This VPN glossary for beginners puts subscriptions, nodes, protocols, split tunneling, and connection modes in context. Import a subscription to get your configuration, choose a node to set your exit point, then let rules decide which requests use the proxy. When something goes wrong, identify which step is failing before trying different nodes.
Where configurations come from: subscriptions and nodes
“Subscription” can refer to billing or configuration. A monthly subscription on a plan page describes recurring monthly data allowances; in a client, a subscription usually means an updateable source of configuration. The two are related, but they are not the same action: paying does not import a configuration, and a successful import does not mean your plan still has data available.
A subscription link is usually a URL containing access credentials. The client requests that URL to retrieve node details; some formats also include policy groups, routing rules, and DNS settings. It is not a regular homepage link or an installer download. Clients may support different configuration formats, so use the import method specified for your service and client.
A “node” is a proxy endpoint that a client can connect to. Its configuration usually includes a server address, port, authentication details, and protocol settings. A node name may indicate a region or use case, but it does not prove connection quality. Similar names can point to different entry points, while different names may share some network resources. The number of entries in a list alone says little about a service’s capabilities.
Protocols and routes: connection methods and data paths
A protocol defines how the client and server communicate; a route describes the network path the data takes. Nodes using the same protocol may use direct, relayed, or dedicated routes. Conversely, the same route type can carry different protocols. A protocol name alone tells you nothing definite about speed, stability, or regional availability.
| Name | What it is | What to check |
|---|---|---|
| Shadowsocks | An encrypted proxy protocol, not a complete system-level VPN tunnel solution. | The client must support the encryption method and related extensions used by the configuration. |
| VMess | A proxy protocol that can use different transport methods. | Check the transport and TLS settings, as well as the authentication details. |
| Trojan | Typically carries proxy traffic over TLS. | Verify the service domain and certificate; don’t disable certificate checks just to get a connection. |
| VLESS | A lightweight proxy protocol that does not encrypt payloads on its own. | Check the actual TLS, REALITY, or other secure transport settings in use. |
| Hysteria2 / TUIC | A QUIC-based proxy solution that depends on UDP network conditions. | Make sure the client supports it and that your current network allows the required UDP traffic. |
This table explains general terminology; it does not mean VPNEyes offers every protocol listed. Beginners should use a compatible configuration provided by their service rather than manually switching protocols just because one sounds newer. A protocol mismatch can leave a node visible in the list but unable to connect.
Direct, Relay, and IEPL Dedicated Lines
A direct route usually means the client connects straight to an overseas proxy entry point. Performance depends on your local carrier and international internet routing. A relay route usually connects to one entry point before forwarding traffic to another exit. An extra hop does not necessarily mean a slower connection; the actual path, congestion, and network operations matter.
IEPL is an international Ethernet private line, describing a dedicated international transmission connection. It is neither a proxy protocol nor an exit address in a particular country. If a service advertises a dedicated line, check which segment of the route it covers. The connection from you to the entry point and from the exit to the destination site may still use public networks, so a dedicated line does not mean the entire end-to-end route is exclusive.
Traffic routing, global mode and rule-based mode
Split tunneling sends requests along different paths based on conditions. These conditions may include a domain, destination address, or app; the action may be direct, proxied, or blocked. Policy groups organize selectable nodes: a rule can point to a group, and the group selection determines the specific exit. Even with a correct rule, choosing the wrong exit in the group can produce an unexpected result.
Rule mode checks requests against configured rules. The exact order depends on the client and rule format, though many implementations use first match wins. More specific service-domain rules usually need to come before broader rules, with a final catch-all rule handling anything unmatched. Before importing new rules, check how their author intends direct and proxied traffic to be handled.
Global mode typically sends all requests handled by the client through the selected proxy policy, but it does not guarantee that every app on the device is covered. Direct mode typically sends handled requests straight out; it does not necessarily mean the client is disconnected. Mode names can be similar, so check the current client documentation to see exactly what each one covers.
System Proxy, Virtual Network Adapters, and App Coverage
A system proxy registers a proxy endpoint with the operating system. Apps that honor this setting will use it, while some apps use their own network settings and may bypass it. A website loading in your browser does not prove that games, command-line tools, or other apps are using the same route.
TUN mode uses a virtual network interface to capture traffic. It can usually cover more apps that do not follow the system proxy setting, but its behavior still depends on routing, permissions, exclusions, and the client’s implementation. Enabling TUN does not automatically resolve DNS, IPv6, or app-specific routing issues.
How the Interface Varies by Platform
Windows and macOS clients may offer both system proxy and virtual network adapter options. Linux setups often involve separate desktop proxy settings, environment variables, and command-line tool configurations. Android clients commonly use the system VPN interface to capture traffic; support for including or excluding specific apps depends on the implementation. iOS clients usually work through system network extensions, and their option names and controls may differ from desktop clients.
A VPN icon in the status bar only shows that the relevant network feature is active; it does not tell you where every request is routed. Follow the guide for your current platform rather than applying settings from another operating system. After updating the client, check that your existing rules still work.
How to import and update a subscription
Before importing a subscription, check that you have the right client and a compatible format. Automatic import usually opens an installed client; if nothing happens, use its built-in subscription manager. An unresponsive import does not necessarily mean the route is down.
- Get the right configuration. Copy the subscription link for your current client from the service dashboard. Don’t copy the page URL or include extra spaces.
- Import and enable the configuration. Add the link on the client’s subscription or configuration page and update it. Some clients also require you to set the new configuration as active.
- Choose a node and mode. Pick an exit region that suits your needs, then check the policy group and rule mode. A refreshed node list only confirms that the configuration was retrieved successfully.
- Test the app you need. Open it and check the connection log for the matching rule and exit. A connection test in the node list is not a substitute for testing the app itself.
- Save your settings before changing them. Change one relevant setting at a time so you can compare the results. Refresh the subscription after the service updates its routes.
“Update subscription” means fetching the configuration again; it does not automatically renew your plan or reset its data allowance. Manually edited nodes may be overwritten during the next update. For ongoing customization, use the client’s supported override or custom rule features, and keep a copy of the original configuration so you can restore it.
DNS Leaks and Connection Troubleshooting
DNS translates domain names into addresses. A DNS leak usually means that lookup requests expected to follow a particular route are instead sent to an unexpected DNS resolver or network exit. A working proxy connection and a correctly routed DNS request are separate issues. Secure DNS built into a browser can also change how lookups are handled.
Encrypted DNS protects part of the DNS traffic, but does not automatically ensure it follows the same route as your proxy. Check the client’s DNS settings, system resolver, browser settings, and IPv6 routing together. The region shown for a DNS resolver on a test page does not necessarily reflect the physical route, so don’t draw conclusions from the location label alone.
- ✅ Subscription update failed: First check that the link is complete, hasn’t been reset, and that your current network can reach its source.
- ✅ Nodes appear but won’t connect: Check protocol compatibility, plan status, and the client’s error message, then check your local network conditions.
- ✅ Browser works but other apps don’t: Check whether those apps honor the system proxy or need a supported virtual network adapter to capture their traffic.
- ✅ Only some sites have issues: Check the matching rules, DNS resolution, and required exit region. Avoid switching exits at random over and over.
- ❌ Don’t disable certificate checks to get past an error, and never include full subscription credentials in a public troubleshooting screenshot.
Connection logs can help you trace where requests go, but may contain domain or address information. When contacting support, share only the relevant error excerpt and redact credentials. A service’s “no logs” policy does not mean your local client won’t generate diagnostic records; check the specific privacy details.
Data usage and billing: don't confuse them with configuration updates
A data allowance describes how much data a plan lets you transfer; it is not connection speed. Device limits describe how many devices can use the service, not a separate allowance for each device. “Unlimited devices” does not mean unlimited data. Check your dashboard and plan terms for the actual usage limits.
VPNEyes monthly subscription data resets each month on the activation date, not on the first day of the calendar month. Data add-ons remain available until used and never expire. These billing rules are separate from how often your client updates its subscription. For allowances and prices, see plan details; for device setup, see the setup guide.