This VPN glossary for beginners starts with how the pieces fit together: a subscription provides configuration, a node is a connection endpoint, a route describes the network path, a protocol defines how communication works, and split tunneling determines which path each request takes. The client applies these settings. Understanding the flow is more useful than memorizing node names when importing a configuration, choosing a route, or troubleshooting.
Glossary: what each layer does
Buttons next to each other in a client may control different layers. A node connecting successfully does not mean an app is using the proxy; a subscription updating does not mean the plan still has data available. When something goes wrong, first work out whether the issue is with configuration, connectivity, or request routing.
| Term | What it does | Common point of confusion |
|---|---|---|
| Plan | Data allowance, billing, and usage benefits | Not a configuration file imported into a client |
| Subscription link | Lets the client fetch and update configuration | Not a regular web bookmark |
| Node | A set of server connection details | The region in its name may not be the connection location |
| Route | The network path traffic takes | A route type is not a proxy protocol |
| Protocol | Rules for communication between client and server | The protocol name alone doesn't tell you the speed |
| Routing rule | Determines whether a request connects directly, uses a proxy, or is blocked | Not the same as the currently selected node |
| Client | Reads configuration and establishes connections | Supported formats and traffic handling vary |
Subscription: billing and configuration links are different things
“Subscription” commonly has two meanings. On a plan page, a monthly subscription refers to billing; in a client, adding a subscription usually means adding a source for configuration. The first determines your usage benefits; the second tells the app where to connect and which settings to use. Successfully importing a configuration does not mean a plan has been activated, and deleting a subscription from your device does not cancel billing.
A subscription link usually contains access credentials. When a client requests the link, it retrieves a list of nodes; some configurations also include proxy groups and rules. The contents depend on the provider and import format. Updating a subscription fetches the configuration again—it does not update the client app or automatically change your plan's data allowance.
Get the link from your account page after signing in. VPNDream client downloads and subscription links are available after login; iOS downloads require an active plan. Clients may accept different subscription formats, so use the option covered by the relevant official guide. Don't paste the link into an unfamiliar online conversion site.
Treat your subscription link like a credential. Before sharing a screenshot, hide the full address, QR code, and token. If you suspect the link has been exposed, use the reset option in your account or contact support. After resetting it, replace the old link saved on each device.
Nodes and routes: entry points, exits, and the path between them
A node typically includes a server address, port, protocol, and authentication details. Selecting a node means choosing a set of connection parameters. Its display name helps identify it, but does not show the full network topology. An exit in a particular region does not mean your device reaches it without passing through other networks.
A direct connection usually means the client connects to the destination proxy server without an additional relay entry point provided by the service; traffic still travels through your internet provider's network. With a relay, traffic first reaches an access server and is then forwarded to the exit. An extra leg may improve routing or add load, so more hops do not automatically mean faster connections.
IEPL stands for Ethernet Private Line. In subscription route descriptions, it usually means that a segment of the backbone transmission uses a private line. This describes part of the transport path; it does not mean every leg between your device and the destination website uses a private line, nor does it guarantee a fixed response time. Your local connection, exit load, and the destination service's status still affect performance.
Start by filtering for an exit region that suits the service you want to use, then compare connection stability during the times you actually use it. Node regions, route labels, and protocol names are useful clues, but they can't replace testing with the apps you use.
Protocols: compatibility matters more than the name
VPN is a common product category, but subscription clients don't necessarily use native VPN protocols built into the operating system. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are common proxy technologies or protocol names. A VPN icon in a client does not make them the same technology.
Shadowsocks is an encrypted proxy protocol; VMess includes authentication and encryption mechanisms; Trojan typically uses TLS to protect traffic. VLESS does not encrypt content on its own and needs an appropriate secure transport setup, such as TLS. Hysteria2 and TUIC are based on QUIC, so how the network handles UDP can affect their connection performance.
These differences don't create a fixed speed ranking. Client and server implementations, network restrictions, and route quality all affect results. A client supporting a protocol does not necessarily mean it supports every transport combination for that protocol. If an import fails with an “unsupported” message, first check the client version, configuration format, and official compatibility notes. Don't remove security-related fields without a clear reason.
This is a general technical overview, not a list of protocols supported by VPNDream. Check the configuration and client documentation in your account for currently available options. This glossary is not a promise of service capabilities.
Split tunneling: rule-based and global modes
Split tunneling determines the path a request takes when it is sent. Rules can match domains, destination addresses, or other supported conditions, then route traffic directly, through a proxy group, or block it. Rules usually follow a matching order: a broad rule placed first may prevent more specific rules later on from taking effect.
Rule-based mode evaluates requests against the configuration, which can send local and international services along different paths. Global mode typically sends traffic handled by the client through the selected proxy group, while direct mode typically lets intercepted requests connect directly. The precise behavior varies by client, so check its documentation.
The key is whether traffic is actually being intercepted. The system proxy relies on apps honoring the proxy settings, and some apps may bypass them. TUN mode intercepts more traffic through a virtual network interface, but its scope still depends on routing, permissions, and configuration. Global mode therefore doesn't guarantee that all device traffic goes through the proxy, and TUN is not a faster proxy protocol.
- ✅ For everyday use, start with the rule configuration provided by the service and make sure local services and the apps you need are accessible.
- ✅ When troubleshooting an app, temporarily compare rule-based and global modes to see whether changing the policy affects the issue.
- ✅ Check the client's connection logs for the matched rule and actual exit instead of relying only on the selected-node button.
- ❌ Don't assume that changing nodes means an app is now using the proxy; it may still be connecting directly.
DNS and privacy: the resolution path is part of your configuration
DNS translates domain names into addresses. Requests made to resolve a domain before visiting a website may be handled by the operating system, the client, or the app's own resolver. Routing app traffic through a proxy does not automatically send DNS requests along the same path. A browser using its own encrypted DNS may also behave differently from the client configuration.
A DNS leak generally means resolution requests have left the intended protected path. This may allow a resolver on the local network to learn which domains were queried, but it does not mean that the resolver can read the contents of HTTPS pages. To troubleshoot, check DNS settings in the client and app, along with connection logs, rather than relying on a single result from a DNS test page.
Encryption has limits, too. VPNDream uses “military-grade encryption” as its primary security message, but that doesn't make malicious sites, phishing pages, or exposed subscription credentials safe. Protecting account credentials, updating your operating system, and checking website certificates remain separate security practices.
Client setup: check each step in order
Client interfaces and system permissions differ across Windows, macOS, iOS, Android, and Linux, but the same basic workflow applies: confirm your account benefits and configuration source, import the settings, then verify that apps are using the expected route. Avoid changing rules and protocols at the same time, or it will be hard to tell which change made a difference.
- Find the right download. Sign in to your account and follow the setup guide to get a compatible client. Check the platform and configuration format, and don't install attachments from unknown sources.
- Import the configuration. Copy the subscription link from your account and use the client's subscription import option. After importing, check that the list contains entries. If you see a format error, make sure you didn't copy the sign-in page address.
- Choose a policy. Update the subscription and select the exit and mode you need. If the configuration uses an automatic proxy group, manually selecting a different node may not change the group's actual selection.
- Grant the required permissions. Enable the system proxy or traffic interception feature as described in the official guide. Mobile operating systems may ask you to authorize a VPN configuration, while desktop systems may require appropriate permissions.
- Test your apps. Open the website or collaboration tool you actually need, then check the client logs to confirm which rule matched. Once testing is complete, keep the working configuration and avoid running conflicting proxy tools at the same time.
Troubleshooting: narrow down the cause based on what you see
Subscription won't update: First check your internet connection, that the link is complete, and your account status. Then confirm that the client supports the format. An expired link, a temporarily unreachable server, and an incompatible format are different problems; repeatedly clicking update won't tell you which one you have.
A node passes the latency test, but websites won't load: A latency test may only check one part of the connection; it doesn't confirm that DNS resolution, web requests, or media transfers are working. Check DNS, routing rules, and whether the app's traffic is being intercepted, then compare with another working node.
Websites load, but calls still stutter: Web browsing and real-time calls have different traffic patterns. Check your local Wi-Fi, background transfers, packet loss, and route stability. Don't judge a call route only by its peak download speed. For further troubleshooting, see the Help Center.
Configuration comes from the subscription; a node establishes the connection; traffic travels along a route; communication follows a protocol; and split tunneling determines where requests go. Troubleshoot each link in that order, changing one setting at a time. This is usually easier than changing everything at once.