iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
For most Windows users, start with WireGuard, Choose Automatically or a nearby server, VPN Kill Switch, Split Tunnel off, MACE optional, Multi-Hop off, and WireGuard MTU set to Auto. Change one setting at a time, disconnect before changing protocols, reconnect afterward, and reload any streaming service after reconnecting. Use OpenVPN only when a network blocks WireGuard or when compatibility matters more than speed.
This guide explains what each Windows setting does, which trade-off it creates, and how to troubleshoot slow connections or permitted regional streaming access without weakening protection accidentally.
Recommended baseline settings
The following profile is a practical starting point for a normal Windows laptop or desktop. It favors the lightest configuration first, then adds protection only when you have a specific reason.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Setting | Recommended starting value | Why | When to change it |
|---|---|---|---|
| Protocol | WireGuard | PIA describes it as lightweight, secure and fast. | Use OpenVPN if WireGuard or its ports are blocked, or if an older network requires it. |
| Server | Choose Automatically or a nearby location | Usually gives the shortest route for ordinary browsing. | Choose the matching streaming-optimized server for lawful access to a permitted home-region library. |
| Kill switch | VPN Kill Switch | Stops internet traffic when the VPN connection drops. | Use Advanced Kill Switch only when you want traffic blocked even while the PIA app is disconnected. |
| Split Tunnel | Off | A single tunnel avoids routing and DNS exceptions. | Turn it on for a defined app that must always use or always avoid the VPN. |
| MACE | Optional | Blocks many ad, tracker and malicious-content domains through DNS. | Enable it when you want domain-level blocking and can accept occasional site compatibility checks. |
| Multi-Hop | Off | A second server adds latency and can reduce throughput. | Enable it when additional resistance to traffic tracing is worth slower performance. |
| WireGuard MTU | Auto | PIA recommends Auto for most users. | Adjust only while troubleshooting a specific fragmentation or connectivity problem. |
| Port forwarding | Off unless an inbound port is required | It is an inbound-connectivity feature, not a general speed boost. | Enable only for a service that needs an incoming connection; it is unavailable on US server locations. |
PIA advertises 10-Gbps servers on its 2026 download page. That is a provider capability claim, not an independent Windows benchmark, so it does not guarantee a particular speed on your ISP, device or chosen server.
#1 Best Overall
Find every setting in the Windows app
Open the PIA Windows application and use the three-dot menu. Select Settings, then work through the Protocols, Network, Privacy and Split Tunnel tabs. The app may require a reconnect before a change is active.
- Open PIA from the Windows taskbar or Start menu.
- Select the three-dot menu.
- Choose Settings.
- Open the tab that contains the setting you need: Protocols for WireGuard, OpenVPN and MTU; Network for connection and kill-switch behavior; Privacy for MACE, Multi-Hop and port forwarding; and Split Tunnel for per-app routing.
- Disconnect before changing the protocol. Save or apply the change, then reconnect and verify the new protocol in the app.
Changing several options at once makes troubleshooting difficult. Establish a baseline connection first, then change one control and test the same website or application again.
Choose WireGuard or OpenVPN
WireGuard: the speed-first default
WireGuard is the right first choice when your network allows it. PIA positions it as a lightweight protocol with strong security and fast speeds, which generally means less protocol overhead than a compatibility-focused configuration. It is the sensible starting point for web browsing, calls, downloads and permitted streaming.
WireGuard is not automatically fastest in every home, office or hotel network. The actual result depends on the route to the selected server, congestion, your ISP and whether the network filters VPN traffic. Treat it as the baseline to measure, not a universal benchmark.
OpenVPN: the compatibility fallback
Switch to OpenVPN when a workplace, school, hotel or public network blocks WireGuard or its ports, or when an application behaves reliably only with OpenVPN. OpenVPN can be slower because of additional overhead, but a stable connection is more useful than a faster protocol that cannot connect.
PIA states that Multi-Hop on Windows is available only with OpenVPN. Therefore, selecting Multi-Hop necessarily means giving up WireGuard for that session.
Safe protocol-switch procedure
- Disconnect PIA.
- Open the three-dot menu and choose Settings.
- Open Protocols.
- Select WireGuard or OpenVPN.
- Reconnect to the same server, or to the same server type, so the comparison is meaningful.
- Retest the same site, stream or download. If the change fixes the problem, keep the working protocol; otherwise return to the previous one.
Pick a server for speed or permitted streaming
Automatic or nearby for ordinary use
Choose Choose Automatically when you want PIA to select a location, or select a geographically nearby server yourself. A shorter network path usually gives browsing and downloads fewer opportunities for added latency. Keep the server choice stable while comparing protocols or other settings.
Rank #2
Streaming-optimized locations
For lawful access to a streaming library available in your home region, select the matching streaming-optimized server. After connecting, reload the website or fully restart its Windows application so it discards the old connection and location information.
Streaming compatibility can vary between servers in the same region. If the first location fails, try another server in that region before changing several unrelated settings.
Do not treat a distant server as a speed upgrade
A distant location can add latency even when the provider has substantial server capacity. Use a regional server only for a defined need, such as a permitted home-region service, and return to Automatic or nearby for routine traffic.
Configure the two kill-switch modes
VPN Kill Switch
VPN Kill Switch blocks internet access if the active VPN connection drops. Its purpose is to prevent traffic from silently reverting to the ordinary connection during a brief outage. PIA describes the kill switch as a feature that disables internet access after a disconnect to prevent data leaks.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →This is the appropriate default for a computer that should remain usable when PIA is intentionally turned off. When you disconnect PIA yourself, normal internet access can continue.
Advanced Kill Switch
Advanced Kill Switch is stricter: it blocks internet traffic whenever PIA is not connected, including periods when you have turned the VPN app off. Use it on a machine where an unprotected connection is unacceptable, and expect the internet to remain unavailable until PIA reconnects or the advanced mode is disabled.
If Windows appears offline after you close PIA, check whether Advanced Kill Switch is the reason before changing adapters or firewall settings.
Use Split Tunnel without creating a leak
Split tunneling lets you decide which applications or IP addresses use the VPN and which connect directly. Leave it disabled unless you have a clear routing requirement; every exception creates a second path that you must understand and maintain.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsOnly VPN
Select Only VPN for an application that must never connect outside the encrypted tunnel. This is useful for a browser, work tool or other program whose traffic should stop rather than fall back to the ordinary connection when the VPN is unavailable.
Bypass VPN
Select Bypass VPN for an application that must use the normal Windows connection. This can help a local service, game, printer utility or a permitted streaming application that fails when routed through the VPN. Bypassed traffic is outside PIA protection and can expose the connection’s ordinary IP address.
Choose the DNS behavior deliberately
On Windows, Split Tunnel settings also let you decide whether DNS follows the app rules or always uses PIA DNS. If DNS follows app rules, a bypassed application and its name lookups can use the normal connection. If DNS is always PIA DNS, lookups continue through PIA even when an application’s traffic bypasses the tunnel. Pick the mode that matches your privacy requirement, then test the specific application because routing and name resolution are separate decisions.
Exact setup sequence
- Open the three-dot menu, select Settings, then open Split Tunnel.
- Enable split tunneling only if the exception is necessary.
- Add the Windows application or IP address.
- Assign Only VPN or Bypass VPN.
- Choose whether DNS follows app rules or always uses PIA DNS.
- Reconnect PIA and restart the affected application.
- Confirm that the application behaves as intended, remembering that bypassed traffic is not protected by the VPN tunnel.
Decide whether to enable MACE
MACE is PIA’s DNS-based blocker for many advertising, tracking and malicious-content domains. It is disabled by default and is optional rather than a requirement for a fast or secure VPN connection.
Free tools Windows power users keep installed
One-click scans. No signup required.
Enable MACE when reducing domain-level ad and tracker requests is more important than maximum site compatibility. Because it works at the DNS level, it can block a domain before a browser or application connects, but it is not a replacement for the encrypted VPN tunnel, endpoint security or a browser’s own privacy controls.
If a site stops loading after MACE is enabled, temporarily disable MACE and reload the site. If that restores the page, keep MACE off for that use or identify the affected domain through the site’s own troubleshooting controls.
Rank #4
Understand Multi-Hop’s security trade-off
Multi-Hop sends the connection through two PIA servers instead of one. That additional hop can make traffic tracing more difficult in some threat models, but it also adds processing and distance. PIA warns that Multi-Hop may be slower, and its Windows implementation works only with OpenVPN.
Leave Multi-Hop off for speed-sensitive browsing, video calls and streaming. Turn it on only when the extra hop addresses a concrete privacy concern and slower performance is acceptable. Because enabling it also forces OpenVPN, compare the complete configuration rather than attributing every speed change to the extra server alone.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Do not use port forwarding as a speed setting
Port forwarding creates an inbound port for applications that need unsolicited incoming connections. It does not make ordinary browsing, downloads or streaming faster. PIA assigns the forwarded port automatically, and the feature is unavailable on US server locations.
Keep it disabled unless you have a specific inbound-port requirement. If you enable it, configure the application with the assigned port, expose only the service you intend to reach, and turn it off again when the use case ends.
Fix streaming that stops working
Use this sequence for a permitted streaming service and stop as soon as playback works. PIA’s terms prohibit using the service to circumvent geographic restrictions or violate copyright, so these steps are for access you are authorized to use.
- Connect to the appropriate regional streaming-optimized server.
- Reload the streaming website or fully restart its Windows application. A page left open before the VPN connection can retain the previous network state.
- If playback still fails, disconnect and try another server in the same region.
- Switch between WireGuard and OpenVPN. Disconnect before changing the protocol, reconnect afterward, and retry the stream.
- If only that application or website must avoid the VPN, add it in Split Tunnel and select Bypass VPN. Remember that this traffic then uses the ordinary connection and is outside PIA protection.
Do not change MACE, Multi-Hop, MTU and split-tunnel rules simultaneously. A one-variable sequence tells you whether the problem is the server, protocol, application route or a domain-blocking rule.
Recommended Free Tools
Profiles for common Windows priorities
| Priority | Protocol | Server | Kill switch | Other settings |
|---|---|---|---|---|
| Maximum everyday speed | WireGuard | Choose Automatically or nearby | VPN Kill Switch | Split Tunnel off, Multi-Hop off, MTU Auto, MACE optional |
| Strict traffic containment | WireGuard unless blocked | Nearby or a required region | Advanced Kill Switch | Only VPN for selected sensitive apps; consider MACE |
| Permitted home-region streaming | WireGuard first | Matching streaming-optimized server | VPN Kill Switch | Reload the service; try another same-region server, then OpenVPN if needed |
| Network blocks WireGuard | OpenVPN | Automatic or nearby | VPN Kill Switch | Keep Multi-Hop off unless its extra hop is required |
| Extra tracing resistance | OpenVPN | A location that meets your need | Advanced Kill Switch if downtime is acceptable | Multi-Hop on; expect lower speed |
How to troubleshoot a slow connection
Start with a clean comparison
Disconnect and reconnect to the same server, then test one website or download. Record whether the issue occurs only in one application or across Windows. This separates an app-specific route from a general VPN or network problem.
Reduce distance and extra hops
Use Choose Automatically or a nearby server. Turn Multi-Hop off and keep port forwarding disabled unless needed. These changes remove avoidable routing distance and features that are not intended to increase speed.
Compare protocols correctly
Test WireGuard and OpenVPN separately, disconnecting before each change and reconnecting afterward. Keep the server and test site the same. If OpenVPN is faster on one restricted network, that is a compatibility result for that network, not evidence that OpenVPN is universally faster.
Check exceptions and DNS
Review Split Tunnel entries. A mistakenly bypassed application may be using a different route, while an incorrectly forced VPN application may fail to reach a local service. Confirm the DNS mode as well as the traffic rule.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use MTU Auto unless diagnosing a defined fault
Leave WireGuard MTU on Auto for normal operation. Manual MTU changes are troubleshooting adjustments, not performance tweaks; change them only when you have a specific fragmentation or connection symptom to investigate.
Security and evidence limits
These settings manage the VPN tunnel, routing and domain filtering; they do not make every application safe. Keep Windows, browsers and endpoint security software updated, and treat a bypassed app as a direct internet connection.
No independent, controlled Windows benchmark establishes that one PIA setting is always fastest across every ISP, device, server and network. WireGuard is the evidence-based starting point from PIA’s guidance, while your own repeatable test determines the best combination for your connection.
Quick Recap
Final checklist before you keep the configuration
- WireGuard is selected unless your network requires OpenVPN.
- The server is Automatic or nearby for ordinary use, or the correct streaming-optimized region for permitted access.
- VPN Kill Switch is enabled; Advanced Kill Switch is used only when blocking all traffic while disconnected is intentional.
- Split Tunnel is off unless each exception has a documented purpose.
- Any Bypass VPN application is understood to be outside the VPN’s protection.
- MACE is enabled only if DNS-based blocking is wanted and compatible with the sites you use.
- Multi-Hop is off unless its extra privacy benefit justifies OpenVPN and lower speed.
- WireGuard MTU remains Auto unless troubleshooting a specific fault.
- Port forwarding is off unless an inbound port is genuinely required, and it is not being treated as a speed feature.
- After protocol or server changes, the affected website or application has been reloaded or restarted.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
