VPN Terms Explained: Subscriptions, Nodes, Routes, Protocols, Split Tunneling & Routing Modes

This VPN glossary covers the subscription settings, nodes, route types, protocols, and routing modes commonly found in VPN clients. Start with what each one does: subscriptions deliver configuration, nodes identify connection endpoints, routes define how traffic travels, protocols govern communication, and routing rules decide which path each request takes.

People often use “VPN” as a catch-all for proxy subscription services, but application-layer proxies and network-layer tunnels work differently. A client showing “connected” doesn’t mean every app on your device is using the proxy. Knowing these terms makes it easier to pinpoint problems than repeatedly toggling settings.

Subscription Links, Plans, and Nodes: Where Configuration Comes From

A subscription plan defines billing; a subscription link provides access to configuration. The plan sets the available data and billing terms, while the link is typically a URL containing access credentials. Once a client retrieves it, it can load node settings. Some subscriptions also include groups, routing rules, or DNS settings, depending on the subscription format.

A node usually includes a server address, port, authentication details, and protocol settings. It’s a logical connection entry in the client, not necessarily a separate physical server. Multiple nodes may share an entry point or exit, so the number of names in a list doesn’t tell you how many independent servers there are.

A configuration file can include more than a list of nodes: it may also contain policy groups, routing rules, and DNS settings. Importing a node-only subscription where a full configuration is required—or giving a client-specific format to incompatible software—can result in import errors, an empty node list, or missing rules.

Treat your subscription link like an access credential. Don’t post the full URL in public forums or submit it to untrusted online conversion tools. If it’s exposed, check whether you can reset it through the service’s account portal, then update the saved subscription on each device.

How to Import a Subscription

1. Check the service dashboard or official guide for compatible clients and subscription formats. Don’t assume compatibility based on a file extension.
2. Paste the link into the “Subscription,” “Configuration,” or “Remote Configuration” section, then wait for the client to fetch it.
3. Make sure the configuration is selected and enabled, then check that nodes, policy groups, and rules appear as expected.
4. Choose a node and operating mode as described in the guide, then test the connection in an app instead of relying only on the connection icon.
5. Refresh the subscription after route changes. If you use custom local rules, check whether an update will overwrite them.

If the import fails, check that the link was copied in full, the subscription format is supported, and your current network can reach the subscription URL. Then check your account status. Refreshing a subscription updates its configuration; it doesn’t renew a plan or reset your remaining data.

Route Types: IEPL, Relay, and Direct Connections

Route types describe the path traffic takes, not the protocol. A direct connection typically connects your device to an overseas proxy server over the public internet. A relay route adds a forwarding node between your device and the exit; different networks may handle the entry point, cross-border leg, and exit.

IEPL usually refers to an international Ethernet private line, a dedicated Ethernet connection between locations. In proxy services, “IEPL” generally indicates that this type of connection is used for the cross-border leg. The label alone doesn’t mean that every part of the route—from your local connection to the exit and destination website—uses a private line.

The region shown for a node usually indicates its exit location, not necessarily its entry point. Websites may also infer your location from IP databases, account details, billing region, or device location. Connecting through an exit in a particular region doesn’t guarantee that a platform will offer its corresponding content or services.

Latency alone doesn’t tell you how a connection will perform in real use. A client’s test may check only a handshake or a specific test address, not sustained video streaming, file uploads, or calls. Compare routes under similar app and network conditions, and see whether they handle your actual tasks. A “private line” label isn’t a speed guarantee.

Common Protocols: Different Names, Different Compatibility Requirements

A protocol defines how a client and server authenticate, encapsulate, and transmit data. The same exit can support different protocols, and the same protocol can run over different routes. First check which protocols the service provides and the client supports; then consider whether they suit your current network.

Shadowsocks, VMess, Trojan, and VLESS

Shadowsocks is a family of encrypted proxy protocols. Both ends need to use compatible encryption methods and credentials. Implementations may differ in which methods they support, so sharing a protocol name doesn’t guarantee interoperability.

VMess provides authentication and encrypted proxy communication between clients and servers. The transport settings must also match the credentials. A significantly incorrect system clock can interfere with authentication, so make sure your device keeps the correct time.

Trojan typically carries proxy traffic over TLS. Certificate validation, the server name, and authentication details can all affect the connection. If you encounter a certificate error, check the domain, system time, and service configuration rather than disabling certificate validation.

VLESS doesn’t encrypt payloads on its own and is typically used with security mechanisms such as TLS or REALITY. Its security depends on the complete deployment, not just the protocol name. Make sure the transport, security settings, and related parameters match the server.

Hysteria2 and TUIC

Hysteria2 and TUIC are both based on QUIC and typically rely on UDP. They may work well under certain network conditions, but they may not connect if your network restricts UDP. A newer protocol isn’t automatically faster.

Keep protocols, transport methods, and security layers distinct: TCP, WebSocket, gRPC, and TLS options in a client don’t all belong to the same layer. This article explains general concepts; it doesn’t mean VPNKuaiWang supports every protocol listed. Check the dashboard, subscription details, and guides for available options.

Global, Rule-Based, and Direct Modes: How Requests Are Routed

Rule-based mode matches requests against conditions such as domain names, destination addresses, and app processes. A policy can connect directly, send traffic to a proxy group, or block the request. Rules are often checked in order, so a broad rule earlier in the list can take precedence over a more specific one. Rule order and fallback behavior both matter.

Global mode typically sends requests that reach the proxy client through a selected proxy policy. It doesn’t guarantee that the entire device’s traffic is routed through the client. If an app bypasses the system proxy, switching from rule-based to global mode may not help.

Direct mode typically connects requests received by the client directly to their destinations. It doesn’t turn off other proxy tools on your system. Check browser extensions, in-app proxies, and system settings separately.

A policy group collects nodes or policies and may support manual selection, automatic testing, or failover. A successful test shows only that the connection works under the test conditions; it doesn’t prove that every website is accessible. A group name is just a label, so check which exit is actually selected within the group.

System Proxy, TUN, and Platform Differences

System proxy provides a proxy endpoint mainly for apps that follow the system settings. Browsers usually support it, but command-line tools, games, and apps with custom networking may need separate configuration. If an app has internet access but its exit hasn’t changed, first check whether its traffic is actually going through the proxy.

TUN uses a virtual network interface to receive IP packets for the client to process, which can cover more apps that don’t follow system proxy settings. Coverage still depends on routes, exclusion lists, permissions, and the client’s implementation. Enabling TUN doesn’t ensure that DNS is configured correctly.

• Windows: Check for conflicts between the system proxy, virtual network adapters, and other networking software. Command-line tools and background processes may not use the proxy the same way your browser does.
• macOS: A system proxy and a tunnel that captures traffic through a network extension work differently. Watch for system permission prompts and check which network service is actually enabled.
• iOS: Clients commonly use system-provided network extensions to establish connections. Seeing a VPN status indicator doesn’t mean your rules have no direct-connection exceptions.
• Android: Many clients use VpnService to capture traffic. App exclusions and background restrictions can affect coverage and whether the connection stays active.
• Linux: Desktop proxy settings, environment variables, and system routes can affect different programs. Services may not inherit the configuration of your current terminal.

VPNKuaiWang supports Windows, macOS, iOS, Android, and Linux. Support for a platform doesn’t mean the client interface and features are identical everywhere. For platform-specific import steps and permission settings, see the guides.

DNS Leaks, Exit IPs, and Privacy Limits

DNS translates domain names into addresses. A DNS leak generally means that queries expected to follow a proxy or specified DNS route instead take a local or otherwise unintended path. This could reveal the domains being queried or cause a website to resolve to an unsuitable server.

A changed proxy exit IP alone doesn’t prove that DNS is following the expected route. Conversely, a test page showing the region of a resolver doesn’t by itself establish a leak: public DNS services may use distributed servers, and IP geolocation databases can be inaccurate. Check the client logs and configuration as well.

A browser’s encrypted DNS may run alongside the client’s DNS configuration. Encryption describes whether queries are protected in transit; it doesn’t guarantee they use the expected exit. Fake-IP returns a synthetic address to an app first, then lets the client map it back to a domain. It isn’t a separate proxy exit, and you shouldn’t toggle it without understanding the configuration.

“Anonymous, no-logs” describes a service’s privacy policy; it isn’t an absolute guarantee about all online activity. Your identity when logged in, browser cookies, and device permissions can still affect how identifiable you are. A proxy also doesn’t replace HTTPS end-to-end content protection.

To troubleshoot, check whether the client specifies DNS servers, whether queries follow your routing rules, and whether the browser uses a separate DNS route. Then check your exit using My IP. Don’t change several DNS settings at once just to pass a test page, or it’ll be hard to tell which change helped.

Troubleshooting by Symptom: From Configuration to Actual Requests

Configuration problems often come from confusing different layers: treating a subscription refresh as a data reset, assuming global mode captures all device traffic, or treating node latency as proof a website is accessible. Work through the checklist below to preserve useful clues instead of reinstalling everything.

• ✅ Subscription import fails: Check the link, format compatibility, fetch results, and currently enabled configuration. Don’t expose your credentials.
• ✅ Node won’t connect: Check account status, protocol support, device time, and network conditions. Keep any error details free of sensitive parameters.
• ✅ Browser works, but an app doesn’t: Check whether the app follows the system proxy or is excluded from TUN routing.
• ✅ Global mode works, but rules don’t: Check which rule matches the destination domain and which node is selected in the relevant policy group.
• ✅ Exit region looks right, but content differs: Check the platform’s account region, content licensing, and IP-based location detection. A regional node doesn’t guarantee access.
• ✅ Connection fails after switching networks: Recheck network authentication, node reachability, and UDP support. Change one type of setting at a time, then test again.

Keep technical settings and billing terms separate. VPNKuaiWang monthly subscription data resets monthly on the activation date. Data packages never expire and remain available until used. Refreshing a subscription restores neither. There’s no limit on the number of devices connected at the same time, but that doesn’t mean each device gets a separate plan allowance. See plan pricing for prices and billing details.