This VPN glossary for beginners starts with a practical question: what does each client setting do? A subscription provides configuration, a node determines what you connect to, a route describes how traffic travels, a protocol defines how it communicates, and routing rules decide where requests go. These concepts are related, but they are not interchangeable.
When troubleshooting a connection, identify where the problem occurs instead of repeatedly toggling every setting. The sections below follow a request from your device to the destination website. Protocols are discussed for general information and do not imply that VPNMF offers the corresponding protocol or configuration.
Subscriptions and clients: where configuration comes from
A subscription plan is a billing arrangement that determines the available data and billing period. A subscription link is the address a client uses to fetch configuration. “Updating a subscription” usually means downloading nodes and related settings again; it does not renew your plan or add data.
A client is software that applies configuration. The server accepts connections; the client selects a node, authenticates, forwards traffic, and applies rules. Whether an account works with a particular client depends on whether the service provides a compatible subscription format and whether the client supports the protocols and fields in the configuration.
Common import options include “Subscription Management,” “Configuration,” and “Import from URL.” Copy the subscription URL from your account panel, not the panel page’s address in your browser. After importing, confirm the update succeeded, nodes appeared, and the configuration is enabled. Saving the URL alone does not mean your device is routing traffic through it.
Nodes and exit points: what are you choosing when you select a region?
A node is a connection configuration you can select in a client, usually containing a server address, port, protocol, and authentication details. A node name is only a label; it may indicate a region, purpose, or route type, but cannot establish the actual traffic path on its own. Selecting a node for a region usually means choosing an exit in that region, but verify the actual exit to be sure.
An entry point is where your device first connects to the service network. An exit point is where a request leaves that network to reach its destination. Websites usually see the exit IP, not the entry address. So an entry point close to you does not mean a website will identify your connection as local.
“Auto select” usually picks a node based on the checks configured in the client. The test target, rules, and refresh behavior vary, and test results don’t represent how every website will perform. When using a service that is sensitive to location, a stable exit that meets its requirements is usually more useful than repeatedly chasing the top result in a test list.
The number of nodes is not the same as the number of unique exit IPs. Different nodes may share an exit, and an exit may change while you stay on the same node. If your work requires a fixed IP, check the product details rather than assuming that selecting the same node guarantees an unchanging exit.
Route types: direct, relayed, and IEPL dedicated lines
A route describes the path data takes. Direct connections, relays, and dedicated lines mainly answer “how does traffic reach the exit?”—not “which protocol is used?” The same protocol can run over different routes, and the same route can carry different protocols.
| Type | Typical route | What you can’t infer |
|---|---|---|
| Direct | The device connects to the remote service node over the public internet, without a separate relay entry point operated by the provider. | This doesn’t mean the connection avoids routers, nor does it guarantee a short route or fast access. |
| Relayed | The device first connects to a relay entry point, which forwards traffic through the relay network to the remote node or exit. | This doesn’t mean the cross-border leg uses a dedicated line or that it will necessarily outperform a direct connection. |
| IEPL dedicated line | An international Ethernet private line that may carry traffic between regions within a service network. | This doesn’t mean users get exclusive use of the entire bandwidth, or that the full path from device to destination website uses a dedicated line. |
Your experience also depends on your local network, entry connection, interregional transport, exit load, and destination website. Improving one part of the route won’t fix issues elsewhere. When reviewing route details, distinguish product descriptions from actual usage conditions; a route label is not a speed guarantee.
Protocol names: compatibility matters more than the label
A protocol is a set of communication rules shared by a client and server. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are commonly used as proxy protocols or related implementations; they are not all equivalent to traditional system-level VPN tunnels. A client displaying a protocol name doesn’t mean it supports every version or extension.
- Shadowsocks: An encrypted proxy protocol. The client and server need matching encryption methods and credentials; support for extensions may vary between implementations.
- VMess: A proxy protocol with authentication and encryption mechanisms. Configuration parameters must match, and an incorrect device clock may also interfere with authentication.
- Trojan: Typically protects traffic with TLS and authenticates with corresponding credentials. The server name and certificate verification must be configured correctly.
- VLESS: Does not provide transport encryption on its own. A connection’s security depends on supporting mechanisms and configuration, such as TLS or REALITY—not just the protocol name.
- Hysteria2 and TUIC: Both use QUIC for transport and rely on a working UDP path. Network restrictions on UDP may affect the connection; using either protocol does not inherently mean faster speeds.
Most users don’t need to assemble these parameters manually. Use a compatible configuration provided by the service and check the client version and protocol support. If you see a certificate error, verify the system clock, server name, and official configuration. Disabling certificate verification should not be a routine fix.
Split tunneling rules: global mode doesn’t take over every device connection
Routing rules decide whether a request goes direct, through a proxy, or gets blocked. Rules may match domains, destination IPs, processes, and other details; the client determines what it supports. “Rule mode” evaluates requests against the configured rules. “Global mode” usually sends requests handled by the client through the selected proxy policy.
The key is “handled by the client.” If only the system proxy is enabled, apps that ignore system proxy settings may still connect directly. So global mode in a client doesn’t necessarily mean that it takes over all traffic on your device.
TUN mode uses a virtual network interface to handle eligible IP traffic. It can usually cover more apps, but the actual scope still depends on routes, exclusion rules, system permissions, and implementation. It does not mean “no rules needed,” nor does it guarantee compatibility with other VPNs or security software running at the same time.
If a particular website won’t load, you can temporarily switch to global mode as a comparison. If it works globally but not in rule mode, check which rule and policy match the request instead of immediately assuming the node is down. Restore your usual mode after testing so local services that should connect directly don’t get routed through a remote exit.
DNS resolution and leaks: a working website doesn’t prove the route is correct
DNS translates domain names into IP addresses. Resolution may be handled by the operating system, browser, or proxy client, or configured to use a remote resolver. Routing a website connection through a proxy and routing DNS queries through it are separate things to check.
A DNS leak generally means that resolution requests didn’t follow the expected tunnel or proxy path and went to an unexpected resolver. Encrypted DNS only indicates that the relevant query path is encrypted. On its own, it doesn’t prove that DNS follows the proxy exit or replace routing rules.
A browser’s secure DNS, client DNS settings, and system settings may affect one another. If the exit location is correct but a website still detects the wrong region, consider account region, sign-in history, location permissions, and cached data. Not every location issue is caused by DNS.
From import to troubleshooting: check each step in the configuration
Windows, macOS, and Linux clients may offer system proxy and TUN options; on iOS and Android, proxy clients often route traffic through the system VPN interface. A VPN icon in the system status bar only shows that the interface is active—it doesn’t prove every app follows the expected routing rules.
- Get the client and configuration from your account panel. Use the client download page, check platform and compatibility details, then import your subscription. Don’t use account credentials with software from an untrusted source.
- Confirm the configuration updated. Check that nodes appear and that there are no authentication errors. If fetching the configuration fails, first check the URL and account status instead of repeatedly deleting and rebuilding all your settings.
- Select a node and enable traffic handling. Confirm which node the active policy group has selected and whether system proxy or TUN is enabled. Allow the network permissions the system requires.
- Check an actual request. Use the network check page to see the exit used by your current browser, then visit the website you need. A browser check does not show the route used by other apps.
- Change one setting at a time. Compare nodes first, then rule mode and global mode. If needed, check connection logs for the matching rule, DNS errors, or handshake errors. Hide sensitive configuration details before submitting a support ticket.
“Connected but can’t open websites” and “subscription won’t update” are different kinds of problems. For the first, check whether requests reach the client, how rules route them, and whether the exit can reach the destination. For the second, check the configuration download path and authentication. Repeatedly switching protocols won’t solve a problem that isn’t at the protocol layer.
- ✅ Confirmed node, protocol, and client compatibility—not just the node name.
- ✅ Distinguished the scope of system proxy, TUN handling, and global routing.
- ✅ Checked destination access, exit location, and DNS path separately.
- ❌ Don’t post subscription links, authentication credentials, or complete configurations on public pages.
When choosing a plan, separate technical settings from billing terms
Once you understand the terminology, check data limits, reset rules, and refund terms before purchasing. VPNMF supports Windows, macOS, iOS, Android, and Linux, with no limit on devices connected at the same time. This doesn’t mean data is unlimited; usage is still subject to your plan’s data allowance.
Monthly plans: ¥9.9/month for 60GB, ¥18/month for 250GB, and ¥28/month for 500GB. Data resets monthly on your activation date, not on a fixed calendar date; if you upgrade mid-cycle, the price difference is prorated for the remaining days. Data add-ons are used until depleted and never expire. These are two different billing models.
VPNMF’s account setup requires no email address, and its privacy policy is anonymous and no-logs. These statements don’t mean destination websites can’t identify you when you’re signed in. Refund terms: request a full refund for any reason within 14 days of your first payment. Compare the options on the plan pricing page.
Keep this troubleshooting order in mind: First check that the subscription is active, then confirm the client is handling traffic, and finally check rules, nodes, and DNS. The route affects the path, the protocol affects how communication works, and the plan determines your data allowance. Separating these layers helps you adjust the right setting for the problem instead of blindly replacing the entire configuration.