Best VPN for Windows: Global Proxy vs Split Tunneling, Gaming and Office Compatibility, Auto-Start Tested

In the desktop settings of a Windows VPN, global proxy and split tunneling are the first decision you have to make: the former sends all traffic from the machine through a server, the latter only takes over requests that match a rule. Neither mode is inherently better — the differences show up in games, office apps and browsers. Pick wrong and you usually see higher game latency, corporate intranet logins timing out, or the browser reporting that the proxy is unavailable. This article compares the two modes by scenario, shows how to write split rules, how to configure system proxy takeover and auto-start, and the order to troubleshoot in when a connection fails.

Global Proxy vs Split Tunneling: How the Two Modes Actually Differ

Global proxy is also called global mode. When it is on, the client sends every outbound connection from the machine through a server, without checking whether the destination is inside or outside mainland China. Its value is predictability: no app can leak onto the local network, and when you troubleshoot you only have to watch one path. The cost is just as direct — visits to sites in mainland China also have to travel out to a node and back, so latency depends on where the server exits; LAN devices (printers, NAS, screen casting) and intranet systems get taken over as well and often stop working entirely.

Split tunneling evaluates rules one by one: connections that match a direct rule use the local network, connections that match a proxy rule go through a server, and anything that matches neither falls to the final catch-all rule. How well it works depends on the quality of the rule set, but with normal maintenance, sites in mainland China load about as fast as they do without a proxy, intranet devices stay reachable, and only the domains and processes that need cross-border access go through a server.

There is also a third, direct mode: it temporarily disables the proxy without quitting the client, which suits system updates and LAN debugging — anything that needs a complete local network environment.

Conditions on the server side affect both modes as well. At VPNPF, for example, routes cover IEPL dedicated lines, relay and direct connections; the regional and route scale is as follows:

With split tunneling, just pick a node near the destination; to check regions and route types one by one, open the routes page.

How to Write Split Rules: Match Order for Domains, Processes and IP Ranges

A split rule set is evaluated top to bottom and stops at the first match. Order matters more than count: put specific rules first, broad rules later, and keep one catch-all rule at the end.

What Each of the Three Match Types Solves

• Domain matching: DOMAIN matches a single domain exactly, DOMAIN-SUFFIX matches a whole domain suffix, and DOMAIN-KEYWORD matches by keyword. Use this type for websites, APIs and software update services — it is the cheapest to maintain.
• Process matching: PROCESS-NAME matches on the executable name and suits desktop software. Setting the game's main executable to direct and the browser to proxy is the most common pattern when gaming and work share one machine; the process name must match exactly what Task Manager shows.
• IP range matching: IP-CIDR matches on the destination subnet and is mainly used to cover intranet addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and servers with fixed exit addresses.

Rule Order: Specific First, Broad Later

rem Split rule example: matched top to bottom, stops at the first hit
IP-CIDR,10.0.0.0/8,DIRECT
IP-CIDR,172.16.0.0/12,DIRECT
IP-CIDR,192.168.0.0/16,DIRECT
DOMAIN-SUFFIX,company.example,DIRECT
PROCESS-NAME,game.exe,DIRECT
DOMAIN-SUFFIX,example-intl.com,PROXY
MATCH,PROXY

Field names and syntax differ slightly between clients; the block above only illustrates the order: intranet subnets and corporate domains go direct first, then the domains and processes that should use a server are listed individually, and a catch-all comes last. If you put a catch-all rule such as MATCH at the top, none of the rules below it will ever fire.

Do You Still Need Your Own Rules After Importing a Subscription?

After you import a subscription, the built-in rule set usually covers common websites and regional categories. Most users only need to add two things: corporate intranet domains and IP ranges, plus the processes of the games or industry software they use. After editing rules, verify them one by one: open the target site or app and check the client's connection log to see whether that connection matched a direct rule or a proxy rule, instead of guessing.

Games and Office Apps: Where the Compatibility Differences Come From

With the same client, games and office apps behave very differently, because they read proxy settings in different ways.

Games: Most Ignore the System Proxy

Mainstream game clients and in-match traffic mostly use their own UDP channels and ignore the Windows system proxy settings. That means with only the system proxy enabled, games never touch a server at all and behave exactly as if no proxy were running. To route games through a server, the client needs a TUN or virtual adapter mode, where the virtual adapter takes over traffic at the system level and rules decide whether it goes through a server or direct. Match quality is mainly decided by the route type: direct routes have the shortest path, relay adds one hop between entry and exit, and IEPL dedicated lines run on a private link that holds up better at peak hours. For games on mainland China servers, direct is recommended; for overseas servers, pick a regional node that matches the server region.

Office Apps: Intranets and Meetings Are the Two Trouble Spots

• Corporate OA systems, mail servers and code repositories often sit behind corporate domains or intranet IPs. Those addresses must go direct, or logins time out or keep bouncing back to verification.
• Meetings and online documents are sensitive to UDP and bandwidth; switching nodes mid-call drops the connection outright, so lock in a route before the meeting starts.
• Some office apps have their own proxy settings, separate from the system proxy. In TUN mode you normally do not need to configure them; in system proxy mode, if the app does not pick up the proxy, check its own network options.

Browsers: They Follow the System Proxy, but Avoid Two Layers of Proxying

Chrome and Edge read the system proxy settings by default; Firefox can be pointed at a proxy in its own network settings. If a browser extension proxy and the client proxy are both on, requests go through the extension first and then the client, which shows up as slower speeds or some sites failing to load. Keep only one layer.

Setting Up System Proxy Takeover and Auto-Start

The steps below follow the common Windows 10 and Windows 11 interfaces. Menu locations differ slightly between clients, but the logic is the same.

1. First pick a mode in the client: use split tunneling (rule mode) day to day, and switch to global only temporarily when you are troubleshooting an app that never goes through a server.
2. Turn on the client's system proxy switch, then go to Windows Settings → Network & Internet → Proxy and confirm the address and port match what the client shows. The local address is usually 127.0.0.1, and the port is assigned by the client.
3. When you need to capture games or other software that ignores the system proxy, turn on TUN / virtual adapter mode and allow the driver installation in the system prompt.
4. Turn on auto-start in the client settings. After a reboot, open Task Manager → Startup and confirm the client is Enabled and has not been disabled by a system optimizer or security software.
5. Make sure an option such as restore system proxy on exit stays enabled, so that if the client crashes the browser is not left pointing at a local port nothing is listening on.
6. Update the subscription so the route list is current, then pick a node by region. Switch routes before changing game servers, not while the game is running.

Troubleshooting Order When a Connection Fails

Work through the list below in order; most problems are found in the first three steps.

• ✅ First confirm the client is running: the system proxy points at a local port, and once the client quits nothing listens there, so the browser reports a proxy error.
• ✅ Then confirm the mode: games ignore the system proxy, so only TUN / virtual adapter mode can capture them; browsers are the opposite and work fine with the system proxy.
• ✅ Check whether DNS goes through a server along with the connection: use nslookup to see the resolving exit IP. If it is still your local ISP's address, DNS requests are not going through the proxy and you have a DNS leak.
• ✅ Check IPv6: some networks hand out IPv4 and IPv6 at the same time, and if the client only captures IPv4, traffic bypasses the server. Temporarily disable IPv6 in the adapter settings and compare the results.
• ✅ Check that the subscription is current: old nodes stop working after route changes, so update the subscription and try again.
• ❌ Do not edit the address and port in the Windows proxy settings while the client is running; a mismatch between the two makes every browser request fail.
• ❌ Do not publish your subscription link: it carries account credentials, and anyone who has it can use your account.

rem Show the current proxy settings at the WinHTTP layer
netsh winhttp show proxy

rem Clear the WinHTTP proxy and restore direct access
netsh winhttp reset proxy

rem Flush the DNS cache
ipconfig /flushdns

rem Check the exit IP for DNS lookups to see whether DNS goes through the server
nslookup -type=txt o-o.myaddr.l.google.com

Windows proxy settings come in two layers: browsers and most desktop apps read the WinINET configuration under Settings → Proxy, while system services and updaters read WinHTTP. The two are configured separately, so check each one when troubleshooting and save yourself a detour.

Conclusion: When to Use Global Mode and When to Use Split Tunneling

The conclusion in three lines: choose split tunneling for long-term use and global for temporary full takeover; hand browsers and apps that read the system proxy to the system proxy, and games and apps that ignore it to TUN; turn on auto-start and turn on restore system proxy on exit — together these two decide whether the proxy state stays under control.