Help
VPN setup
Pick your service and follow the steps.
The three options
- WireGuard config in Theia. Only Theia uses the VPN. Turn the VPN app off.
- Split tunneling in the VPN app. Add
theia.exeto the app's include list. Theia stays on Whole-PC VPN app. - Whole-PC VPN app. Everything on the PC uses the VPN.
Surfshark
| Best fit | WireGuard config in Theia |
|---|---|
| WireGuard config | Yes, needs an active plan |
| Proxy | None found |
| App split tunneling | Yes: Bypasser, Route via VPN |
- Sign in at my.surfshark.com. Go to VPN > Manual setup > Desktop or mobile > WireGuard.
- Choose I don't have a key pair, name it, then Generate a new key pair. Do this before downloading or the file has no key.
- Choose a location and download the
.conf. - In Theia: Settings > Network & VPN > WireGuard config > Open .conf file > Save config.
- Turn the Surfshark app off, then Test connection.
Other option
- App only: Surfshark app > Settings > VPN settings > Bypasser > Route via VPN > Select apps (or Add apps and pick
theia.exe). Reconnect. In Theia choose Whole-PC VPN app.
The key pair screen shows a private and a public key once. The download button sits next to each location.
NordVPN
| Best fit | Whole-PC VPN app |
|---|---|
| WireGuard config | No. NordLynx works in the NordVPN app only |
| Proxy | SOCKS5, port 1080, service credentials |
| App split tunneling | Exclude documented. Include mode not confirmed |
- Connect the NordVPN app.
- In Theia choose Whole-PC VPN app.
Other option
- SOCKS5: Nord Account > NordVPN > Manual setup > Service credentials. In Theia choose SOCKS5 or HTTP proxy, host such as
us.socks.nordhold.net, port1080. A proxy does not encrypt. - If your app shows Split Tunneling with an option to use the VPN for selected apps only, add
theia.exethere.
Source: support.nordvpn.com, support.nordvpn.com
ExpressVPN
| Best fit | Split tunneling in the app |
|---|---|
| WireGuard config | No. Manual setup is OpenVPN only |
| Proxy | None |
| App split tunneling | Yes: Only VPN |
- ExpressVPN app > Profile > Split Tunneling, turn it on.
- Add App >
theia.exe> set to Only VPN. - Set All Other Apps to Bypass VPN. Reconnect.
- In Theia choose Whole-PC VPN app.
Source: www.expressvpn.com
Proton VPN
| Best fit | WireGuard config in Theia |
|---|---|
| WireGuard config | Yes, Free plan included |
| Proxy | No |
| App split tunneling | Yes: Include mode, paid plans |
- Sign in at account.protonvpn.com > Downloads > WireGuard configuration.
- Enter a name, pick Windows, choose a server > Create > Download.
- In Theia: WireGuard config > Open .conf file > Save config.
Other option
- Paid plans, app only: Split tunneling > Include mode > Add >
theia.exe> Apply.
Source: protonvpn.com, protonvpn.com
Mullvad
| Best fit | WireGuard config in Theia |
|---|---|
| WireGuard config | Yes, uses one of 5 devices |
| Proxy | SOCKS5 only while connected to Mullvad |
| App split tunneling | No, exclude only |
- Open
mullvad.net/en/account/wireguard-configand sign in with your account number. - Platform Windows > Generate key > pick country, city and server > Download file.
- In Theia: WireGuard config > Open .conf file > Save config.
Source: mullvad.net, mullvad.net
Private Internet Access
| Best fit | Split tunneling in the app |
|---|---|
| WireGuard config | No, app only |
| Proxy | SOCKS5 in the Netherlands, separate credentials |
| App split tunneling | Yes: Only VPN |
- PIA app > Settings > Split Tunnel, turn it on.
- Add Application >
theia.exe> Only VPN. - Set All Other Apps to Bypass VPN. Reconnect.
- In Theia choose Whole-PC VPN app.
Other option
- SOCKS5: Client Control Panel > Downloads > VPN Settings > SOCKS > Generate. Host
proxy-nl.privateinternetaccess.com, port1080. Not encrypted.
Source: helpdesk.privateinternetaccess.com, helpdesk.privateinternetaccess.com
CyberGhost
| Best fit | Whole-PC VPN app |
|---|---|
| WireGuard config | No |
| Proxy | None found |
| App split tunneling | No. Windows exceptions are websites only |
- Connect the CyberGhost app.
- In Theia choose Whole-PC VPN app.
Source: support.cyberghostvpn.com
IPVanish
| Best fit | WireGuard config in Theia |
|---|---|
| WireGuard config | Yes |
| Proxy | SOCKS5, port 1080, credentials on the Proxy tab |
| App split tunneling | No, exclude only |
- Sign in at my.ipvanish.com > WireGuard Configuration Generator.
- Pick a server location > Generate.
- In Theia: WireGuard config > Open .conf file > Save config.
Source: support.ipvanish.com
Windscribe
| Best fit | WireGuard config in Theia (paid). Inclusive split tunnel (free) |
|---|---|
| WireGuard config | Yes, paid accounts |
| Proxy | No |
| App split tunneling | Yes: Inclusive |
- windscribe.com > My Account > WireGuard config generator.
- Pick Location and Port > New Key Pair > Download Config.
- In Theia: WireGuard config > Open .conf file > Save config.
Other option
- Free: app > Preferences > Connection > Split Tunnel > Inclusive > add
theia.exeunder Apps. In Theia choose Whole-PC VPN app.
Source: windscribe.com, windscribe.com
PrivadoVPN
| Best fit | WireGuard config in Theia (Premium) |
|---|---|
| WireGuard config | Yes, Premium. More than 10 downloads turns off older files |
| Proxy | SOCKS5, Premium, separate credentials |
| App split tunneling | Tunnel option in the app, not confirmed |
- Sign in > Dashboard > Manual Configuration > Wireguard.
- Pick a server > Download configuration.
- In Theia: WireGuard config > Open .conf file > Save config.
Other option
- Free plan: connect the app and choose Whole-PC VPN app in Theia.
Source: support.privadovpn.com
Another service
- Your account offers a WireGuard config? Download it, then in Theia: WireGuard config > Open .conf file > Save config.
- Your app can send only chosen apps through the VPN? Add
theia.exeto its include list, then in Theia choose Whole-PC VPN app. - Neither: connect the VPN app for the whole PC and choose Whole-PC VPN app.
A SOCKS5 or HTTP proxy works too, under SOCKS5 or HTTP proxy. A proxy does not encrypt.
Windows paths
- Theia:
%LOCALAPPDATA%\Programs\Theia\theia.exe - Tunnel helper:
wireproxy.exein the same folder. Theia starts it only for a WireGuard config. - For split tunneling add
theia.exeonly. Video plays insidetheia.exe. - Using a WireGuard config in Theia? Don't add either file to a VPN app's include list, and keep the VPN app off.
Troubleshooting
| What you see | Try |
|---|---|
| File has no private key | Make the key pair in your account first, then download the file again. |
| Tunnel didn't connect | Pick another location. The key may be deleted or the device limit reached. Some networks block WireGuard. |
| Tunnel helper blocked | Your antivirus may have quarantined wireproxy.exe. Restore it or reinstall Theia. |
| Test shows the same address twice | A VPN app is already on for the whole PC. Turn it off when using a WireGuard config in Theia. |
| Stream held back | Leak protection is working: the tunnel or proxy is down. Wait for it to reconnect or test again. |
| Stream check skipped | Every connection on your account is in use. Stop playback on another device. |
| Proxy rejected the sign-in | Use the service or proxy credentials, not your account login. |
Checked against each service's help center on September 14, 2026. Menus change. Service names belong to their owners. WireGuard is a registered trademark of Jason A. Donenfeld.