This VPN glossary for beginners covers subscriptions, nodes, routes, protocols, and traffic routing. Here’s how they fit together: a subscription provides the configuration, the client reads it, a node is the connection endpoint, a route is the path traffic takes, a protocol handles communication, and routing rules decide where requests go.
The point isn’t to memorize a list of technical terms. It’s to know what to check when a configuration imports but nothing loads, or a website works while an app doesn’t. First, let’s unpack the labels in your client, then turn them into practical setup steps.
Subscription links vs. paid subscriptions: same word, different things
A paid subscription is a billing arrangement that determines which services and data allowance your account can use. A subscription link is how a client retrieves its configuration. It typically includes node settings and may also include proxy groups, routing rules, and DNS settings. Paying doesn’t automatically add the configuration to your client, and copying the link doesn’t turn on the connection.
When you import a subscription into a compatible client, it fetches the link’s contents and saves the configuration. Clicking “Update subscription” usually refreshes nodes and rules; it doesn’t renew your plan. An update may fail if your account has expired, you’ve used up your data, the link has been reset, or your current network can’t reach the configuration URL. Check each possibility separately.
Don’t post subscription links in public forums. A link may contain credentials that identify your account, and anyone who gets it may be able to use the associated configuration. Hide the full link and any tokens when troubleshooting. If you’ve already shared it publicly, check your dashboard for a reset option, then import the new link.
“Import successful” only means the client accepted the configuration. You still need to check whether a connection can be established, whether the target app is routed through the proxy, and whether the website allows access.
Nodes, regions, and exit IPs: what are you choosing?
A node is a server endpoint or configuration that your client connects to. Its name often indicates an exit region, but the name itself isn’t a measurement. The connection may enter the network nearby and be relayed through another region before reaching a website, so the entry address and the exit address seen by the site may differ.
An exit IP is the network address a destination website sees. It may affect the regional content shown, but it doesn’t determine account eligibility, payment region, or platform permissions on its own. Switching to a node in a different region doesn’t change your account region or guarantee that a platform will work.
A latency test next to a node usually measures the round-trip time for a particular probe. Clients may test different addresses, or measure only part of the connection path. A response can help you shortlist nodes, but it doesn’t translate directly into download speed or prove that a connection will stay stable over time.
| Client term | What it tells you | What it doesn’t tell you |
|---|---|---|
| Subscription link | Where to get the configuration | That your account has renewed or the connection is on |
| Node | Which server configuration to connect to | That the named exit location never changes |
| Route | Which network path your traffic takes | That performance is the same at all times |
| Protocol | How the client and server communicate | That a particular protocol works best on every network |
| Routing rules | Whether a request connects directly, goes through a proxy, or is blocked | That the current rules control every app |
IEPL dedicated lines, relays, and direct connections: it’s all about the path
A direct connection usually means the client connects to the server without an additional relay provided by the service. “Direct” describes the connection setup, not the shortest geographic distance. Traffic still travels through carrier networks, where international congestion and routing changes can affect performance.
A relay adds a forwarding hop between the client and the exit. It may improve reachability at the entry point, but it can also introduce a new bottleneck. To assess a relay route, look at connection reliability, sustained transfers, and recovery after a failure—not just whether its name says “optimized.”
IEPL is an international Ethernet private line, a network transport service—not a proxy protocol. A route labeled IEPL usually means the provider uses this type of dedicated line for part of the transport path. It doesn’t mean every segment from your device to the destination website uses that line. Your local Wi-Fi, access provider, and the route from the exit to the destination still matter.
So consider route type and protocol separately: the same protocol can run over different paths, and the same type of path can carry different protocols. For a fair comparison, keep the device, network, and target app consistent, then see how often connections drop or need to reconnect.
Shadowsocks, VMess, Trojan, VLESS: protocols aren’t speed rankings
A protocol defines how the client and server exchange data. Support for a protocol doesn’t guarantee compatibility with every configuration format, transport, or extension. The client’s core and its version also matter. The descriptions below explain the concepts; they don’t mean VPN37 offers every protocol listed.
- Shadowsocks: An encrypted proxy protocol commonly used to relay app traffic. The client and server need compatible encryption methods and settings.
- VMess: A proxy protocol with authentication and encryption, commonly used with related proxy cores. Some configurations depend on the system clock, so check the device time if you have connection issues.
- Trojan: Usually establishes an encrypted connection over TLS. Certificate validation and server name settings matter. If a connection fails, turning off certificate validation shouldn’t be your go-to fix.
- VLESS: Doesn’t encrypt data by itself and is usually paired with TLS or another secure transport. The name alone doesn’t confirm that a connection is encrypted; you need to assess the complete configuration.
- Hysteria2 and TUIC: QUIC-based proxy protocols that rely on UDP. Restrictions on UDP in your current network can affect availability. Using QUIC doesn’t necessarily make either one faster.
If you’re new to this, start with the compatible clients and configuration formats listed in the service documentation. There’s no need to keep searching for the “best” protocol. Changing protocols can also change the transport and connection behavior, so adjust one thing at a time to identify the cause of a problem.
Traffic routing, global mode, and TUN: which traffic goes through the connection?
Rule-based mode chooses how to handle traffic based on conditions such as domain, destination address, process, or other criteria. Common actions are to connect directly, send traffic to a proxy group, or block it. Rules are often checked in order, so an earlier rule may take effect before a later one. Adding a rule doesn’t guarantee that it matches.
Global mode usually sends traffic that reaches the proxy core through a single policy. The key is “traffic that reaches the proxy core”: if an app bypasses the system proxy, global mode may not capture it. If a browser loads websites but a command-line tool can’t connect, the tool may not be using the system proxy settings.
TUN mode receives system traffic through a virtual network interface and lets the client process it. It usually covers more traffic than setting a system proxy alone, but routing, permissions, exclusion lists, and client implementation still matter. TUN and global mode aren’t the same thing: TUN is about how traffic enters the client; global mode is about how the client handles it.
Windows and macOS clients may offer both a system proxy and TUN. Mobile platforms often route traffic through the system VPN interface. The VPN icon indicates that the system network interface is enabled, not that every app is being proxied. On Linux, desktop apps and command-line tools may use different proxy settings, so check each app separately.
DNS leaks, exit checks, and connection results
DNS translates domain names into addresses. Even if web traffic goes through a proxy, DNS queries may take a different network path. If queries don’t follow the expected path and are instead handled by your local network or another unintended resolver, that may be what’s commonly called a DNS leak. Whether the path is unexpected depends on the client mode and its rules.
Encrypted DNS protects queries in transit between your device and the resolver, but doesn’t automatically route them through a proxy. The resolver still processes the queries. Some clients use Fake-IP, returning a synthetic address and restoring the domain name when a connection is made. This is a routing implementation; it doesn’t mean the website’s actual address has changed to that synthetic one.
When testing, check the exit region, DNS resolution path, and behavior of the app you’re using separately. A test page only reports what it can observe; it can’t speak for every app. Browser-level secure DNS, existing connections, and cached results can make the outcome appear inconsistent with client settings. Check the logs too instead of repeatedly switching nodes.
From getting a client to verifying it: configure in order
- Check the download source and compatibility.Get a client from the user dashboard, then check your platform and supported configuration formats. Don’t give a subscription link to software that isn’t compatible with it.
- Import and update the configuration.Use the subscription option in your client and check whether nodes and proxy groups appear. If an update fails, first check your account status, whether the link is valid, and whether it’s reachable on your network.
- Choose a node and mode.Pick a region for your needs, then check that the system proxy or TUN is enabled. To start, use the rules provided with the configuration rather than layering on multiple rulesets from unknown sources.
- Test the app you need.Open the website or tool you want to use, check whether the exit matches your expectations, and look in the client logs to see which policy handled the request.
- Troubleshoot one layer at a time.If the configuration won’t update, check the subscription. If a node won’t connect, check the network and settings. If only one app fails, check how traffic is captured, DNS, and the app’s own settings.
- ✅ Before sharing troubleshooting screenshots, hide subscription links, tokens, and account credentials.
- ✅ Keep a copy of a configuration you’ve verified works, so you can compare changes if something goes wrong after an update.
- ✅ When contacting support, include your platform, client, network environment, and error message—not just “it doesn’t work.”
- ❌ Don’t treat disabling certificate checks or installing certificates at random as general-purpose fixes.
Data allowances and billing follow the account terms. VPN37’s monthly data allowance resets each month on the activation date. Data add-ons remain available until used and never expire. There’s no limit on the number of devices connected at once, but that doesn’t mean plan data is unlimited. Create an account with a username and password—no email address required. See plans and data allowances for available options, or check the guides for help with setup.
In short: A subscription provides the configuration, a node is the connection endpoint, a route describes the path, a protocol defines how communication works, and routing rules determine where requests go. Check whether traffic reaches the client first, then inspect the policy and exit. That’s more useful for troubleshooting than relying on a “connected” status or switching nodes over and over.