When you're new to VPNs, start by understanding subscriptions, servers, split tunneling, global mode, and rule-based routing. A subscription provides the configuration, a server determines where you connect, and the mode determines how traffic is routed. Each serves a different purpose. This guide walks through the setup process and practical checks.
From subscriptions to servers: what each part of your configuration contains
A subscription link is how a client retrieves its configuration and often contains a token tied to your account permissions. When the client requests the link, it may receive a server list or a full configuration with policy groups, DNS settings, and routing rules, depending on the subscription format. It isn't a general information page, and it may not work with your device's built-in VPN settings.
A server is a proxy endpoint the client can connect to. Its configuration usually includes a server address, port, protocol, and authentication details. A location label often describes the exit region, but check the service documentation: the entry point, physical server location, and exit location may differ. Multiple server names don't necessarily represent separate physical machines.
A policy group adds a layer of selection logic. For example, one group may let you choose a server manually, while another automatically selects one based on health checks. Even after a successful import, you may still be unable to connect if a rule points to a policy group with no available server selected. Updating a subscription refreshes the configuration; it doesn't restore plan access or guarantee that local edits will be preserved.
Protocols, routes, and clients are different things
A protocol defines how the client and server communicate; a route describes the path traffic takes; and the client applies the configuration. These tools are often broadly called VPNs, but proxy protocols aren't the same as system-level VPN protocols. An app may use the system VPN interface to handle traffic, so seeing a VPN indicator on your device doesn't tell you which proxy protocol is in use.
| Term | What it does | Common point of confusion |
|---|---|---|
| Subscription link | Lets the client retrieve or update its configuration | It's not a client installer or a credential for signing in to a website |
| Server | Provides a proxy endpoint to connect to | Names and counts alone don't tell you how fast or reliable it is |
| Proxy protocol | Defines how connections, authentication, and data transfer work | A protocol name says nothing about route quality |
| Route type | Describes a network path, such as direct, relayed, or dedicated | A route label doesn't guarantee access to a particular website |
| Rules and policy groups | Choose the route for a request and which server to use | Changing modes doesn't necessarily capture traffic from every app |
Shadowsocks is an encrypted proxy protocol. VMess, Trojan, and VLESS each have different authentication and transport designs. Trojan typically uses TLS, while VLESS doesn't provide encryption itself; secure transport depends on the accompanying configuration. Hysteria2 and TUIC are based on QUIC and rely on UDP, so performance may be affected on networks that restrict UDP. These differences help assess compatibility, not rank protocols by speed.
The client must support the subscription's format, protocols, and relevant transport options. Even configurations labeled VLESS can differ in compatibility depending on their transport and security settings. Check the service's compatibility guidance when choosing a client, and don't paste your configuration into an unfamiliar online converter just to use a particular protocol.
How to tell direct connections, relays, and IEPL dedicated routes apart
In route descriptions, direct usually means your device connects straight to an overseas proxy server. A relay usually means it first connects to an entry server, which forwards traffic to the exit server. Relays add a step, but can improve performance through better routing, so more hops don't automatically mean a slower connection.
IEPL refers to an international Ethernet private line and usually describes the cross-border segment of a route. It doesn't mean the entire path from your device to the destination website uses a private line, nor does it guarantee that the public internet egress will never be congested. When choosing a route, consider local access, the cross-border segment, the egress network, and the destination service—not just the server name.
One term can mean two different things here: in routing rules, “direct” usually means a request reaches its destination without using a proxy server. That's different from “direct” in “direct route,” which describes the server path. When reading a configuration, first check whether the discussion is about routing policy or the route to a server.
Global mode vs. rule-based routing: how requests are routed
Rule-based routing sorts requests into policies such as direct, proxy, or block based on domains, IP addresses, processes, or other conditions. A common setup sends local services direct and routes services that need international access through a proxy. Rules usually run in order: once a request matches an earlier rule, later rules typically don't reconsider it. The final behavior also depends on the client's rule engine and fallback policy.
Global mode usually sends all requests already captured by the client through a selected proxy policy. It's useful for temporarily checking whether a rule is causing a problem. But “global” doesn't mean that every bit of traffic from your device must go through the proxy. On desktop, if only the system proxy is enabled, apps that ignore system proxy settings may still connect directly.
TUN mode uses a virtual network interface to capture more IP traffic, often including traffic from apps that don't support system proxy settings. It isn't inherently faster and doesn't automatically resolve DNS issues, routing exclusions, or conflicts with other VPNs. Mobile clients usually work through the system VPN interface, while desktop clients may offer separate system proxy and TUN settings. Don't follow another platform's instructions without checking your own client's interface.
From getting a subscription to your first connection
- Check your account status. In the user panel, confirm your plan access and remaining data, then open the client download section. VPNUnit's client downloads are available on the user panel download page. Check the panel for platform compatibility details.
- Get the right configuration. Choose a subscription format that works with your client. If one-click import is available, check which app your device is about to open. For manual setup, paste the link into the client's subscription or remote configuration section.
- Check the import. Confirm that the configuration is enabled, the server list is present, and a valid option is selected in the policy group. If you see a format error, first check the format and client version rather than repeatedly switching servers.
- Grant permission and connect. On mobile, allow the VPN configuration when prompted by the operating system. On desktop, follow the client instructions to enable the system proxy or, if needed, TUN. Don't run multiple network tools that capture traffic at the same time.
- Test the apps you actually use. Visit the destination website and check sign-in, page assets, and the features you need. To check the exit region, compare results from a trusted IP lookup service—but don't treat a changed exit IP as proof that every app's traffic is being captured.
Treat your subscription link like an account credential. Don't share the full link, its QR code, or screenshots containing its token, and don't post it in public troubleshooting threads. If you think it may have been exposed, check the panel to see whether you can reset the subscription. For troubleshooting, share the error type and logs with sensitive details removed. For more setup guidance, see Quick Start.
DNS, exit IPs, and connection checks
DNS translates domain names into addresses that devices can connect to. Routing a web request through a proxy doesn't mean its DNS lookup follows the same route; that depends on system settings, the client's DNS mode, routing rules, and any encrypted DNS settings in the app itself. A DNS leak generally means a lookup has unexpectedly bypassed the intended protection path—not that using a local resolver is automatically a configuration error.
Before checking, decide what you expect: how international services should be resolved and whether local services are intentionally using local DNS. Then compare client logs, DNS test results, and what happens when you actually connect. A DNS test site reports the behavior it observed under its test conditions; it can't draw conclusions for every app.
Exit IPs have similar limitations. The address shown by a browser lookup only describes the exit used for that web request; command-line tools, games, and standalone apps may take a different route. If an app has its own proxy settings, check that it uses the correct local proxy address or that the client is capturing its traffic.
Troubleshooting: check each layer before switching servers
- ✅ Subscription won't update: Check that the link is complete, your account access is valid, and your local network can reach the subscription address. A failed update doesn't necessarily mean all your existing servers are unavailable.
- ✅ A server is listed, but won't connect: Check client compatibility, system time, authentication errors, and UDP support before trying another compatible server.
- ✅ Your browser works, but other apps don't: First check whether the apps follow system proxy settings or have their own proxy options. Then check the scope of TUN capture; don't assume the route is at fault.
- ✅ Global mode works, but rule-based routing doesn't: Check which policy group matches the destination domain, along with DNS results and fallback rules. If you confirm a misclassification, make the smallest rule change needed.
- ✅ Some websites work, but a particular platform still reports an error: Check your account region, the platform's policies, and the error message. Network connectivity and platform authorization are separate issues; changing your exit location doesn't guarantee access.
A latency test only measures response under a specific test method; it can't replace download, video playback, or long-connection tests. When troubleshooting, record the network, client, mode, server, and error. Change one condition at a time to help distinguish a local traffic-capture issue from a rule or route problem.
Guidelines for beginners setting up a client
Understanding these terms also helps you ask better questions when comparing services: which clients and subscription formats are supported, how route types are described, how configurations are updated, and how to report an issue. To compare service terms, see the plan details. For configuration help, visit the support page.