If you’re new to VPNs, start by distinguishing subscriptions, nodes, route types, protocols, and routing modes. They refer to configuration sources, connection endpoints, network paths, communication methods, and where traffic goes—not the same thing. When something won’t connect, identifying which layer is at fault is more useful than cycling through nodes.
What do the terms in your client control?
People often use “VPN client” as a catch-all for proxy clients and VPN apps, but the underlying technology differs. A traditional VPN usually creates a network-layer tunnel, while a proxy may handle traffic only from selected apps. A proxy client can cover more programs when it uses a virtual network interface, but that does not make it equivalent to a traditional VPN or mean it uses the same protocols.
| Term | What it means | What to check |
|---|---|---|
| Subscription link | An address used to retrieve nodes or configuration | Is the source trustworthy, and is the format compatible? |
| Node | A connection profile available in the client | Exit location, protocol, and connection result |
| Route type | How traffic is routed between servers or from the user to the exit | What “direct,” “relay,” or “dedicated line” means in practice |
| Protocol | The rules for communication between the client and server | Whether the client’s core supports the configuration |
| Routing rules | Conditions that determine whether a request goes direct, through a proxy, or is blocked | Rule order and which rule ultimately matches |
Subscription links and nodes: how configuration gets into your client
A plan subscription is a billing arrangement; a subscription in a client usually distributes configuration. The URL may return a list of nodes or a complete configuration with rules, policy groups, and DNS settings. Don’t treat them as interchangeable just because both use a link: a client that can read one node format may not be able to load another client’s full configuration file.
A node doesn’t necessarily represent a dedicated physical server. It may be a combination of an entry point, an exit, and protocol settings. The location shown in a list usually indicates the exit location, but naming conventions vary by provider and don’t reveal the entire route. Different node names may also share some infrastructure.
Updating a subscription syncs configuration changes; it doesn’t renew your plan and may not change the selected node. Before updating, check whether the client will overwrite local edits. If you need custom rules, use the client’s override feature where available so an update won’t replace them.
IEPL dedicated lines, relays, and direct connections: it’s all about the route
Direct connection: The client usually connects straight to a server outside your country, with no additional relay arranged by the provider. Traffic still travels over carrier networks and international links—it doesn’t mean there are “no routers in between.” The route may be easier to understand, but performance depends on your local access network, carrier routing, and the destination network.
Relay: A provider-arranged forwarding step sits between you and the exit. You connect to an entry point, which forwards traffic to the exit. A well-chosen relay can improve routing on some networks, but adds another component to maintain. A relay is not the same as a dedicated line and does not automatically mean lower latency.
IEPL dedicated line: IEPL stands for International Ethernet Private Line. A service may use one for the segment between an entry point and an exit outside your country; the connection from you to the entry point may still use the public internet. So “uses IEPL” does not mean the entire route from your device to a website is dedicated, nor does it imply a dedicated IP address.
Route type and protocol are separate dimensions: the same protocol can work over different routes. First check whether you can reach the destination in your target region, then test performance on your usual network and at the times you typically connect. If the route isn’t clearly described, don’t judge it by “dedicated line” in a node name alone.
Common protocols: compatibility matters more than the name
A protocol defines how a client and server exchange data. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are different proxy protocols; their names alone don’t establish a universal speed ranking. Server implementation, transport settings, and current network conditions all affect performance.
- Shadowsocks: An encrypted proxy protocol. The client must support the specific encryption method used in the configuration. Support for Shadowsocks doesn’t mean support for every method or extension.
- VMess: A proxy protocol with authentication and encryption mechanisms that can use different transports. The client and server transport settings must match.
- Trojan: Typically uses TLS for transport. Certificate validation and server name settings affect the connection; disabling certificate checks shouldn’t be treated as a routine fix.
- VLESS: The protocol itself does not encrypt data and is typically used with a security layer such as TLS or REALITY. The VLESS label alone isn’t enough—check the full transport configuration.
- Hysteria2 and TUIC: QUIC-based proxy protocols that rely on UDP. If the network restricts UDP, connections may fail or become unstable.
These are explanations of protocol terms, not a list of protocols offered by VPNAdd. Check the account panel and client documentation for what’s actually available. If an import fails, first check the client version, core support, and subscription format rather than editing protocol names in the URL at random.
Global, rules, and virtual network interfaces: know the difference
“Global” usually describes a routing decision: send all traffic handled by the client through the selected proxy exit. “Rules” route traffic based on conditions such as domain, destination IP, process, or other criteria. Rules are often evaluated in order, so an earlier match may prevent later rules from running. Exact behavior depends on the client.
“System proxy” and “TUN virtual network interface” describe how much traffic the client can handle. A system proxy provides proxy settings to apps, but some apps ignore them. TUN receives traffic routed through a virtual interface at the network layer and usually requires the appropriate system permissions. Even in global mode, apps outside the client’s scope may still connect directly.
For everyday use, start with the provider’s recommended rule configuration so local resources and requests that need international routes can take suitable paths. If a site has problems, temporarily switch to global mode for comparison, then check the rule-match log. If global mode works but rules don’t, routing rules or DNS settings may need investigation, but that alone doesn’t prove the cause.
Desktop apps on Windows and macOS vary in how they follow system proxy settings; mobile apps often route traffic through the system VPN interface. On Linux, also account for differences between desktop proxy settings and the environment used by command-line programs. Don’t assume a toggle with the same name works the same way across platforms.
First import and test: troubleshoot in order
- Get a client. Download a client that matches your operating system from a trusted source, and confirm it supports the configuration format provided by the service. VPNAdd users can get a client from the account panel. See the getting started guide for setup instructions.
- Import your subscription. Copy the subscription URL from the account panel and add it through the client’s subscription screen. If you use one-click import, make sure the correct app opens. Don’t paste the URL into a search engine.
- Check the configuration. Make sure the node list appears, select a target location, and grant network permissions if prompted. Start with the default rules, and avoid running multiple clients that take over network traffic at the same time.
- Check your exit IP. After connecting, open My IP to check the exit used by your browser request. IP geolocation databases can disagree, and a change in exit only confirms that the tested request took a different route.
- Test the apps you use. Check your browser and the target app separately. If the browser works but the app doesn’t, first check which traffic the client handles. If neither works, check your local network, node, and subscription status.
- Keep troubleshooting details. Note your operating system, client, node name, mode, and error message. Hide subscription tokens and account details before sharing logs. If needed, submit a support ticket through the account panel.
DNS leaks and traffic: common misconceptions
DNS translates domain names into IP addresses. If a connection to a destination goes through a proxy but its DNS query follows an unexpected local route, the query may be visible to the resolver on that route. Whether this counts as a leak depends on your intended policy. In rule-based mode, using local DNS for local domains is not automatically a misconfiguration.
Your browser’s encrypted DNS, system resolver, and client DNS settings may all be active at once. When troubleshooting, check client logs and the actual query path; don’t rely only on the resolver name shown by a test page. Encrypted DNS protects queries in transit to the resolver, but it doesn’t automatically route app connections through a proxy. Include IPv6 in your routing and rule checks.
- ✅ Check your exit IP, DNS route, and which apps the client handles separately. A browser test alone can’t verify the whole device.
- ✅ Monthly plan data resets each month on your activation date, not at the start of the calendar month.
- ✅ VPNAdd data packs don’t expire; they’re used until depleted. Compare them with a monthly plan based on your usage.
- ❌ Unlimited simultaneous connections don’t mean unlimited data. Connection limits and data allowances are different things.
- ❌ Encrypted traffic doesn’t make you anonymous. Website logins, browser identifiers, and payment records each have their own data boundaries.
To compare billing options, see the full plan details. No email address is required, which means you share less information when opening an account, but it’s still worth reviewing the privacy policy. “Bank-grade encryption” describes protection for data in transit; it doesn’t mean your device, destination websites, and account activity receive the same protection automatically.
Subscriptions distribute configuration, nodes offer connection choices, route types describe the path, protocols define how data is exchanged, and routing rules determine where requests go. Start by importing a trusted subscription into a compatible client, then check your exit and the apps you use. If something goes wrong, investigate traffic coverage, rules, DNS, and nodes one by one instead of repeatedly changing every setting.