VPN for Windows: set up WireGuard on your PC

Do you need a VPN on a Windows PC?

On any network you do not control, yes. A laptop moves more kinds of traffic than a phone: a dozen browser tabs, an email client, Windows Update, a remote desktop session. A system-level tunnel wraps all of it, so the coworking or hotel network sees only encrypted packets going to one address.

The sites you visit then see the server's IP address instead of yours, and the local network can no longer list the domains you opened.

That is why a system-level tunnel beats a browser plug-in on a computer. An extension only covers what happens inside that browser; every other program keeps talking to the internet directly. SuaVPN does not offer an extension, and on Windows it does not need one: WireGuard installs a virtual network adapter and captures every application's traffic with no per-app setup.

One thing a VPN does not do is make you anonymous: sign in to email or a social network through the tunnel and that service knows who you are. It does not replace antivirus either. Our guide on what a VPN is covers those limits.

Windows VPN setup with the official WireGuard app

Windows 10 and 11 include a VPN client under Settings > Network & internet > VPN, but it only supports older protocols such as IKEv2, L2TP, SSTP, and PPTP. WireGuard is not on that list, so that screen is a dead end for SuaVPN. Use the official WireGuard app instead: it runs on Windows 10 and 11 in x64 and ARM64 builds and carries no ads or bundled extras. SuaVPN has no app of its own, and you do not need one: the dashboard generates a configuration file per device and WireGuard does the rest.

The dashboard also shows a QR code, but that is for phones; on a PC the .conf file is the way in:

• Get the installer from wireguard.com/install and run it. It asks for administrator rights because it installs a network driver alongside the app.
• In the SuaVPN dashboard, open Devices, add a device named after your computer ("work laptop", "desktop"), pick a location from those listed on the status page, and save the .conf file.
• Open WireGuard, click "Import tunnel(s) from file", and select the .conf. The tunnel takes its name from the file.
• Select the tunnel and click "Activate". The status changes to "Active" and the "Latest handshake" field fills in within seconds, which means keys were exchanged and traffic is flowing.
• Close the window if you like: WireGuard keeps running from the notification area and the tunnel stays up.

What is a VPN kill switch on Windows?

It is a checkbox in the WireGuard app: "Block untunneled traffic (kill-switch)". With it ticked, WireGuard adds Windows firewall rules that drop anything not headed into the tunnel, so if the server becomes unreachable the PC goes quiet until the VPN is back instead of silently falling back to the open network.

The checkbox appears on any tunnel whose AllowedIPs line covers the whole internet (0.0.0.0/0), which is what SuaVPN's configurations do.

Turn it on for public Wi-Fi, hotels, and travel, with two things in mind. With the box checked and the tunnel deactivated you have no internet at all, so if nothing loads, check that first. And captive portals, the login pages hotels and airports use, cannot be reached through the tunnel: deactivate it, sign in to the network, then activate it again.

Starting with Windows and switching between locations

WireGuard installs as a Windows service. A tunnel that was active at shutdown comes back at the next boot, before anyone signs in and without opening the app. For a laptop that hops between networks all week, that is always-on protection with no extra software. If you would rather start clean, deactivate the tunnel before shutting down.

You can import several configurations, one per location, and switch from the list; only one is active at a time. Each configuration is a device in the SuaVPN dashboard, so a PC that keeps two locations ready uses two of your device slots (Basic includes 3, Pro 5, Family 10). The locations available are the ones listed on the status page. One limitation to know up front: SuaVPN has no split tunneling. The tunnel carries all of the PC's traffic or none of it; if a program must connect directly, deactivate the tunnel for that task and reactivate it afterward.

"Free VPN for PC": what to check before you install

Running a VPN costs money for servers and bandwidth, so a free Windows program is paying for itself somehow. The usual patterns: installers that add toolbars or change your default search engine, clients that bundle third-party tracking, and services that turn your PC into an exit point for other people's traffic. Before installing any free VPN, check who the company is, what its privacy policy actually authorizes, and whether the installer comes from the vendor's own site. Our guide on free VPNs goes through how these services make money.

The safe combination is the official WireGuard client, which has no ads and no extras, plus a service that bills in plain sight. SuaVPN shows its current prices on the pricing page, takes cards through Stripe from anywhere, renews automatically, and can be canceled at any time from the dashboard. Purchases can be refunded within 7 days under Brazilian consumer law, which amounts to a full trial on your own PC and your own network.

Checking that it works and fixing common problems

With the tunnel active, open any site that shows your public IP address and location. It should display the city and country of the location you picked, not yours. In the WireGuard window, "Latest handshake" should be recent while you browse, and the received and sent counters should climb as pages load. If the address shown is still your own, the tunnel is not carrying your traffic, whatever the status says.

Most Windows problems fall into a handful of patterns. If none of these fits, write to support with the tunnel status, last handshake time, and location; that shortens the diagnosis. The Mac and Linux guides cover the same setup elsewhere, and the P2P guide the case of a torrent client bound to the tunnel.

• Tunnel active, no internet: deactivate and reactivate it; check the location on the status page; if it persists, generate a fresh configuration in the dashboard and import it again.
• Import fails: WireGuard names the tunnel after the file, and the name must be at most 32 characters with no spaces (letters, digits, dots, hyphens, and underscores are fine). Rename it to something like suavpn.conf and try again.
• No handshake: a firewall or antivirus is probably blocking outbound UDP to the port in the Endpoint line. Allow WireGuard in its rules, or test on another network to confirm.
• Sites load halfway or time out: set MTU = 1280 in the [Interface] section of the configuration, which fixes fragmentation on some hotel and mobile hotspot networks.
• DNS does not change: check that the configuration has a DNS line, and that no other VPN software is installed and fighting over the adapter.