Skip to main content
The Windows client works the same way as the Linux client: it connects to the TURN server, wraps WireGuard traffic in DTLS 1.2, and tunnels it to your VPS. The routes.ps1 script reads the TURN server IP from stdout and installs a host route via your default gateway using New-NetRoute.

​
Prerequisites

  • A VK Calls invite link (https://vk.com/call/join/...) or a Yandex Telemost link (https://telemost.yandex.ru/j/...)
  • The client.exe binary from the releases page
  • routes.ps1 from the repository, placed in the same directory as client.exe

​
Setup

1

Edit your WireGuard client config

In the WireGuard Windows app, edit your tunnel configuration. Change the Endpoint to the local proxy listener and set the MTU:
[Peer]
Endpoint = 127.0.0.1:9000
# ... other peer settings ...

[Interface]
MTU = 1280
# ... other interface settings ...
Save the config but do not activate the tunnel yet.
2

Open PowerShell as Administrator

The routes.ps1 script calls New-NetRoute to add host routes, which requires elevated privileges.Right-click the Start menu, select Windows Terminal (Admin) or PowerShell (Admin), and confirm the UAC prompt.
Running without Administrator privileges causes New-NetRoute to fail. The client will still connect, but the TURN server IP will not be routed correctly and the VPN will not work.
3

Run the client and pipe routes

Navigate to the directory containing client.exe and routes.ps1, then run one of the following commands.Using a VK link (TCP, default):
./client.exe -peer <vps-ip>:56000 -vk-link <VK link> -listen 127.0.0.1:9000 | ./routes.ps1
Using a VK link with UDP transport:
./client.exe -udp -peer <vps-ip>:56000 -vk-link <VK link> -listen 127.0.0.1:9000 | ./routes.ps1
Using a Yandex Telemost link (specify a working TURN IP explicitly):
./client.exe -udp -turn 5.255.211.241 -peer <vps-ip>:56000 -yandex-link <Ya link> -listen 127.0.0.1:9000 | ./routes.ps1
Wait for Established DTLS connection! in the output before enabling the VPN.
4

Enable WireGuard

Once the client reports a successful connection, activate your WireGuard tunnel in the WireGuard app.
Do not enable the VPN before the client establishes a connection. The client needs to reach the TURN server and complete DNS lookups before the tunnel is active. Starting the VPN first routes those requests through the tunnel, preventing the proxy from connecting.

​
How routes.ps1 works

The script reads your default gateway using Get-NetRoute, then reads IP addresses line by line from stdin. For each address it adds a /32 host route via the gateway using New-NetRoute with ActiveStore (the route is not persisted across reboots): 
# Get default gateway (IPv4)
$gateway = Get-NetRoute `
    -DestinationPrefix "0.0.0.0/0" `
    | Sort-Object RouteMetric `
    | Select-Object -First 1 -ExpandProperty NextHop

if (-not $gateway) {
    Write-Error "Could not determine default gateway"
    exit 1
}

Write-Host "Default gateway: $gateway"

# Read addresses from stdin
$input | ForEach-Object {
    $addr = $_.Trim()
    if ($addr -eq "") { return }

    Write-Host "Adding route to $addr via $gateway"

    New-NetRoute `
        -DestinationPrefix "$addr/32" `
        -NextHop $gateway `
        -PolicyStore ActiveStore `
        -ErrorAction Stop
}

​
Additional flags

FlagDescription
-turn <ip>Override the TURN server IP. Use this when automatic discovery fails.
-udpConnect to the TURN server over UDP instead of TCP. Try this if TCP does not work.
-n <count>Number of parallel TURN connections (default 16 for VK, 1 for Yandex). Use -n 1 for more stable throughput (capped at ~5 Mbit/s on VK).
-port <port>Override the TURN server port.

Build docs developers (and LLMs) love

Get started for freeTalk to us