This VPN glossary for beginners puts subscriptions, nodes, protocols, and routing in context: a subscription provides configuration, a node is a connection endpoint, a protocol defines how data is transmitted, and rules determine which route each request takes. Global and rule modes are different ways for a client to handle traffic—not plan tiers.
Think of a client as a routing hub: get a route map, choose an entry point, then send traffic based on its destination. If a site won’t load, identifying where the connection is failing is more useful than repeatedly toggling settings. The protocol and route descriptions below are general information; they don’t mean VPNPZ currently offers every type. Check the control panel for the actual configuration.
What do subscriptions, nodes, and protocols do?
These terms often appear on the same screen, but refer to different layers. “Update subscription” refreshes the configuration; “switch node” changes the connection endpoint; “rule mode” changes how requests are routed.
| Term | What it does | What it doesn’t mean |
|---|---|---|
| Subscription link | Lets the client retrieve routes and related configuration | A website address you can open in a browser |
| Node | A selectable connection configuration | A dedicated physical server in every case |
| Protocol | Defines how the client and server communicate | A ranking of route quality |
| Route type | Describes the network path taken by traffic | A guarantee that a particular app will work |
| Routing rule | Routes requests based on criteria such as domains or addresses | Simply switching nodes by country name |
| Egress | The network address seen by the destination website | Always the same as the client’s connection location |
How to get, import, and update a subscription link
A plan subscription is a billing arrangement; a client subscription is a way to distribute configuration. The terms sound alike but mean different things. Even a data pack may use a subscription link to retrieve configuration. The link usually contains access credentials. When the client requests it, it receives a node list; whether it also includes rules, proxy groups, and DNS settings depends on the configuration format.
Follow the current platform instructions when getting a subscription or client from the VPNPZ control panel. Before importing, check that the client supports the relevant format, and don’t enter a configuration URL as if it were a regular node address. Updating a subscription fetches the latest configuration; it usually doesn’t reset data usage or extend a plan’s validity.
- Sign in to the control panel and check which configuration options are available for your account. Get the client from the download page. For iOS, available options depend on your account status in the panel.
- In the client, choose the subscription or configuration import option, then paste the full link from the control panel or use its import option.
- Update the configuration, check that the list isn’t empty, then select a node or proxy group and connect.
- After a route change, update manually. Automatic update intervals depend on the client; there’s no single interval that applies to all apps.
A node, entry point, and exit point are different things
A node usually includes a server address, port, authentication details, and protocol settings. The city shown in the app can help you choose, but the name alone doesn’t confirm the actual route your traffic takes. A relayed setup may connect through a nearby entry point, then reach websites from an exit in the destination region.
So a node showing as connected doesn’t mean every website will load. A connection test may only check the route to its test destination. The website you want to reach may also check the exit address, account region, content rights, or its own security systems. Test results can help with comparisons, but they can’t replace trying the actual stream, download, or work task.
A proxy group is a shortlist of possible routes. With a manual group, you choose a node; an automatic group picks one based on its configured checks. A failover group also depends on its detection criteria. A group named “Auto” doesn’t necessarily know which node works best for a particular app.
How to read protocol names
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are common proxy protocol names. They aren’t interchangeable with traditional VPN tunneling protocols. However, proxy clients can route traffic through a system VPN interface or virtual network adapter, which is why your device may display a VPN indicator.
Shadowsocks uses an agreed encryption method and authentication details. VMess and VLESS require compatible implementations; VLESS doesn’t encrypt content by itself, so it needs an appropriate secure transport configuration. Trojan typically runs over TLS, and certificate checks shouldn’t be skipped. Hysteria2 and TUIC use QUIC over UDP, so network restrictions on UDP may affect the connection.
Protocols can also use different transport methods. The same protocol name doesn’t mean every setting is compatible; client core versions, transport support, and certificate settings all matter. If you’re new to this, use a compatible client and complete configuration recommended by the control panel. Don’t delete or change settings you don’t understand just to use a particular protocol name.
What’s the difference between direct, relayed, and dedicated routes?
In route descriptions, “direct” usually means the device connects to an overseas server through the public internet. A “relay” adds a forwarding point between the device and the overseas exit. A “dedicated route” describes the use of dedicated transmission resources along part of the path. These terms describe routing; protocols are a separate aspect of the connection.
IEPL is an Ethernet private line service, generally referring to a dedicated connection between locations. A provider labeling a route IEPL doesn’t mean the entire path—from your device to the entry point and from the exit to the destination website—is dedicated, or that bandwidth is exclusive. Check the route details to see which part is covered.
A direct route is simpler, but depends more on routing between your local network and the overseas server. A relay may improve the entry path but adds another hop. A dedicated segment can change some transmission conditions, but shared resources, the exit, and the destination site can still affect performance. Don’t judge a route by its label alone. See the routes page and control panel for VPNPZ’s actual nodes and route types.
When to use global mode or rule mode
Rule mode routes requests based on conditions—for example, direct connections for local sites, proxy routing for selected international sites, or blocking certain requests. Common matching criteria include domains, IP ranges, and processes, though support varies by client. Rules usually run in order, so a broad rule earlier in the list can override a more specific one later on.
Global mode generally sends requests already handled by the client through the selected policy. The key is “already handled”: apps that don’t use the system proxy, or traffic not captured by a virtual network adapter, may still use the original network. Global mode therefore doesn’t mean all communication from your device will necessarily use the same exit.
A system proxy tells compatible apps to use a proxy address. TUN mode captures network traffic through a virtual network adapter and can cover more traffic, but is still affected by routing, permissions, exclusions, and DNS settings. A VPN permission prompt on a phone means the system allows the client to create the relevant network interface; it doesn’t certify the level of privacy.
If a site won’t load in rule mode but works after temporarily switching to global mode, check rule matching, proxy groups, and DNS before assuming the node is faulty. Once you find the cause, restore a configuration suited to everyday use to avoid routing local traffic through an international exit unnecessarily.
DNS, leaks, and the limits of anonymous no-logs claims
DNS translates domain names into network addresses. Your browser, operating system, and client may all handle DNS. If DNS requests don’t take the expected route, the resolver on your original network may see the domains you look up—a situation commonly called a DNS leak. That doesn’t mean the contents of web pages are directly exposed, but it’s still worth checking.
When testing, first review the client’s DNS routing settings, then check whether encrypted DNS in your browser works independently of the client. A test page showing a resolver in your region or elsewhere doesn’t, by itself, prove whether there’s a leak. Compare the expected configuration, who operates the resolver, and the actual request path. Address protocol versions and per-app exclusions can also cause some requests to take a different route.
VPNPZ’s stated privacy policy is anonymous, no-logs service. This policy statement doesn’t mean a website can’t see your login account, browser identifiers, or exit address, and it won’t remove history stored on your device. HTTPS protects data in transit between your browser and the destination website; a route service can’t replace secure website connections or account protection.
Check client settings by symptom
Windows, macOS, and Linux clients may offer a system proxy, virtual network adapter, and different permission options. iOS and Android more commonly use the system VPN interface. Button names, core features, and background restrictions vary by client, so don’t assume every setting works the same way across platforms.
First note whether all websites fail or only one app. Then check configuration, connection, routing, and the destination site in that order. Change one setting at a time so you can tell what made a difference. This checklist is useful after your first import or when a route suddenly stops working.
- ✅ The list is empty or updates fail: Check that the subscription link is complete, your account is active, and your current network can reach the configuration URL.
- ✅ No nodes connect: Check your local network, system time, and client compatibility, then look for protocol or transport support issues.
- ✅ The browser works but an app doesn’t: Check whether the app follows the system proxy or is bypassing it through a virtual network adapter exclusion rule.
- ✅ Only some domains fail: Check rule matching and DNS resolution, then compare briefly with global mode. Don’t clear the entire configuration right away.
- ✅ A website loads but content is restricted: Check the exit region, account requirements, and platform rights. Changing routes doesn’t guarantee that regional restrictions will be lifted.
- ✅ Need help from support: Include your operating system, client version, error message, and steps to reproduce the issue. Hide passwords, tokens, and subscription links.
Here’s the basic sequence: get the configuration from the control panel, let the client load the nodes, connect using a compatible protocol, then route requests with rules. For platform-specific instructions, see the Guides. For account or current route issues, contact support through a control panel ticket. Terms are just signposts; judge whether a configuration works by the actual results.