How to Set Up a VPN Manually on Windows 11

Windows 11 can create a VPN connection without installing any extra software. The option sits in Settings, it takes a few minutes, and it gives you a connection that behaves like any other network item on your taskbar. It is also easy to get wrong, because every field must match what your VPN service expects, down to the last character.

This guide explains how to set up a VPN manually on Windows 11: what each field means, where the correct values come from, how to connect and disconnect, how to confirm it worked, and what the usual error numbers are telling you. It does not list server addresses or connection types for any service, because those must come from your own provider.

When a manual setup makes sense

There are two ways to run a VPN on a Windows 11 PC. You can install an app, or you can add a connection to the operating system's own VPN client. The manual route is a good fit in a few situations.

• Your service supplies manual details for Windows: a server address, a connection type and a sign-in method.
• You do not want to install anything, for example on a locked-down laptop where you cannot add programs, or on a device you only use briefly.
• You want the VPN as a system network item, one you can switch on from Quick Settings like Wi-Fi.
• You already follow an IT checklist that tells you to configure the built-in client.

It is a poor fit if you do not know where the details come from. Guessing a server address or connection type wastes time and, worse, can send your sign-in details to the wrong place. For XPASS customers the source is the My Pass page: it shows setup instructions and the connection methods available for your account. If it does not list a manual method for Windows, use the free VPNclient app, which you can get from the download page. Our shorter guide to setting up a VPN on Windows covers the app route.

Gather what you need first

Collect the following before opening Settings. Having it all in front of you avoids half-finished entries.

1. Server name or address. Often a hostname such as one that ends in a domain, or a numeric address. Copy and paste it, do not retype it.
2. VPN type. Windows offers a list, including Automatic, PPTP, L2TP/IPsec (with a certificate or a pre-shared key), SSTP and IKEv2. Your service tells you which one to pick. The specification for IKEv2 is RFC 7296, and NIST SP 800-77 gives general guidance on IPsec VPNs. If the type you were given is PPTP, be aware that it is an old design with known weaknesses; prefer another type if the service offers one.
3. Type of sign-in info. Usually user name and password. Some setups use a certificate or a one-time password.
4. Username and password. The VPN credentials, not the website email. See where are my VPN login details if you are not sure where they are.
5. A pre-shared key or certificate, only if your service says one is needed.
6. A stable network for the first connection, preferably home Wi-Fi.

Keep the credentials in a password manager rather than in a note on the desktop.

Step by step: add the connection

Windows wording varies a little between builds, so treat the labels below as typical rather than exact.

1. Open Settings. Press the Windows key and I together.
2. Go to Network & internet, then VPN.
3. Choose Add VPN. (On some builds the button reads "Add a VPN connection".) A form opens.
4. VPN provider: choose Windows (built-in).
5. Connection name: type a label you will recognise, for example "Work trip" or "My pass". It is only a label on your PC.
6. Server name or address: paste the value from your service.
7. VPN type: select the type given to you. If you were not given one, do not pick "Automatic" and hope. Go back and read your instructions.
8. Type of sign-in info: choose the method your service uses, usually User name and password.
9. User name and Password: enter them. The fields are marked optional, which means Windows will ask when you connect if you leave them blank.
10. Remember my sign-in info: tick it only on a PC that only you use.
11. Select Save. The new entry appears in the VPN list.

What each field really does

Field	What it controls	Typical mistake
Connection name	A label shown in Settings and Quick Settings	Using a name that already exists
Server name or address	Where Windows sends the connection request	A typo, extra space or missing part of the address
VPN type	Which method Windows uses to build the tunnel	Choosing a type the service does not offer
Type of sign-in info	How you prove who you are	Choosing certificate when the service uses a password
User name	The account on the VPN side	Entering the website email by mistake
Password	The matching secret	Pasting with a trailing space
Remember my sign-in info	Whether Windows stores the credentials	Leaving it on for a shared PC

If you ever need to change something, open the entry in Settings and use the Edit option. You can also delete the entry and recreate it, which is often faster than hunting for a bad character.

Connect, disconnect and use Quick Settings

1. Connect from Settings. In Network & internet, VPN, select your entry and choose Connect. If you did not save the sign-in info, Windows asks for it.
2. Wait for the status. It changes from Connecting to Connected. If it ends in an error, jump to the next section.
3. Use Quick Settings. Click the network, speaker and battery icons at the right of the taskbar. If a VPN tile is missing, use the pencil icon to edit the quick actions and add it. The tile lets you connect and disconnect without opening Settings.
4. Disconnect by selecting the entry again and choosing Disconnect. For broader instructions on stopping a VPN safely, see how to turn off a VPN on any device.

Two advanced options live under "Advanced options" for VPN connections. Allow VPN over metered networks and Allow VPN while roaming are off or on by default depending on your build. Turn them on only if you need the VPN on a phone hotspot or a roaming connection, and remember that a metered link can cost money for the data used.

Confirm that it worked

Do not stop at the word Connected.

• Check your public address. Before connecting, note the address shown by an IP-checking page. After connecting, check again. It should change. See how to check if your VPN is working for a fuller routine.
• Check that pages load. If the status says Connected but nothing opens, the tunnel exists but traffic is not flowing. Disconnect and try again, then see the troubleshooting list below.
• Look at the adapter. In Settings, Network & internet, Advanced network settings, the list of adapters includes your VPN entry while connected.

Understanding the common error numbers

Error	What it usually means	What to try
691	Sign-in was refused	Retype username and password, check the pass is active, confirm you are using VPN credentials
809	Windows could not reach the server through the network	Check the server address, try a different network, check firewall and router settings
789	The security layer failed during setup	Check the connection type and any pre-shared key
800	Windows could not establish the connection	Check the address and the network; try again later
628 or 629	The connection closed before it finished	Test on another network and retry

The Windows VPN errors guide at fix common Windows VPN errors goes through them in more detail. An error rarely means that Windows is broken. It usually means one value does not match what the server expects, or a network along the path will not let the connection through.

Troubleshooting in a sensible order

1. Re-read your instructions and compare each value. Most failures are one wrong character or one wrong choice.
2. Delete and recreate the entry. Starting from a blank form is faster than finding a typo.
3. Try another network such as your phone's hotspot. Public and managed networks often block certain connection types.
4. Turn off other VPNs and security tools while you test. Two VPN clients on one PC conflict.
5. Restart Windows after changes to networking components.
6. Check the clock. A wrong date or time can break secure connections.
7. Look at the basics: is the internet working without the VPN, and is your pass still active?
8. Switch to the app route if the manual method keeps failing. The VPNclient app usually avoids the typing problems that cause manual errors.

For a wider checklist, our guide to when a VPN will not connect applies on any platform.

Limits and cautions of the manual route

• You are responsible for every value. A typo or a wrong type fails silently or noisily, and no app is there to help you.
• The built-in client has fewer conveniences. There is no location list, no automatic reconnect to a different place and no extra tools such as split tunneling in the simple form. Behaviour such as which traffic goes through the tunnel depends on adapter settings. Do not change the "use default gateway on remote network" option in the adapter's advanced TCP/IP settings unless your service tells you to, because it decides whether all traffic or only some goes through the VPN.
• Credentials are stored by Windows. If you tick Remember, anyone who uses your Windows account can connect. Lock the PC when you leave it.
• Some networks refuse certain types. If a connection works at home but not at a hotel, the hotel network is the likely cause.
• A VPN does not fix everything. It does not stop phishing or malware, and some sites object to VPN traffic. See what a VPN protocol is for how the connection types differ.

Summary

Setting up a VPN manually on Windows 11 means collecting the exact server address, connection type, sign-in method and credentials from your service, then entering them under Settings, Network & internet, VPN, Add VPN. Every field must match. Connect from Settings or Quick Settings, check that your public address changed, and read error numbers as clues: 691 points to sign-in, 809 to reaching the server. If the manual route becomes frustrating, the free VPNclient app does the same job with less typing.

If you would like a prepaid pass to use with Windows 11, you can look at the options on the pricing page when it suits you.