This VPN glossary puts subscriptions, nodes, protocols, routing, and rule mode in the context of how you actually use a client: a subscription provides configuration, a node is a connection endpoint, a protocol defines how data is exchanged, and routing determines where requests go. They’re distinct settings and aren’t interchangeable.
One terminology distinction is worth noting: “VPN client” can refer to a system-wide tunnel app or a proxy client. How much traffic the latter handles depends on system proxy settings, a virtual network interface, and each app’s configuration—not just whether the client says “Connected.”
Subscriptions and Nodes: Configuration and Connection Endpoints
A subscription link is a URL for retrieving configuration, not a node itself. The client fetches node details from the service at that address. Some subscription formats also include proxy groups, routing rules, or DNS settings. Because the link usually contains credentials, protect it like an account key.
A node is a set of connection parameters that may include a server address, port, protocol, authentication details, and transport settings. A location shown in the client is only a label. Check the service details and network diagnostics to see whether the exit IP’s location and actual route match that label.
Updating a subscription fetches the configuration again; it doesn’t renew a paid plan or necessarily switch the current node. Subscription formats matter too: some links return only a node list, while others provide a full configuration. If the format isn’t supported, trying a different import option may not help—check which formats your client accepts first.
Protocols, Transports, and Routes: Different Layers
A protocol defines how the client and server authenticate and exchange data. Transport describes how that data is carried—for example, some configurations use WebSocket. TLS provides security for the relevant connection. These terms may all appear in a node’s details, but they refer to different layers, not interchangeable options.
| Protocol | What it does | What to check |
|---|---|---|
| Shadowsocks | Encrypted proxy protocol | Whether the encryption method, password, and client implementation match |
| VMess | Proxy protocol with authentication and encryption | Authentication parameters, transport settings, and system time |
| Trojan | Typically carries proxy traffic over a TLS connection | Password, server name, and certificate verification settings |
| VLESS | Lightweight proxy protocol that does not encrypt content on its own | Related security and transport settings, such as TLS or REALITY |
| Hysteria2 / TUIC | QUIC-based proxy protocol | Whether the client supports it and the network allows the required UDP traffic |
Protocol names aren’t a speed ranking. The same protocol can perform very differently over different routes, and protocol and field support varies by client version. If an import fails, don’t change protocols at random or disable certificate checks. Check the configuration source and client documentation first.
Route type describes the network path. A direct route usually means the client connects straight to an international endpoint; a relayed route adds a forwarding endpoint along the way. IEPL is an international Ethernet private line—a network transport resource, not a proxy protocol. It also doesn’t mean the entire path from your home device to the destination website uses a dedicated line.
A route may involve an entry point, a relay, dedicated-line transport, and an exit point. Congestion, detours, and connection quality between the exit and destination can all affect performance. Interpret labels such as “dedicated line” and “relay” in context; they don’t guarantee a fixed speed or access to any particular platform.
Rule Mode and Global Mode: Where Requests Go
Routing rules choose a path for each request based on set conditions. Common conditions include domain names, destination IPs, app processes, and geographic IP databases. A matching rule may send traffic direct, through a proxy, or block it—or pass it to a proxy group to choose what happens next.
Rule mode evaluates rules one by one. Many clients use a top-to-bottom, first-match-wins approach, but the configuration format determines the exact behavior. A proxy group isn’t another route; it’s a container for selecting nodes or connection policies. Depending on the client, you may be able to choose manually or switch using an automatic selection method.
Global mode typically sends requests that have already entered the proxy core through the global policy. It doesn’t take over the entire device: connections from apps that haven’t entered the core won’t be handled just because you switch to global mode. Direct mode typically connects requests entering the core directly; it doesn’t mean the client is off.
For everyday use: Start with rule mode and a trusted configuration. If a website has trouble, briefly switch to global mode for comparison. If it works in global mode but not rule mode, check the rules, proxy group, and DNS before trying another node.
Global mode can help narrow down a problem, but it isn’t a fix for every issue. It may change the route used by local services and websites in mainland China, and it may use more plan data. Restore your previous mode when you’re done testing.
System Proxy and TUN: Does Traffic Reach the Client?
A system proxy tells the operating system where to send proxy requests. Apps that follow this setting pass their requests to the proxy, but some games, command-line tools, and in-app components don’t use it. If a website loads in your browser, that confirms only that the browser’s request works—not that every app is routed through the client.
TUN mode receives IP traffic through a virtual network interface. It usually covers more traffic and may require additional permissions, but it’s still affected by routes, exclusion rules, DNS settings, and system restrictions. If your company network, local devices, or another tunnel stops working after you enable it, check for route conflicts instead of adding more settings at random.
Windows, macOS, and Linux clients may offer system proxy, background service, or TUN settings under different names. Android often routes traffic through the system VPN interface; iOS clients typically create a tunnel using a system network extension. Seeing a VPN indicator in the system doesn’t mean these clients use the same proxy protocol.
Running multiple traffic-routing tools at once can cause port, route, or DNS conflicts. If something goes wrong, keep the connection tool you need and troubleshoot the others one at a time. On iOS, client availability may also depend on the App Store region, distribution method, and dashboard permissions; use an access method that’s actually available to you.
DNS and Exit IP: What to Check Beyond Connectivity
DNS translates domain names into IP addresses. Even after a proxy connects, domain lookups may still use a resolver provided by your local network. If a query that should follow a particular route takes another path, that may indicate a DNS leak. This is a separate check from the exit IP used by the website connection.
Remote DNS, encrypted DNS, and Fake-IP in a client aren’t interchangeable terms. Encrypted DNS protects the transmission of the relevant lookup, but doesn’t automatically route it through a proxy. Fake-IP is a client method that returns a synthetic address and associates it with the real domain; it doesn’t change your public exit IP.
Start by using Network Check to review the exit information for your current request, then check the client logs and a trusted DNS test to see how lookups are routed. A website test covers only that particular request; it can’t prove that every app uses the same route. If IPv6 is enabled, check whether the current configuration handles that traffic too.
From Import to Troubleshooting: Check in Order
Once you understand the terms, follow this order to set things up: first confirm that the configuration loads, then check that a node connects, and finally test the relevant apps and routing behavior. Change one thing at a time so you can identify what affected the connection.
- Check the client’s source and compatibility. Get the client from a trusted source and confirm that it supports your subscription format, protocol, and required system permissions. Don’t follow another guide just because its software has a similar name.
- Import and update the subscription. Copy the full link from the dashboard into the subscription field, then check whether the node list loads. If it fails, first verify that the link is valid and complete, and that your current network can reach the subscription URL.
- Choose a node and route traffic through the client. Select a node listed in the dashboard, then enable the system proxy or tunnel as required by your platform. A successful latency test means only that the relevant probe received a response; it doesn’t guarantee that a particular website will load.
- Test an actual request. Open the destination website and check the exit information. If it works in your browser but not in other apps, first check whether those apps are routed through the proxy instead of assuming the route is down.
- Check routing rules and DNS. Temporarily compare with global mode, then review the matching rule, selected policy, and DNS behavior. When reporting an issue, include your system, client, and error message—but hide subscription links and authentication details.
- ✅ The node list loads: the subscription was fetched successfully, but this doesn’t mean a node has connected.
- ✅ The destination website loads: this request works; check the exit and other apps too if needed.
- ❌ Repeatedly switch routes when import fails: import happens before connection, so check the format and link first.
- ❌ Skip certificate checks to get connected: verify the server name, system time, and configuration source instead.
Plan Data and Configuration Subscriptions: Same Word, Different Meaning
Finally, note the other meaning of “subscription”: a configuration subscription fetches nodes, while a monthly subscription is a billing plan. Updating configuration doesn’t reset plan data, and refreshing the node list doesn’t change your plan allowance or benefits.
VPNMG monthly plans are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB, with data resetting monthly on the activation date. Data packs are ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB; they don’t expire and remain available until used. See the plan details to compare options. Don’t confuse “auto-update” in a configuration with plan renewal.
Keep the relationship in mind: a subscription provides configuration, a node provides an endpoint, a protocol handles communication, the traffic-capture method determines what enters the client, and routing rules decide where it goes. Following this order makes real-world troubleshooting easier than memorizing every setting name.