Manual VPN setup — Windows
Recommended: the VPN Pink app
Start with our VPN Pink app for your device. Manual setup is an alternative if the app cannot be used or you prefer your own VPN client.
Get the VPN Pink app →These instructions are an alternative to our recommended VPN Pink app. Choose your platform.
Before you start
You need an active VPN entitlement. Use only a server assigned to your account. Signing into the website does not itself activate VPN access.
Find your VPN username, VPN password and assigned server in My Dashboard. The VPN password may differ from your website password. A customer reference is not your VPN username.
IKEv2 / IPsec
| Server address | Example: Germany — Choose a server address: hostname or IP Hostname: de-fkb-sha-vps3.vpn-pink.comAlternative IPv4: 212.227.45.10Alternative IPv6: 2a01:239:304:6900::1 |
|---|---|
| VPN username | My Dashboard → |
| VPN password | My Dashboard → |
Setup steps
- Open Settings → Network & internet → VPN → Add VPN. Select Windows (built-in).
- Choose IKEv2, enter a connection name and your assigned server hostname. Select username/password sign-in and enter your VPN credentials.
- Save and connect. As an alternative for DNS issues, test the assigned IPv4 or IPv6 in the same address field; see the table below. Windows normally has no separate Remote ID field. Keep certificate validation enabled.
Choose a server address: hostname or IP
Enter exactly one value in Server address: the hostname or, alternatively, the IPv4 or IPv6 address of the same assigned server. If DNS fails, replace the hostname with its fixed IP. IPv6 requires working IPv6 connectivity. If the client has a separate Remote ID field, keep vpn-pink.com there. A fixed IP bypasses DNS lookup of the server address, but does not replace certificate validation.
Windows also allows testing the IPv4 or IPv6 from the table instead of the server hostname. Windows normally has no separate Remote ID field. The entered address must match the server certificate. If identity validation fails, return to the hostname and contact support; do not disable validation.
| VPN | Hostname | Alternative IPv4 | Alternative IPv6 |
|---|---|---|---|
| AT | at-sha-vps1.vpn-pink.com | 5.132.162.69 | 2a03:3180:4001:106::473d:989b |
| DE | de-fkb-sha-vps3.vpn-pink.com | 212.227.45.10 | 2a01:239:304:6900::1 |
| ES | es-mad-sha-vps1.vpn-pink.com | 82.223.83.18 | 2001:ba0:253:6000::1 |
| US | us-sha-vps1.vpn-pink.com | 198.71.58.244 | 2607:f1c0:f04f:f200::1 |
If connection fails
IKEv2 uses UDP 500 and 4500. Replies must be allowed; home-router port forwarding is normally unnecessary. No captured packets is not proof that a port is blocked.
An EAP_NAK followed by EAP_FAILURE means the EAP negotiation was rejected; it does not prove a wrong password. “Recovery remains armed” is an app status, not an administrator-permission request or proof of a working VPN. Ask support with the time, platform, server and log.
Do not share passwords, private keys, tokens, QR codes or complete WireGuard configurations. Review logs before sharing.
Contact support →VPN
Check that your system reports the tunnel connected, internet access works and your public IP has changed. Opening the app or importing a profile alone proves no connection.
IP →