VPN Beginner Glossary: Subscriptions, Nodes, Protocols, and Traffic Routing Explained

Put the terms in context

“VPN” can mean a system-level virtual private network or, more broadly, a network acceleration client. Enabling TUN in a proxy client does not necessarily mean it uses a traditional VPN protocol underneath. What matters most for beginners is whether the client captures an app’s requests and where those requests go afterward.

Think of it as a flow: an app sends a request, and the client uses its rules to send it directly or through a proxy. Requests routed through a proxy go to the selected node, whose exit then connects to the destination site. DNS resolution is part of the process too; it may be handled locally, by the client, or remotely, depending on the configuration.

Subscriptions: plans and config links are different

“Subscription” can mean two different things. Buying a monthly subscription gives you plan benefits for that period; copying a subscription link lets a client download connection settings. Having data available in your account doesn’t mean the client has imported the link, and importing it successfully doesn’t mean your account benefits will always remain active.

A configuration subscription is usually a URL with access credentials that a client uses to fetch a node list. Some formats also include proxy groups, rules, and DNS settings, while others provide nodes only. So “update subscription” usually means refreshing the configuration—not renewing your plan or necessarily updating the client itself.

VPNVW monthly plans reset data on the activation date, not at the start of each calendar month. If you upgrade mid-cycle, the price difference is prorated for the remaining days. Data add-ons remain available until used and never expire. These billing rules are separate from the client’s automatic update settings.

If the client says a format isn’t supported, first check that you chose the right import option. A node share link, a full configuration file, and a subscription URL may each require a different import method. Don’t judge compatibility by the file extension alone, and don’t overwrite a configuration in use with unfamiliar settings from a third party.

Nodes, exit locations, and route types

A node is a connection entry in the client, usually containing a server address, port, protocol, and authentication settings. The region in a node’s name is just a label: the entry location, exit location, and network path in between may all differ. To find out what region a site sees, check the exit IP actually used by that app.

A direct route usually means the client connects straight to a server outside mainland China. The connection still travels over carrier networks; it doesn’t avoid routers or intermediate networks. The path is relatively straightforward, but international congestion, carrier peering, and server load can all affect performance.

A relay route connects to a relay entry point first, which then forwards traffic to the exit. This may improve routing on some networks, but it adds another component to maintain. A healthy entry point doesn’t prove the connection is working beyond the relay, and a change in exit location doesn’t necessarily mean the entry configuration changed.

IEPL generally refers to an international Ethernet private line. Even when an acceleration service uses one, the access leg from the user to the entry point and the public internet segment from the exit to the website can still affect performance. Route type and protocol are separate dimensions: Trojan isn’t a dedicated line, and an IEPL label alone doesn’t guarantee a platform will work.

Start by choosing the target region and app, then test on your current network. A client’s latency check usually covers only a specific test request; it doesn’t measure video playback, file transfers, or call quality. Check the control panel for the available nodes and route details, or visit the servers page.

Protocols: what the names tell you

A protocol defines how the client and server transmit, authenticate, and protect data. A connection can work only when both ends and their settings are compatible. The descriptions below are general industry explanations, not a list of protocols currently supported by VPNVW. Check the client and control panel configuration for current support.

• Shadowsocks: An encrypted proxy protocol. A typical configuration includes a server, port, password, and encryption method. Supported encryption methods, plugins, and extensions vary between implementations.
• VMess: An authenticated proxy protocol that commonly uses a UUID in its configuration. The transport and security settings need to match, and some implementations are sensitive to system clock differences.
• Trojan: Usually uses TLS to protect proxy traffic and a password for authentication. Certificate verification, the server name, and authentication settings all matter. Don’t disable certificate checks just to troubleshoot a connection.
• VLESS: A lightweight proxy protocol that doesn’t provide encryption by itself. It’s usually paired with security mechanisms such as TLS or REALITY. The name VLESS alone doesn’t tell you how the data is protected.
• Hysteria2: A QUIC-based proxy protocol that relies on UDP connectivity. Its congestion-control design is intended for unstable links, but it isn’t guaranteed to be faster on every network.
• TUIC: Also based on QUIC, with support for proxying TCP and UDP traffic. The version, authentication method, and client implementation must be compatible, so check support even when the name matches.

There’s no protocol ranking that applies in every environment. On hotel Wi-Fi that restricts UDP, QUIC-based configurations may struggle to connect. If the client lacks the required core support, switching regions won’t fix a format issue. Prefer configurations adapted for your client in the control panel, and avoid copying “optimized settings” from unknown sources.

Traffic routing: global mode vs. rule-based mode

Rule-based mode selects a route based on conditions such as the domain, destination IP, or process. For example, local services can connect directly while selected international sites use a proxy. Rule engines often evaluate rules in order, but behavior depends on the client. Broad rules placed first can prevent more specific rules later from taking effect.

Global mode usually sends all requests already captured by the client to a single proxy policy. The key phrase is “already captured”: if only the system proxy is enabled, apps that ignore it may still connect directly. Global mode therefore doesn’t guarantee that every connection on the device will use the proxy.

System proxy tells the operating system or apps which proxy address to use; whether an app follows it depends on how it’s built. TUN mode captures more traffic through a virtual network interface, but is still affected by routing, app exclusions, permissions, and DNS settings. Traffic capture and routing mode are separate settings and can be used together.

Proxy groups may also select or switch nodes automatically. A group showing as selected doesn’t guarantee it contains a working node. For troubleshooting, temporarily pin the group to a specific node to reduce variables from automatic switching. Once testing is complete, decide whether to re-enable automatic selection.

Client setup and platform differences

The same subscription URL may not work with every client. The graphical interface handles user input; the core handles connections and rule processing. Their supported formats and protocols can change between versions. Windows, macOS, iOS, Android, and Linux each have their own system permissions and traffic-capture mechanisms.

Desktop clients commonly offer system proxy and TUN options; on Linux, network management and permissions also depend on the distribution. Mobile clients often capture traffic through the system VPN interface. A VPN icon only confirms that the interface is enabled—it doesn’t replace an exit IP check. Another VPN app or system network extension may also cause conflicts.

1. Choose the client for your platform from the control panel download page, and check the configuration compatibility notes.
2. Get a compatible subscription URL from the control panel and import it through the client’s subscription option. Don’t enter the URL as a server hostname.
3. Wait for the configuration to load, then check that nodes and proxy groups appear. If the import fails, keep the error message and first verify the format and client support.
4. Choose a node in the target region, enable the traffic-capture method and routing mode suited to your setup, and approve any required system network permissions.
5. Open the target app and check its exit IP. If the result isn’t what you expected, first confirm the configuration is enabled, then check rules, DNS, and the node one at a time.

Old nodes still appearing after an import don’t necessarily mean the subscription has expired; the active configuration may simply not have changed. Distinguishing between “saved,” “updated,” and “currently in use” can prevent confusion from repeated imports. For more detailed steps, see the quick start guide.

Exit IP and DNS checks

The exit IP is the network address a destination service sees. Note the result before connecting, then connect to the target node and compare using the same app. Seeing the expected exit in a browser confirms only that browser’s request path at that time. Verify office apps, games, and command-line tools separately.

DNS translates domain names into network addresses. A DNS leak usually means a lookup that should be protected or routed as expected was instead sent over an unintended path, such as the local network. Seeing a resolver in another region isn’t enough on its own to prove a leak. A public resolver’s registered location may also differ from where its service actually operates.

Consider the client’s DNS settings, traffic-capture mode, browser Secure DNS, IPv6 routing, and test results together. Encrypted DNS protects the DNS lookup path; it doesn’t automatically change an app’s exit route. A website may still show content based on your account region, history, or location permissions, so don’t attribute every change in its catalog to DNS.

• ✅ Confirm which configuration and proxy group are active. Check the client log for matched rules and connection errors.
• ✅ Compare exit IP results before and after connecting, and test in the target app itself—not just the client’s “connected” status.
• ✅ Check how DNS, browser Secure DNS, and IPv6 are handled, and confirm the results match your access needs.
• ✅ Change one setting at a time and note the result. Don’t switch nodes, edit rules, and clear the configuration all at once.
• ❌ Don’t disable certificate verification just to get a connection, and don’t share subscription credentials while asking for help.

Start by checking your browser’s exit IP on the network test page. If you still can’t identify the issue, open a support ticket in the control panel with your platform, client version, target app, error message, and redacted logs. Hide subscription URLs, passwords, and authentication details in screenshots.

From terms to practical choices

Choosing a plan and choosing a protocol are separate decisions. If you use the service regularly, compare monthly plans; for occasional use, compare data add-ons. First consider your usage and schedule, then check whether the client, target region, and app are compatible. VPNVW monthly plans are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB. See the plans page for full pricing and data add-on details.

VPNVW has no device limit, but plan data is shared at the account level, so keep an eye on usage across devices. No email address is required; create an account with a username and password. You can request a full refund for any reason within 7 days of your first payment.