VPN Terms for Beginners: Subscriptions, Nodes, Routes, Protocols & Traffic Rules

Here’s the short version of this VPN glossary for beginners: a subscription provides configuration, a node determines the connection’s entry and exit points, a route describes the path data takes, a protocol defines how it’s transmitted, and traffic rules determine which requests use the proxy. These are separate layers; no single term tells you everything about a service’s performance.

What people call a “VPN client” may actually run an application proxy or use TUN to capture traffic. A connected status only means that one part of the connection has been established; it doesn’t mean every app is using the same exit point. Start with the terms below, then follow the setup guide to troubleshoot more effectively.

Subscriptions, Nodes, and Clients: From Configuration to Connection

A subscription service is an account benefit; a subscription link is the address a client uses to retrieve nodes and related configuration. Both are often shortened to “subscription,” but one refers to a plan and the other to configuration delivery. Updating a subscription only retrieves the latest data—it doesn’t renew your plan or automatically add traffic.

A node is a connection configuration you can select in a client. It typically includes a server address, port, authentication details, and protocol settings. The region shown in a node’s name usually refers to its exit location; it doesn’t mean your device connects directly to that location, nor does it reveal the networks used along the way. Different nodes may also share some infrastructure.

A client reads configuration, establishes connections, and applies traffic rules; its core handles the protocols and network operations. Updating an app’s core may change what it supports. And even if two apps have similar controls, they may not accept the same subscription format.

IEPL Lines, Relays, and Direct Connections: Routes vs. Protocols

In a node description, direct usually means your device connects to a remote server over the public internet without an additional relay entry point set up by the service. The route depends on the actual paths between your local provider, international gateways, and the remote network. This is different from a “direct connection” in traffic rules, which means accessing a website without using a proxy.

With a relay, your device typically connects to an entry point first, which then forwards traffic to the exit. An entry point may improve the connection route, but it adds another forwarding step. A relay alone guarantees neither speed nor whether the connection uses the public internet or dedicated infrastructure.

IEPL usually refers to an international Ethernet private line. It’s a network transport service, not a client protocol. When a node is labeled IEPL, it generally describes a segment of the route that uses dedicated infrastructure—not an end-to-end private line from your device to the destination website. Your local connection, the route from the exit to the website, and your device’s network can all affect performance.

So, neither “a dedicated line always means lower latency” nor “a direct connection is always faster” is a reliable assumption. Compare routes on the same network, at similar times, and to the same destination. Check page response, sustained transfers, and dropped connections. A single latency test doesn’t tell the whole story.

Shadowsocks, VMess, Trojan, and Other Protocols

A protocol defines how the client and server authenticate, encapsulate, and transmit data. It’s independent of the route: the same protocol can run over different routes, and changing protocols won’t automatically change the exit region. If an import fails, first check whether your client supports the protocol and its settings rather than assuming the route is unavailable.

• Shadowsocks: A widely used family of encrypted proxy protocols. The client and server need to match on the encryption method, authentication details, and any extensions; matching names alone don’t guarantee compatibility.
• VMess: A proxy protocol with its own authentication and encryption mechanisms. Configurations may use different transport methods, and mismatched transport settings can prevent a connection.
• Trojan: Typically establishes proxy connections over TLS. Certificate validation, the server name, and authentication details can all affect the connection. Disabling certificate validation isn’t a routine fix.
• VLESS: A lightweight proxy protocol that doesn’t provide transport encryption on its own. It should be understood alongside secure transport mechanisms such as TLS or REALITY and their respective settings.
• Hysteria2 and TUIC: Proxy solutions based on QUIC that rely on UDP. Restrictions on UDP in some networks may affect performance, but that doesn’t mean these protocols are faster on every network.

Protocol encryption isn’t the same as end-to-end HTTPS between you and a website, and it doesn’t guarantee privacy. Using a connection service involves trust boundaries; website accounts, browser state, and other apps on your device also matter. If you’re new to this, use the matching configuration provided in your dashboard and avoid changing certificate, authentication, or transport settings without a reason.

Global Mode, Rule Mode, and TUN: Which Requests Use the Proxy?

Rule mode directs requests based on domains, destination addresses, processes, or other conditions. A common setup sends some websites directly and others through a proxy, but the result depends on the rules, their order, and the default action when nothing matches. Rule mode doesn’t mean the client automatically knows which route every website needs.

Global mode usually sends traffic already captured by the client to the selected proxy or policy group. The key phrase is “already captured”: if an app doesn’t use the system proxy or its traffic isn’t covered by the client, switching to global mode may not change its route.

A system proxy provides proxy settings to the operating system or apps; whether they follow those settings depends on how each app is built. TUN mode uses a virtual network interface to capture IP traffic and pass it to the client. It often requires additional permissions and may conflict with other VPNs, corporate networks, or security software. It also doesn’t automatically fix every DNS issue.

A policy group organizes nodes and selection methods, such as manual selection or choosing based on test results. Automatic selection depends on the test target and client implementation, and doesn’t guarantee the best performance for a particular service. If a specific website behaves unexpectedly, check which rule matched and which exit was actually used before changing the policy.

DNS Leaks, Exit IPs, and Latency: What to Check

DNS translates domain names into addresses. The browser, operating system, and proxy client may all handle DNS, so routing a webpage through a proxy doesn’t automatically mean its DNS requests follow the intended route. A DNS leak usually means requests went to an unexpected resolver or took an unintended network path. Before drawing conclusions, clarify how you want DNS traffic routed.

A test page showing a local resolver doesn’t necessarily prove that all traffic bypassed the proxy; seeing a remote resolver doesn’t prove every app is being captured, either. Encrypted DNS settings in the browser, cached results, and the client’s DNS policy can all affect the outcome. Interpret the results in light of your actual configuration.

An exit IP is the source address a destination website sees. Use the IP lookup page to check your current browser exit and compare it with the selected node. This only shows the exit for that request; other apps, protocols, or traffic may use a different route.

Latency is the time taken for a particular round-trip test; bandwidth describes data-carrying capacity; and throughput depends on your device, route, server, and destination website. If the client can test latency but a site won’t open, the cause may be DNS, rules, authentication, or restrictions at the destination. Repeated speed tests alone won’t identify the problem.

From Dashboard to Connection: A Beginner’s Checklist

Start with the setup guides to find the instructions for your platform and client, then retrieve your subscription. VPNRD’s client downloads are available in the dashboard after you log in. On platforms other than iOS, you can log in to download a client; on iOS, access is handled according to the dashboard’s active-plan rules. Don’t use installers from unverified sources instead of following the dashboard instructions.

1. Check client compatibility. Confirm that your operating system, client, and core support the protocols and subscription format provided in the dashboard. System proxy settings on Windows and macOS work differently from VPN permission flows on iOS and Android. On Linux, also check permissions and routing configuration.
2. Retrieve and import your subscription. Use the dashboard option for your client. If it opens the app, follow the prompts; otherwise, copy the link into the client’s subscription or configuration manager. Don’t paste it into a field meant for a single node.
3. Update and check the result. Make sure nodes appear in the client and that there are no parsing errors. If the update fails, check that the link is complete, your system clock is correct, and your current network can reach the subscription address.
4. Select a node and grant permissions. Follow the guide to enable the system proxy or required traffic-capture mode, and review any system permission prompts. Avoid running multiple proxies or VPNs at the same time during testing so you can identify the route actually in use.
5. Test the service you need. Check your browser’s exit, then open the website or app you actually want to use. If only certain destinations have problems, check the matching rule, DNS, and the app’s own proxy settings.

• ✅ If nodes appear in the list, the subscription was read—but you still need to test the connection.
• ✅ Check the browser and target apps separately; a browser result can’t confirm how the whole device is routed.
• ✅ When contacting support, include your operating system, client, error message, and what you were doing. Hide your subscription link and authentication details.
• ❌ Don’t try to solve the problem by disabling certificate checks, sharing your subscription link publicly, or repeatedly reinstalling the client.

Plan Allowances and Configuration Updates: Know the Service Terms

“Updating nodes” and “resetting traffic” are unrelated. VPNRD monthly plan traffic resets on the activation date each month; data add-ons remain valid indefinitely, even after they’re used up. When checking plan prices, distinguish the billing period from the traffic validity rules. A data add-on isn’t a fixed monthly allowance.

Unlimited simultaneous connections describe the device connection policy; they don’t mean each device gets its own data allowance or dedicated bandwidth. Being able to import a configuration doesn’t guarantee that your account benefits are active. If you have connection issues, check your dashboard status and, if needed, contact support through the support page.