Windows VPN setup for travelers to China

Windows setup takes about five minutes. The UnblockMeVPN Windows client bundles OpenVPN, Cloak, and Hysteria2 — no separate downloads needed. This guide covers the install, recommended settings, and verifying the tunnel once you arrive.

Install

1. Download the installer from unblockmevpn.com/downloads.html.
2. Run the .exe. The installer is signed, but some systems may still show SmartScreen or endpoint-protection prompts depending on reputation and local policy.
3. The installer sets up a service that runs OpenVPN as SYSTEM (required for the Wintun virtual adapter).
4. Launch the app, sign in.
5. Connect to Hong Kong and verify.

Recommended settings

• Start on boot — so the VPN is running before any app tries to reach the network
• Auto-connect to last server — reconnects after sleep and network changes
• Kill switch on — blocks all non-VPN traffic if the tunnel drops
• DNS leak protection on — forces DNS through the tunnel
• Register DNS on connect — prevents Windows from caching stale DNS from the physical adapter, a common cause of leaks

Verify the tunnel

1. Connect to Hong Kong.
2. Open a browser and search for what is my ip. The result should show a Hong Kong IP.
3. Run a DNS leak test at dnsleaktest.com. All DNS servers shown should be in the VPN path, not your ISP.
4. Run a speed test from fast.com or speedtest.net. Expect 50–200 Mbps on a good hotel connection.

Split tunneling

The Windows client supports split tunneling — you can choose which apps go through the VPN and which go direct. Common use cases:

• Route your browser and work apps through the VPN, keep game clients and large downloads direct
• Route Outlook and Slack through the VPN, keep video streaming services direct
• Bypass the VPN for local-network devices like a home NAS

For business travelers we usually recommend everything through the VPN on hotel networks. Split tunneling is more useful at home.

Common Windows-specific issues

• SmartScreen warning on install — still possible. Some endpoint-protection suites flag fresh or rotating signing certificates. Check the signature and allow the install if it is the expected signed build.
• Cannot connect after wake from sleep — toggle the VPN off and back on. We are tightening resume-from-sleep handling in the next release.
• Network adapter stuck — rare, but open Device Manager, disable and re-enable the Wintun adapter. The client also auto-resets the adapter on every connect.