Here’s the key relationship to remember: a subscription provides configuration, a node carries the connection, a protocol defines how data is exchanged, routing rules determine where requests go, and global mode changes the routing choice. These are different layers, so switching protocols isn’t a substitute for troubleshooting everything.
What people call a VPN client may actually be a proxy client. A traditional VPN typically creates a network-layer tunnel, while proxy tools may handle connections through the system proxy or a virtual network interface. Both may show “Connected,” but they don’t necessarily handle the same traffic. The terms below can help you work out whether a request entered the client—and which route it took.
How Subscriptions, Nodes & Clients Fit Together
A subscription link is usually an address used to retrieve configuration. The client fetches node details from the service; some subscriptions also include groups, rules or DNS settings, depending on the format. It’s not a regular website URL or an installer. Pasting it into a browser may display encoded text or configuration data.
A node is a server configuration that can be used to connect. It often includes an address, port, authentication details and protocol parameters. The region shown for a node is usually a hint about its exit location, but the name alone can’t verify the actual route, exit location or whether a site will work. The client reads the configuration, connects and applies local settings. Server support for a protocol doesn’t mean every client can import it.
| Term | What it does | Common misconception |
|---|---|---|
| Subscription link | Fetches and updates nodes or a complete configuration | It’s a client download link |
| Node | Specifies which server to connect to and how to authenticate | The node name tells you how fast it is |
| Protocol | Defines how the client and server communicate | A newer protocol name always means faster speeds |
| Route type | Describes how the entry point, transit segment and exit are arranged | A dedicated-route label guarantees end-to-end performance |
| Policy group | A set of exits that rules can select manually or automatically | Every request uses the same node after import |
What Protocol Names Tell You
Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC may all appear in proxy configurations. Protocols affect compatibility, authentication, encryption or transport, but speed also depends on your local network, server load, route congestion and specific settings. A protocol name alone can’t provide a reliable ranking of node performance.
- Shadowsocks: An encrypted proxy protocol. The client and server need compatible encryption methods and credentials. Supported features may vary between implementations and versions.
- VMess: A proxy protocol with authentication and encryption mechanisms. It can be paired with different transport settings and shouldn’t be mistaken for a particular route type.
- Trojan: Proxy traffic is usually carried over a TLS connection. The certificate, server name and authentication settings must match. Don’t disable certificate verification just to clear an error.
- VLESS: A lightweight proxy protocol that doesn’t provide transport encryption on its own. Security depends on the TLS, REALITY or other mechanisms used with it, and on correct configuration.
- Hysteria2 and TUIC: Both are based on QUIC and rely on UDP network paths. If UDP is restricted, connections may fail or become unstable; that alone doesn’t mean the account is invalid.
When choosing a client, check more than the name: confirm the core version, subscription format and additional transport parameters. A successful import only means the configuration was accepted—not that every field is working as expected. If a protocol isn’t supported, check the official compatibility notes before removing unfamiliar settings by hand.
IEPL Dedicated Routes, Relays & Direct Connections
A direct connection usually means the client connects to an overseas server directly over the public internet. A relay adds an entry point or forwarding node along the route before traffic reaches its exit. IEPL refers to an international Ethernet private line; in subscription services, the term often describes one segment of the transport path. These terms describe route design, not proxy protocols.
A node can therefore use the Trojan protocol over a relay route, or use another protocol over a dedicated line. Protocols and route types aren’t mutually exclusive. Even on a route labeled IEPL, traffic between you and the entry point, or between the exit and the destination site, may still use the public internet. The label doesn’t mean the entire connection uses a dedicated line.
When choosing a route, first check the destination region and your use case, then see whether the service you need works reliably during your usual hours. A latency test only measures the round trip for a particular probe. Throughput, sustained packet loss, site authentication and exit IP reputation are separate factors. If a site won’t open, regional policies or risk controls may be responsible; the route may still be connected. Check VPN94’s specific routes on the server page and in the control panel. Don’t assume a label guarantees access to a particular site.
Choosing Between Rule-Based & Global Mode
Split tunneling routes requests according to conditions. Common rules can match domains, destination IPs, geographic databases or processes, then send traffic direct, to a proxy policy group or to a block action. Rules are usually evaluated in order, so an earlier match may take precedence over later ones. Any connection that doesn’t match is handled by the fallback rule.
Rule-based mode works well for everyday use: send requests that need international routes through the proxy and connect to local services directly, according to the configuration. But “rule-based” doesn’t mean every site in mainland China goes direct. The actual behavior depends on the rules, DNS resolution and the client’s support for matching conditions. To troubleshoot, check the matched rule and actual exit in the connection details.
Global mode usually sends requests already handled by the client through the selected proxy policy. It doesn’t automatically route every app on the system through the proxy. With only the system proxy enabled, apps that ignore that setting may still connect directly. TUN mode handles more traffic through a virtual network interface, but routing, exclusions, permissions and platform-specific implementation still apply.
Use rule-based mode by default; switch to global mode temporarily to troubleshoot routing. If a site fails in rule-based mode but works in global mode, check the matched rules and DNS next. That’s a useful troubleshooting clue, not definitive proof of the cause. If both modes fail, also check the node, traffic capture settings and the destination service’s status.
Importing a Subscription & Testing the Connection
Interface labels vary by platform, but the basic steps are much the same. Avoid running multiple proxy or VPN tools at once, as they may conflict over system routes, virtual network interfaces and DNS settings. You don’t need to share any subscription credentials to follow these steps.
- Get the client instructions from the control panel. Sign in to access your subscription, then choose a client from the service’s compatibility list. VPN94’s download link is in the control panel; check the panel for iOS access requirements.
- Copy the subscription link for the right format. Tell a full-configuration subscription apart from a single-node share link. Paste the link into the client’s subscription or remote-configuration field—not a website URL or single-node address field.
- Update and enable the configuration. Make sure the node list appears, then select a configuration or policy group. If the update fails, first check whether your current network can reach the subscription URL and whether your account and subscription are active.
- Grant permissions when prompted by your platform. Allow the system proxy, network extension or virtual network interface to run. The client can only handle the relevant traffic once the operating system grants permission.
- Select a node and test the service you need. Keep the mode and other settings unchanged; change only the node. Check the matched rule and exit in the connection log so you don’t change several variables at once.
- Check the exit and the apps you use. Use IP lookup to check your current browser exit, then test the app you actually need. A correct browser exit doesn’t mean other apps are being handled too.
On Windows, the system proxy and TUN are separate ways to route traffic; macOS may require approval for a network extension. Android often handles traffic through the system VPN interface and may allow per-app exclusions. On iOS, traffic handling and background behavior depend on both the operating system and the client. On Linux, check whether desktop proxy settings apply to terminal programs. Follow the client documentation for platform-specific details rather than copying switches from a screenshot.
DNS Leaks & Privacy Boundaries
DNS translates domain names into addresses. Routing a website connection through a proxy doesn’t mean its DNS queries take the same route. If a domain lookup that should be handled on the proxy side is still sent to a resolver specified by the local network, it may expose query information or return a result unsuitable for the current exit. This is commonly called a DNS leak.
Interpret checks in light of your configuration. In rule-based mode, local domains may intentionally use local DNS, so seeing a local resolver on a test page doesn’t necessarily mean anything is wrong. Encrypted DNS in the browser, remote resolution by the client, system DNS and IPv6 routing may all be involved. Check each separately instead of drawing conclusions from an unfamiliar network provider’s name.
- ✅ Check the client’s DNS policy and confirm that domains meant to use the proxy follow the expected resolution path.
- ✅ Check whether encrypted DNS in the browser bypasses the client’s settings, and verify against the connection log.
- ✅ Check whether IPv6 is handled by the client or by an explicit rule; don’t test only the IPv4 exit.
- ✅ Give support redacted rule-match details, error messages and system information. Don’t share your full subscription link.
A proxy service isn’t an identity-isolation tool. Websites may still associate activity with your account, cookies and browser fingerprint. VPN94’s no-logs statement describes the service’s privacy policy; it doesn’t prevent websites from recognizing an account you’re signed into, and it doesn’t replace device security, permission controls or protection for sensitive information.
Check the Subscription Terms Behind the Jargon
When comparing services, separate technical labels from account terms. VPN94 offers 100+ countries / 190+ routes and supports unlimited devices. No email address is required; create an account with a username and password. Coverage and device policies are verifiable service details, but they don’t guarantee the same performance in every region or app.
Monthly subscription data resets each month on the activation date. If you upgrade mid-cycle, the price difference is prorated by the remaining days. Data packs never expire. See plan pricing for current prices and data allowances. The refund policy allows you to request a full refund for any reason within 60 days of your first payment. Before choosing a data plan, check client compatibility and how the service works on the networks you use most.
Troubleshoot in this order: configuration, traffic capture, exit, rules, destination site. If a subscription won’t update, check configuration retrieval first. If the client says it’s connected but an app behaves the same, check which traffic it handles. If only one site fails, check its rules, DNS and any restrictions on the destination. Change one setting at a time to find the cause more reliably than repeatedly switching protocols.