VPN for beginners: a setup guide from scratch

A VPN for beginners is a different problem than a VPN for someone who already has a comfortable mental model of how networks work. This guide is for the first group. We assume you have heard the term VPN, you have decided you want to try one, and you do not want to read fifteen pages of context before clicking install.

Below: how to pick a VPN at a high level, how to sign up for ours, how to install on Windows, how to connect, how to verify it is actually working, and what to do when something does not. We are honest about which platforms are ready and which are not.

What to look for in a VPN

We have a longer write-up at how to choose a VPN with the criteria laid out in detail. The short version for a beginner: you want a paid VPN with a kill switch, modern protocols (WireGuard or VLESS Reality), no-logs claims with a path to verification, and a free trial so you can test before committing.

The criteria we deliberately deprioritise: server count printed on the homepage, "military-grade encryption" branding, and how many awards the homepage cites. None of those tell you anything useful.

Go to fexyn.com and create an account. Email plus a password is enough. The 7-day free trial does not require a credit card upfront for the trial period, so you can try the service before making a commitment.

Pick a plan. We have four tiers. The cheapest is $2.99 per month on the longest commitment, the monthly is $9.99. Pricing pages and the trade-offs are at /pricing. All plans include the same protocols, the same servers, and the same client features. The only difference is billing frequency and the per-month price.

Verify your email when the message lands. The dashboard at /dashboard should now load.

Step 2: Download the Windows client

We currently ship a Windows desktop client as the primary product. Windows is what we recommend if you have the choice. The client is a small Tauri app with a Rust helper service that handles the privileged networking work.

From the dashboard, the Downloads page links to the latest installer. Or go directly to /download. The installer is signed and includes the helper service. Run it as administrator (the helper service installs as a Windows SYSTEM service, which requires admin during install).

Honest platform note: as of May 2026, our Android client is in active development and available through the beta channel. iOS, macOS, and Linux clients are on the roadmap and not yet shipping. If you are on Android and comfortable with beta software, the Android beta works on real hardware. If you are on the other three platforms, our service is not yet ready for you and we will not pretend otherwise.

Step 3: Connect

Open the Fexyn client. The first screen shows a connect button and a server picker.

For most users, "Auto" picks a sensible server based on latency. If you want a specific country, use the picker to choose from our four current exits: Frankfurt, Helsinki, Cyprus, or Ashburn (US East).

Pick a protocol if you have a preference. The defaults are sensible. Quick guide:

Bolt is WireGuard. Fastest. Use this for everyday browsing, streaming, gaming. Default for most users.
Stealth is VLESS Reality. Use this in countries with active VPN blocking (China, Iran, Russia, UAE). Slightly slower than Bolt, far harder to detect.
Secure is OpenVPN. Use this if Bolt and Stealth both fail on your network for some reason. Older protocol, broader compatibility, slowest of the three.

Click Connect. The status changes to connecting, then to connected. The first connection on a given install is slower (about 1-2 seconds) because Windows is initialising kernel-level networking state. Subsequent connections are typically under a second.

The status bar shows your current server, protocol, and connection time. The kill switch icon shows whether the network firewall is enforcing the no-leak rule (it should be on by default).

Step 4: Verify it is working

This is the step most VPN tutorials skip. A connection that says "connected" is not the same as a connection that is actually routing your traffic correctly. Two checks.

Check 1: Your visible IP

Open a new browser tab and go to our IP checker. The page will show the IP address and approximate location your traffic is coming from.

If the VPN is working, the IP and location should match the server you connected to. If you connected to Frankfurt, the IP geolocates to Germany. If you connected to Ashburn, it geolocates to Virginia (US).

If the IP and location match your actual location instead of the VPN server, the tunnel is not routing traffic correctly. Disconnect, reconnect, and check again. If it still fails, see the troubleshooting section below.

You can also use third-party checkers like ipchicken.com or ipinfo.io for a second opinion. Both should agree with our checker.

Check 2: DNS leak test

A separate failure mode: your IP correctly shows the VPN server, but your DNS queries still go to your ISP. This is the DNS leak problem. We have a piece on how DNS leaks work that explains the underlying mechanism.

Run our DNS leak test or use dnsleaktest.com (the standard test, run it in extended mode). The test resolves a series of unique domains and reports back which DNS resolvers handled them.

What you want to see: only DNS resolvers operated by the VPN, not your ISP's resolvers. Our client uses Cloudflare 1.1.1.1 and Google 8.8.8.8 as default resolvers when connected, with DNS-over-HTTPS where the OS supports it. If the leak test shows your ISP's resolvers handling queries, your DNS is leaking.

DNS leaks are usually caused by an OS-level network setting overriding the VPN's DNS configuration. The most common causes on Windows are IPv6 configurations the VPN client missed, or third-party network management software (Killer Networking on some gaming laptops, NIC vendor utilities) reasserting its preferred DNS. Disconnect, reboot, reconnect. If the leak persists, contact support and we will troubleshoot.

Optional check 3: WebRTC leak

Browsers can leak your real local IP through WebRTC even with a VPN. Run our WebRTC leak test. If the leak shows your local network IP (something like 192.168.x.x or 10.x.x.x), that is normal and harmless. If it shows your real public IP, the browser is bypassing the VPN for WebRTC. Modern browsers and our client handle this for most users, but specific browser extensions or network configurations can break it. See WebRTC leaks explained for how to fix.

Step 5: Live with it

Once the VPN is connected and verified, you mostly forget about it. The kill switch handles tunnel drops. The reconnect logic handles network changes. The client minimises to the system tray.

Things you might want to adjust over time:

Auto-connect on startup. Settings → General. Off by default to avoid surprising you.
Always-on protection. Settings → Connection. Forces the kill switch to stay on even when the client is closed.
Default protocol. Settings → Protocol. Set to Stealth if you live in a country with active blocking.
Server preferences. Settings → Servers. Pin a favourite if you want predictability.

The Windows client checks for updates automatically. Updates ship roughly weekly. You will see a small notification when an update is ready. Updates are signed and verified before installation.

Common first-time issues

A short list of things that break for new users, with what to do.

"Connection refused" or stuck on "connecting"

Most common cause: the network you are on blocks our default protocol. Try switching to Stealth (VLESS Reality) in the protocol picker. If you are in a country with active VPN blocking, Stealth is what you want anyway.

If Stealth also fails: try a different server (the geographic distance does not matter much; what matters is whether the path between you and the exit is open). If all servers fail on all protocols, the network you are on is heavily filtered or has firewall rules blocking outbound UDP and certain TCP ports. We have a piece on bypassing internet censorship with deeper coverage.

Connection works but websites do not load

Usually a DNS issue. The tunnel is up but DNS resolution is failing. Disconnect the VPN, then go to Windows Settings → Network → Properties → DNS, set DNS to "Automatic" if it is not, then reconnect. Reboot if it persists.

If the websites that fail are specifically streaming services or services blocking known VPN IPs (Netflix, Hulu, some banks), that is a different problem: the destination is blocking VPN IPs. Try a different exit server, or use the destination without the VPN if it does not need to be hidden from your ISP.

Slow speeds

Three causes, in order of likelihood.

Distant exit. Frankfurt has higher latency from Asia than from Europe. Pick the closest available exit to your physical location for best speed.
Local network is the bottleneck. Run a speed test without the VPN, then with the VPN. If both are slow, your connection is the issue. If only the VPN-on test is slow, see the next point.
Protocol mismatch. OpenVPN ("Secure") is meaningfully slower than WireGuard ("Bolt"). If you are on Secure, try Bolt. If you are on Stealth, you are paying a small overhead for censorship resistance, which is fine if you need it.

We have a longer piece at does a VPN slow down your internet with measured numbers.

Kill switch blocking everything

If the kill switch is on and the VPN is disconnected, no traffic flows. That is the kill switch working as intended. You have two choices: connect to a VPN server (traffic resumes through the tunnel), or temporarily disable the kill switch in the client (traffic resumes outside the tunnel, with no protection). Disabling the kill switch is fine if you are doing it deliberately. Forgetting to turn it back on later is the failure mode to watch.

Game lobbies or peer-to-peer apps not working

Some peer-to-peer applications need inbound connections that a typical VPN does not support out of the box. Workarounds: use port forwarding if your provider offers it (we currently do not for security reasons), or temporarily disconnect the VPN for the specific game. This is a real limitation. We are not the right VPN for users whose primary use case is hosting peer-to-peer game lobbies.

What to do next

If you got through the four steps and your IP and DNS check out: the VPN is working. You are protected on the networks you use, your traffic is encrypted from your ISP, and your real IP is hidden from destinations.

A few directions to explore from here:

What is a VPN, exactly for the conceptual model.
Do I actually need a VPN for the honest "is this for me" question.
VPN myths debunked for the things you have probably heard that are not quite right.
Public Wi-Fi risks in 2026 for what you are actually defending against on hotel networks.

If something in the setup did not work for you, support is at /dashboard/help. Real humans respond. The 7-day trial gives you time to test seriously. If we do not earn our place, cancel within the window and you owe us nothing.