary detours. A browser extension with its own proxy settings may override system settings; when troubleshooting, disable similar extensions first to avoid conflicts between proxy entry points.
Games and voice chat
A game launcher opening successfully does not mean the game session is being proxied. Sign-in, updates and gameplay may use different processes and transport methods, while voice chat may depend on UDP. Check that the client, node and route all support the app’s traffic, then see whether the session reaches the proxy core. TUN can expand the capture scope, but it does not guarantee compatibility with every game or anti-cheat system.
Web download performance does not directly predict the gaming experience. Games depend more on latency variation, packet loss and session stability. If a local server already connects normally, forcing traffic through a remote exit may add extra routing. Do not send gameplay traffic that could connect directly on a longer route just to keep “Global” mode enabled.
Work apps and corporate networks
Corporate VPNs, endpoint management software and TUN can all change routes or DNS settings. Follow your organization’s policies on managed computers, and ask an administrator to configure them if needed. Shared folders, printers and intranet domains usually need to retain local access routes; do not override them with a single broad proxy rule.
Command-line tools, background services and desktop apps may use different proxy mechanisms. If the browser works but terminal requests fail, check the tool’s own proxy settings or environment variables rather than assuming the route is at fault. If corporate security software raises an alert, do not disable protection to force a connection.
DNS and exit checks: a working webpage is not enough
To verify a connection, check which exit handles the destination request, which resolver handles the domain, and whether uncaptured traffic behaves as expected. Start by checking My IP, then compare the result with the client connection log. An IP page shows the exit used by that webpage request; it cannot prove that every app on your PC uses the same route.
A DNS leak occurs when a lookup that should follow the expected proxy path is instead sent to an unexpected resolver. With rule-based routing, using local DNS for local services may be intentional; seeing a local resolver does not by itself prove a leak. First determine which domains should use proxy DNS, then check the actual results.
- ✅ Check which rule matched the destination domain and whether the exit is the expected route.
- ✅ Review the client’s DNS policy and the browser’s secure DNS settings to ensure separate settings do not bypass the expected route.
- ✅ Check how IPv6 traffic is captured or connected directly; do not verify only part of the network path.
- ✅ Test local websites, international websites, intranet resources and the apps you actually use for work separately.
- ❌ Do not treat a speed-test page loading, a successful latency check or a changed IP as proof that every app is captured.
If global mode works but rule mode fails, focus on rule matching and DNS. If the browser works but a game does not, check the capture method and UDP support. If all apps fail, check the local network, subscription update and node connection errors in turn. Change one setting at a time so you can identify what made a difference.
Startup behavior and restoring the network after closing the client
Starting the client at boot, connecting automatically after startup and setting the system proxy automatically are separate features. Enabling client startup does not mean the proxy is ready as soon as you sign in to Windows; TUN may also depend on an installed service component or specific permissions. Follow the client’s instructions and do not lower system security settings just to avoid a prompt.
After setup, sign in again and confirm that the configuration has loaded and the exit strategy is correct before opening your usual apps. Check whether the connection is re-established after waking the PC from sleep or switching networks. If an app starts before the proxy, its existing connection may keep using the old route; reconnect the app if needed instead of only refreshing an IP-check page.
When you exit the client, the normal process should undo the proxy or routes it set. If no websites open after closing it, first check Windows “Network & Internet → Proxy” for a leftover manual proxy address pointing to your own PC. Remove only settings you enabled that are no longer valid; do not change organization-managed proxy settings without permission.
Routes and plans: make a decision based on how you use them
IEPL dedicated lines, relayed routes and direct connections describe how a route is organized, not whether it uses global or rule mode. A relayed route typically forwards traffic through an entry server, while a direct connection typically connects from your network to the destination node. IEPL refers to a dedicated Ethernet line; its actual coverage depends on the service deployment. None of these options alone guarantees app compatibility, a fixed speed or availability on a particular platform.
When comparing routes, use the same app at similar times and check whether page loads, file transfers and long-lived connections meet your needs. Do not compare results from different exits and destination servers as if they were the same. For route types and regions, see the servers page; available choices in the current panel take precedence.
R1VPN has no device limit and follows a no-logs policy. Monthly plans are ¥9.9/60GB, ¥18/250GB and ¥28/500GB, with data resetting monthly on the activation date; data packages remain available until used and never expire. Consider different billing options for continuous or occasional use. See the plans page for full pricing.
No email address is required to register. You can request a full refund for any reason within 60 days of your first payment. Choose a service based on testing it with your own apps. A no-logs policy is a service policy; it does not replace the everyday care of device permissions, account passwords and subscription links.