This complete VPN beginner's guide walks through the full setup path: creating an account, choosing a plan, confirming payment, getting a subscription URL, importing it into a client, selecting a route, and checking whether the connection is actually working. For first-time users, the confusing part is usually not a single button but how the account, subscription, client, and route fit together. Once these objects are clear, troubleshooting becomes much easier.
The account gets you into the user panel; the plan determines which services are currently available; the subscription URL delivers route configurations to the client; and the client reads those configurations and establishes a connection on your device. A route is a specific entry point within the subscription, not the subscription itself. Moving to another device usually means importing the subscription again, while changing routes only requires selecting another entry from the imported list.
Confirm your setup path before choosing a plan
Do not install a collection of clients from unknown sources and then look for one that can import the configuration. A safer order is to open the plans page, confirm the plan you need, and complete the account and order process through the user panel. After payment is complete, continue with configuration using the download and subscription entries provided in the panel.
- Open the plans page and review the data allowance, billing period, and intended use instead of comparing prices alone.
- Open the user panel, create an account as instructed, and store your login credentials securely.
- Choose the appropriate plan and complete the payment steps shown on the page.
- Return to the order or overview area and confirm that the plan status has updated before retrieving the subscription.
Being redirected away from the payment page does not necessarily mean the client has received its configuration. Use the order and service status in the user panel as the reference, rather than the page where the browser stops. If the payment result has not synced, do not repeatedly submit the same order. Refresh the panel and check the order record first; if the issue remains, keep the order identifier and payment result page, then contact support through the ticket portal.
- ✅ You can log in to the user panel and see the current order or plan status.
- ✅ The panel shows an option to retrieve the subscription, not only a payment option.
- ✅ The download entry matches your device platform, and the installer comes from the site panel.
- ❌ Repeatedly creating the same order before the payment status is confirmed.
- ❌ Posting your login password, subscription URL, or complete configuration screenshots publicly.
What subscription URLs and protocols mean
A subscription URL is a way to distribute configuration. When a client accesses it, the client retrieves a set of route names, server addresses, ports, transport parameters, and authentication details. It is not a regular webpage and does not need to remain open in a browser. Options such as “Import from URL,” “Add subscription,” and “Subscription management” generally refer to the same type of operation, although the wording varies slightly by platform.
A protocol determines how the client and server establish a session. Common names include Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC. They are not client brands, and the name alone cannot determine actual speed. Whether a protocol works depends on client support for the relevant format and whether the transport, encryption, or TLS parameters delivered by the subscription can be read completely.
| Name | Basic role | What to check when importing |
|---|---|---|
| Shadowsocks | An encrypted proxy protocol; configurations usually include a server, port, password, and encryption method. | Older clients may not support the newer encryption method specified by the subscription. |
| VMess | Common in the V2Ray ecosystem; authentication and transport parameters must work together. | Do not copy only the server address; the network, transport, and TLS parameters must also match. |
| Trojan | Usually carried over TLS, with configuration involving a domain, authentication details, and certificate validation. | An incorrect system clock or missing domain parameters can cause the handshake to fail. |
| VLESS | A lightweight authentication protocol whose security and transport capabilities depend on the accompanying transport layer. | The client must recognize the transport method and related security parameters in the subscription. |
| Hysteria2 | A UDP-focused transport designed to handle unstable connections and packet loss. | If the local network restricts UDP, timeouts or handshake failures may occur. |
| TUIC | A proxy protocol based on QUIC concepts, with requirements for client-version and parameter matching. | When import fails, first check whether the client actually supports the protocol. |
Beginners usually do not need to enter these parameters manually. Importing the complete subscription first reduces the chance of missing transport-layer options. Inspect individual protocol fields only when the subscription cannot be recognized, support specifically asks you to verify the configuration, or you need to diagnose a single route.
Install and import a client on different platforms
Use the user panel's Get the client entry to choose your platform. Desktop and mobile systems handle network permissions differently, but the import flow is much the same: install the client, grant the required permissions, add the subscription, update the list, choose a route, and start the connection.
Windows and macOS
Desktop clients generally offer system proxy and virtual network adapter modes. System proxy mode handles apps that follow the system proxy settings; virtual network adapter mode can handle more programs that ignore those settings, but may require a network component or administrator permission. During initial setup, do not run multiple proxy clients at once, since they may overwrite each other's system proxy ports, routing tables, or virtual adapters.
When a network extension is enabled for the first time on macOS, the system asks you to confirm permission. Windows may also show a system confirmation window when installing a virtual network adapter component. Grant the permission first, then return to the client and click connect. If you dismiss the system prompt, the client may appear to be starting while the actual route has not been established.
iOS and Android
Mobile platforms display a system-level VPN configuration request the first time you connect. This is the permission the operating system needs to create a network tunnel; it does not mean the subscription has been imported successfully. The correct order is still to add the subscription and update the routes in the client, select a node, and then approve the system connection request.
iOS clients generally use the system Network Extension to manage connections; Android clients take over traffic through the system VPN service. Strict battery saving, background restrictions, or automatic sleep can disconnect the client after it remains in the background for a while. If this happens, check the operating system's background-run settings for the client instead of repeatedly replacing the subscription URL.
- Copy the subscription URL from the panel and make sure there are no extra spaces at either end.
- Open subscription management in the client and choose to add a subscription from a URL.
- Give the subscription an easy-to-recognize name, then run an update.
- Choose a node from the route list and set it as the current route.
- Start the connection and approve the network permission shown by the operating system.
After a successful update, the client should show a route list rather than merely storing one line of subscription text. If the subscription has been added but the list is empty, run “Update subscription” manually first. If a format error appears, check that the full address was copied, that a webpage address was not mistaken for a subscription address, and that the client version supports the protocols included in the subscription.
How to choose direct, relay, and IEPL routes
“Direct,” “relay,” and “IEPL” in route names describe different network paths. Direct means the device connects straight to the remote entry point; the path is simpler, but performance is more affected by the local carrier's international routing. A relay route first connects to a nearer entry point and then uses a relay network to reach the exit region, which is generally used to improve stability across networks and borders.
IEPL refers to an international Ethernet private-line type of connection, often used for the dedicated transport segment between an entry and an exit. It describes the intermediate transport network, not an application-layer proxy protocol, and does not mean the entire access path avoids the public internet. The connection from your device to the entry point and the path from the exit to the destination website are separate network segments, and the final experience is also affected by local access, exit load, and the destination's response.
| Route type | Path characteristics | Best situations to try first | Common limitations |
|---|---|---|---|
| Direct | The local device connects directly to the remote entry point. | Stable routing from the local network to the target region and everyday web browsing. | Fluctuations may be more noticeable when traffic takes a longer path across networks or congestion increases in the evening. |
| Relay | Connects to a nearer entry point first, then relays to the exit node. | When direct connections lose packets or routes between carriers are unstable. | More link segments are involved, so the entry-point status also affects the connection. |
| IEPL | Uses a private-line type of transport between the entry and exit. | Tasks that prioritize sustained connections and stable routing. | A private line describes only the transport segment; it cannot replace correct endpoint permissions and configuration. |
When choosing a route for the first time, do not chase the longest name or the farthest node. Start by choosing an exit region based on your purpose, then compare the actual response of different routes in that region. If pages load slowly but the connection stays up, the issue may be with the destination or exit path; frequent client reconnects are more likely related to the local network, entry link, or protocol compatibility. Change only one variable at a time so you can identify which layer is responsible.
Confirm that the connection is actually working
A client showing “Connected” only means the local program believes the session is established; it does not by itself prove that every app is using that path. Verification should cover the exit address, DNS resolution, and actual app access. Start by opening the site's My IP page and recording whether the exit information changes before and after connecting, then check whether the target app loads normally.
Check the exit address
If the exit information does not change after connecting, first check on desktop whether the client is using system proxy or virtual network adapter mode. Browsers usually follow the system proxy, but some games, command-line tools, and standalone network programs may bypass it. On mobile, check whether the system status bar shows a VPN indicator and whether the client is still connected in the background.
Check for DNS leaks
A DNS leak occurs when traffic is forwarded through the proxy but domain lookups are still handled directly by the local network. This may expose the local resolver or produce regional results that do not match the exit region. Check the client's DNS settings, routing mode, and virtual network adapter configuration to confirm that proxy domains use remote resolution.
Seeing only a local DNS address is not enough to draw a conclusion, because some clients create a local DNS listener on the device and forward queries remotely. The key question is which path ultimately handles the query, not the listener address shown in the client interface. After changing DNS, disconnect and reconnect so old caches and sessions are cleared.
Check split-tunneling rules
Split-tunneling rules determine which domains or IP addresses use the proxy and which stay direct. Global mode is convenient for troubleshooting because the traffic path is more uniform; rule mode is better for everyday use, but incorrect or outdated rules may send a target site direct by mistake. If a site will not open, temporarily switch to global mode for comparison. If it works globally but not in rule mode, the issue is usually rule matching or DNS routing rather than the account or subscription.
- ✅ The exit information changes as expected for the selected route.
- ✅ Both the browser and the target app can connect, rather than only the client showing a connection.
- ✅ When rule mode behaves unexpectedly, use global mode for comparison.
- ✅ After changing the route, DNS, or mode, disconnect the old session before reconnecting.
- ❌ Running multiple clients that modify the system proxy or routing at the same time.
A troubleshooting order for common issues
Troubleshoot from the account layer toward the network layer; do not start by reinstalling the system or repeatedly changing protocols. The account, subscription, client, route, and app are separate but connected layers. Until the previous layer is confirmed to work, symptoms in the next layer are difficult to interpret.
The subscription will not update
Return to the user panel and confirm that the plan status and subscription entry are still valid, then copy the complete URL again. Check that the client has saved the address as a “subscription” rather than a “single route.” If an old subscription worked before but now fails to update, delete the local subscription record and add it again; first confirm that the panel can still provide the URL.
All routes time out
When every route times out at once, first check the local network, system time, client permissions, and firewall blocking. TLS-dependent configurations such as Trojan may be affected by an incorrect system clock; UDP-dependent options such as Hysteria2 and TUIC may be restricted by the current network. You can compare routes using different protocols in the subscription, but do not change DNS, routing, and virtual network adapter mode at the same time, or you will not know which change helped.
The browser works, but other apps do not
This is usually related to the scope of proxy coverage. The browser reads the system proxy, while the target app may establish connections directly. On desktop, check whether the client supports virtual network adapter mode and whether its network component is enabled. Exit other similar clients before switching modes to avoid routing and port conflicts.
Some websites still will not open after connecting
First switch to another route in the same region to rule out an issue with a single exit path; then compare global and rule modes. If only rule mode fails, check the domain rules and DNS policy. If every route fails only for the same website, also consider the website's own status, account region settings, or browser cache instead of assuming that the subscription has failed.