Here’s how the pieces fit together: a subscription provides configuration, a client reads that configuration, a node is a proxy endpoint you can choose, a route determines the network path your traffic takes, and split tunneling determines which requests use the proxy. They are not interchangeable. Knowing the difference helps you decide whether to refresh your subscription, switch routes, or check your app settings.
People often use “VPN” as a catch-all for tools that provide cross-border network access, but system VPNs, app proxies, and proxy protocols are not the same thing. The sections below explain each term in the context of everyday use. Protocol descriptions are general technical information and do not mean VPNGF supports every protocol or client.
Subscriptions, Nodes, and Routes: Quick Reference
Think of the process like getting around: the client is like a navigation app, the subscription provides route information, nodes are available entry points, and routes are the roads traffic actually takes. This analogy is only meant to clarify their roles; it says nothing about speed or privacy.
| Term | What it means | What beginners should know |
|---|---|---|
| Subscription | The service benefits associated with an account, which may include a billing period or data allowance. | An active account does not mean the client has imported the correct configuration. |
| Subscription link | The address a client uses to retrieve configuration, usually with access credentials included. | It is not an installer or an ordinary webpage bookmark. |
| Node | A selectable proxy connection in a configuration, with an address, authentication details, and protocol settings. | The listed region usually indicates the exit location; check the service details for specifics. |
| Route | The network path from your connection to the proxy entry point, exit point, and destination service. | Nodes listed in the same region may use different network routes. |
| Protocol | The rules a client and proxy server use to establish a connection and transfer data. | The client’s core must support the protocol used in the configuration. |
| Routing rules | Rules that direct requests to an outbound connection based on domains, addresses, or other conditions. | A request matched by a direct-connection rule will not use the proxy just because you selected a node. |
| DNS | The process of translating domain names into network addresses. | Check the DNS resolution path alongside the connection route. |
A longer node list does not necessarily mean more regions are covered. Several entries may share an exit location or differ only in their entry point or transport method. When choosing a route, consider the region, route type, and how it performs with your target app—not just the number of entries.
How to Import a Subscription Link into a Client
“Subscription” can mean two different things: on a plan page, it refers to service benefits; in a client, “add subscription” refers to the source of its configuration. After purchasing or activating a service, you still need to import the relevant configuration into your client. Active subscribers can get clients and subscription details from the VPNGF user panel; marketing pages do not provide live subscription links.
- Get the client from a trusted source. Open the client download section in the user panel and choose the version for your operating system. Similar software names do not necessarily mean they can read the same configuration format.
- Choose the right import method. Look for “Add subscription,” “Import from link,” or a similar option in the client. If the panel offers client-specific formats, choose the one that matches your client.
- Finish importing and check the list. Once the update succeeds, you should see nodes or configuration entries. If the list is empty, check that the link is complete, the subscription is active, and the client supports that configuration format.
- Enable the configuration and choose an outbound connection. A successful import only means the details have been saved. You still need to enable the configuration, select a route, and allow any network permissions requested by your system.
- Test the app you want to use. Open the website or app, then check the client’s connection log. A successful subscription update does not mean every app is using the proxy.
Updating a subscription retrieves configuration again; it is not a top-up and may not reset manual settings. Some clients update rules and nodes together, while others refresh only the node list. Check how your client works first so you don’t mistake rules you added yourself for server-provided settings.
IEPL Dedicated Lines, Relays, and Direct Connections
These terms describe network paths, not proxy protocols. A direct connection usually means your device connects to the proxy server over the public internet. A relay usually sends traffic through a forwarding entry point before it reaches the exit. IEPL stands for International Ethernet Private Line; a service may use one to carry traffic between its entry and exit points. The exact path depends on the service’s network architecture.
“Direct route” and “direct” in split-tunneling rules are easy to confuse. The former may still connect to a proxy server, but without an intermediary relay from the provider. The latter usually means a request bypasses the proxy outbound and connects directly to its destination. A route labeled “direct” does not necessarily mean the client is not using a proxy.
A dedicated line mainly offers greater control over the network segment it covers. It does not mean your local connection to the entry point or the path from the exit to the destination website is also on a dedicated line. Wireless signal quality, carrier routing, exit congestion, and the destination service can all affect performance, so a dedicated line is not a fix for every access issue.
When choosing a route, first identify the exit region your destination requires, then compare routes in that region. For video calls, check for choppy audio; for file sync, watch for interruptions during sustained transfers; for web browsing, look for consistent page loads. A shorter distance can be a useful starting point, but geography alone cannot tell you which route will be faster.
Protocols and Encryption Don’t Define Route Quality
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are protocol names used by common proxy solutions. They define how the client and server communicate; IEPL, relays, and direct connections describe how the network carries those connections. The same protocol can run over different routes, and the same route may offer configurations using different protocols.
- Shadowsocks: Carries proxy traffic using an agreed encryption method. The client and server authentication and encryption settings must match.
- VMess: Has its own authentication and data protection mechanisms and can be paired with different transport methods. Don’t copy only the server address and leave out the other required settings.
- Trojan: Common deployments use TLS to carry proxy connections. Certificate verification and server name settings are important.
- VLESS: The protocol itself does not encrypt data. Consider the security transport used in the deployment; the protocol name alone does not tell you whether a connection is protected.
- Hysteria2 and TUIC: QUIC-based solutions that usually depend on UDP network conditions. If your current network restricts UDP, switching to one of these protocols may not resolve the connection issue.
Beginners don’t need to start by looking for the “strongest” protocol. A more reliable approach is to check client compatibility, use the complete configuration provided by the service, and then test the app you want to use. Changing the transport method, certificate settings, or authentication fields at random can break a configuration that was working.
Rule-Based Mode and Global Mode
Rule-based mode chooses an outbound connection according to conditions—for example, sending everyday local services directly while routing requests that need an international exit through a designated proxy group. Global mode usually sends all requests intercepted by the client through the selected outbound connection; it does not automatically intercept all traffic on the device.
System proxy settings mainly affect apps that follow them. Some games, command-line tools, and other software may ignore these settings. TUN mode uses a virtual network interface to intercept more traffic, but its behavior still depends on routes, exclusions, permissions, and the client’s implementation. If an app isn’t using the proxy, first check what traffic is being intercepted before switching to global mode.
For example, your browser may work while a coding tool cannot connect because it uses its own proxy settings or its destination domain matches a direct-connection rule. Check the domain, matched rule, and outbound connection in the logs; repeatedly switching nodes won’t reveal the cause.
- ✅ For everyday use, keep rule-based mode and confirm that local services and international destinations take the intended routes.
- ✅ If an app has a problem, check whether it appears in the connection log and which outbound connection it used.
- ✅ Temporarily switching to global mode can help you compare results, but keep the destination and traffic interception method the same.
- ❌ Don’t run multiple clients that intercept network traffic at the same time; their proxy settings and routes may conflict.
How to Check DNS and Platform Differences
DNS translates domain names into addresses. If a connection uses a proxy but DNS queries still take an unexpected local route, the domains being looked up may be exposed. This is commonly called a DNS leak. It is different from whether your exit IP address has changed, and a test site showing the region of a DNS server is not enough on its own to draw a conclusion.
When checking, consider the client’s DNS settings, system resolver settings, browser Secure DNS, and the actual connection logs. A browser’s built-in encrypted DNS may use a separate route; IPv6 traffic should also follow the client’s interception policy. Encrypted DNS protects the relevant DNS transport—it does not automatically send all traffic through the same proxy outbound connection.
On Windows and macOS, distinguish system proxy settings from virtual network interface modes. Linux desktop proxy settings may not carry over to terminal tools. Android clients often intercept traffic through the system VPN interface, so check battery restrictions and per-app exclusions. iOS clients typically use Apple’s network extension framework; support for particular rules or protocols depends on the app.
“Connected” only confirms that one part of the connection is working. For a fuller check, make sure the target app works, the exit region meets your needs, the connection log shows the expected outbound connection, and DNS resolution follows the intended rules. VPNGF’s anonymous, no-logs policy is a service privacy policy; it does not replace checking your local client configuration or mean your browser account and activity on websites cannot be linked.
A Beginner’s Troubleshooting Checklist
If the node list is empty, check subscription retrieval and format compatibility first. If nodes appear but won’t connect, check whether the configuration is enabled, permissions, and your current network. If the browser works but an app doesn’t, check traffic interception and split-tunneling rules. If only a particular website has issues, check the exit region, DNS results, and the destination service. Change one setting at a time so you can tell which step made a difference.
Before contacting support, note your operating system, client name, route name, affected app, and error message. Don’t send your full subscription link. For common setup steps, see the Quick Start Guide; for route types, see Route Information; for account and service questions, visit the Support Page.