Start with the client interface. A subscription provides configuration, a node is a selectable connection endpoint, and traffic routing determines which requests use a proxy. Rule mode applies routing rules. These are separate functions, and one cannot replace another. If a website still won’t load after connecting, the node may not be at fault. Check whether the request reached the client, which rule it matched, and how the domain was resolved.
Terms at a glance: configs, routes and traffic handling
“VPN” can mean a system-wide encrypted tunnel or, more broadly, a subscription service that uses proxy protocols. Enabling a system proxy and enabling a virtual network interface are different ways of routing traffic through a client. Review the table before changing client settings, so you don’t mistake “connected” for “all apps are covered.”
| Term | What it means | Common misconception |
|---|---|---|
| Subscription link | An address the client uses to retrieve nodes or configuration, usually with access credentials. | It’s not a regular webpage, and it isn’t the same as a paid plan. |
| Node | A proxy connection profile available in the client, containing a server address, protocol, and authentication details. | The region in a node’s name doesn’t always indicate where its entry server is located. |
| Route | The path a connection takes from your local network through an entry point and transport link to its exit point. | A route isn’t a protocol, and its name alone doesn’t tell you how well it performs. |
| Protocol | The set of rules a client and server use to transmit, authenticate, and encrypt data. | A newer protocol isn’t necessarily faster on every network. |
| Proxy group | A set of candidate nodes or handling options that rules can direct traffic to. You can choose manually or let the configuration select automatically. | The currently selected node may not apply to every proxy group. |
| Traffic routing | Choosing direct, proxy, or blocked handling based on criteria such as domain, address, or app. | It doesn’t split the same request evenly across all nodes. |
| DNS | The mechanism that translates a domain name into a network address. | Routing webpage traffic through a proxy doesn’t mean DNS queries take the same path. |
| TUN | Traffic is received through a virtual network interface and then handled by the client. | Routes may still exclude some traffic; this doesn’t guarantee that everything is routed without configuration. |
Subscription links: importing a config, not making a payment
“Subscription” has two different meanings: billing and configuration. On a plan page, a monthly subscription describes the billing period and traffic terms. In a client, a subscription usually refers to the source of its configuration. Importing a link lets the client retrieve server settings; it doesn’t confirm that your plan is active or has enough traffic, and it won’t change your plan automatically.
A subscription may contain only a node list, or it may also include proxy groups, routing rules, and DNS settings. The contents depend on the service’s format and the client’s supported features. Updating a subscription usually syncs node changes, but whether local edits are kept and rules are overwritten depends on how the client handles updates. If you’re new to this, start with the format intended for your client; don’t mix complete configurations from different clients.
- Make sure the client comes from a trusted source, and check which subscription formats and protocols it supports. Find the client download link on the user panel download page. Sign-in is required, and the panel provides the link based on your plan status.
- Copy the subscription link from the user panel, then import it from the client’s subscription or configuration settings. If the import fails, first check for extra spaces, make sure the link is complete, and confirm that the format is supported.
- Update the subscription and check that the node list appears. Then select the configuration, choose a node within the relevant proxy group, and enable the traffic-handling method you need.
- Open the website or app you actually want to use, then check the client’s connection log to confirm the request path. Don’t rely on the node test icon alone.
Nodes and routes: the exit region isn’t the whole path
A node named after Japan or Singapore usually indicates its exit region. A request may first reach an entry point, then travel over a relay link to the exit. The exit primarily determines the address seen by the destination website. Your local connection quality also depends on your access network, reachability of the entry point, transport link, and server load.
Direct connections, relays, and IEPL
A direct connection usually means the client connects straight to an overseas proxy server. The route is easier to understand, but performance can depend on your local international gateway and network policies. A relay adds a forwarding hop to improve reachability along part of the route. It doesn’t necessarily use a dedicated line or guarantee performance during peak hours. IEPL is an Ethernet private-line service. If a subscription uses it for transport, that means a specific segment of the route uses a private line—not that every segment from your device to the destination does.
Route type can help you compare options, but it can’t replace real-world testing. The meaning of a client’s “latency” reading depends on how it’s measured: testing a proxy handshake, opening a test URL, and measuring network round-trip time are not the same thing. Low latency can still come with buffering if throughput is poor or packets are lost. Test the apps you actually use for calls, documents, or media, then check the request log for the exit and any errors.
Protocol names: compatibility matters more than speed rankings
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are common proxy protocols or protocol implementations—not coverage areas, plan tiers, or route grades. The notes below explain their technical meaning; they don’t mean VPNLM offers every protocol. Check the configuration in your panel and the client’s documentation for supported options.
- Shadowsocks: An encrypted proxy protocol. The client and server need to use matching encryption methods and credentials. Feature and version support can vary between implementations.
- VMess: A proxy protocol with authentication and encryption mechanisms that can work with different transport methods. For a node to connect, the protocol and transport parameters must match.
- Trojan: Proxy traffic is typically carried over TLS. Certificate validation, the server name, and authentication details must all be correct. Don’t disable certificate verification just to get a connection.
- VLESS: A lightweight authentication proxy protocol that doesn’t encrypt data on its own. It relies on a security layer such as TLS or REALITY. The name VLESS alone doesn’t tell you how secure the full configuration is.
- Hysteria2 and TUIC: QUIC-based proxy protocols that usually rely on UDP connectivity. They may not connect on networks that restrict UDP. A client that supports other protocols may not support these.
Choose a protocol based on three things: client support, network compatibility, and matching server configuration. If the route and congestion haven’t changed, switching protocols alone may not improve performance. When an error occurs, keep the exact message and identify whether it points to authentication, a certificate, DNS resolution, or a connection timeout instead of toggling every setting.
Split tunneling and rule mode: how requests are routed
In rule mode, requests that reach the client are matched against routing rules. Common criteria include domains, domain suffixes, destination addresses, and app processes; available criteria depend on the client. A match can send a request direct, to a proxy group, or block it. Many clients stop at the first matching rule, with a final catch-all rule handling requests that didn’t match anything earlier.
For example, a collaboration tool’s domain can go to an office proxy group, local network devices can connect directly, and other requests can use a fallback group. Choosing a Japan node in the office group doesn’t switch the media group to Japan. If the exit doesn’t change after you switch nodes, first check which group handled that request instead of reimporting the subscription.
Global mode usually sends requests handled by the client through the selected proxy group. Direct mode usually sends those requests without using a proxy server. Mode names, local network exclusions, and special requests can behave differently between clients. Global mode can help you temporarily check whether a rule is causing a problem, but it can’t route an app that bypasses the client in the first place.
- ✅ Before using rule mode day to day, confirm that the target domain matches the expected proxy group and check which node is selected in that group.
- ✅ If switching to global mode fixes the problem, check the routing rules, their order, and the fallback group first.
- ❌ Don’t assume “global” guarantees that every bit of traffic on your device is routed through the client. Confirm the traffic-handling scope separately.
- ❌ Avoid running multiple clients that change system proxy settings, routes, and DNS at the same time. It makes it harder to tell which one is handling a request.
DNS leaks: check the query path too
When you visit a domain, the app usually needs to resolve its address first. If the webpage connection goes through a proxy but the DNS query is sent over your local network, the domain being looked up may be exposed. This is commonly called a DNS leak. Whether it conflicts with your privacy expectations depends on your configuration goals; in rule-based routing, a domain intentionally set to go direct isn’t necessarily a problem just because it uses local DNS.
DNS settings in the client, operating system, and browser’s encrypted DNS may all take effect separately. Enabling encrypted DNS in a browser doesn’t guarantee that queries use the current proxy; the DNS connection may still go direct. Even with TUN enabled, check DNS handling, routes, and IPv6 settings. Confirming the IPv4 exit alone isn’t enough to finish troubleshooting.
Some clients use Fake-IP, first mapping domains to virtual addresses and then associating the domain with the actual destination when forwarding traffic. This helps with traffic routing; it isn’t another name for a DNS fault, and some apps may need exceptions. Don’t paste a DNS section from an unfamiliar configuration and assume the problem is fixed. Confirm that its syntax and mode are supported by your client.
Client differences: how to troubleshoot after connecting
Windows and macOS clients often offer system proxy and TUN options for routing traffic. A system proxy mainly affects apps that follow the system proxy settings, while some apps use their own network settings. TUN usually requires extra permissions and can conflict with routes set by other network software. On Linux, also check permissions, routing, and DNS management; desktop client menu steps may not apply.
iOS and Android clients often use the system’s VPN network extension or VPN interface to handle traffic. App exclusions, background behavior, and protocol support depend on the client and system settings. Android battery restrictions can affect background activity. A connection may also need to be re-established when a mobile device switches from Wi-Fi to a mobile network. The system’s VPN indicator shows the network interface status; it doesn’t guarantee that a destination website is reachable.
Troubleshoot in the order data travels; it’s more effective than reinstalling at random. Check whether the configuration loaded, the node connected, the app’s request reached the client, the rules selected the right exit, and DNS returned a usable result. Then check for region or account restrictions on the destination service. If regular websites load but a specific service denies access, the cause may be the service’s policies or restrictions on the exit address—not necessarily the protocol.
For more setup instructions, see the Guides. When contacting the panel support team, include your platform, client name, network, mode, and the full error message, and hide your credentials. Describe “can’t connect” separately from “connected, but the app doesn’t work” to help narrow down the cause.