VPN Glossary for Beginners: Subscriptions, Nodes, Routes, Protocols & Split Tunneling

Start with one simple distinction: a subscription provides configuration, a node is a connection endpoint, a route describes the network path, a protocol handles communication, and split tunneling determines where requests go. These terms refer to different things and aren’t interchangeable. When a connection fails, identifying the layer involved is more useful than repeatedly changing settings.

Subscriptions, Nodes, and Routes: What’s the Difference?

“Subscription” commonly refers to either billing or configuration. A monthly subscription is a way to pay for service; a subscription link lets a client retrieve its configuration. Buying a plan doesn’t automatically connect your client. You’ll usually need to sign in to the service dashboard, get a configuration for your client, and import it.

A node is a set of connection parameters, usually including a server address, port, authentication details, and protocol settings. A region name shown in a client is just a label; don’t assume it tells you the physical location, actual exit point, or intended use. A route describes the path data takes. The same exit region can have different entry points and forwarding methods.

What Each Term Covers, from Configuration to Network Requests
Term	What it does	Not the same as
Subscription link	Lets a client retrieve or update connection settings	A public sharing page or a fixed installer
Node	Provides a specific connection endpoint and authentication details	A guarantee of end-to-end route quality
Route	Describes the path between the entry point, transit network, and exit point	The name of a communication protocol
Protocol	Defines how the client and server exchange data	A region or plan tier
Routing rule	Chooses a direct connection, proxy, or other action based on conditions	A website’s regional licensing rights

Subscription updates usually sync changes to nodes and configuration. They don’t renew your plan, and they may overwrite local edits. Before updating, check how your client handles custom rules. If a node disappears, first confirm that the subscription updated successfully; then contact support if needed.

Subscription Links: How to Import and Keep Them Safe

A subscription link may contain access credentials, so treat it as sensitive information. Don’t post it in public forums or submit it to an untrusted online converter. What to do if a link is exposed depends on whether the dashboard lets you reset it. If you’re unsure, ask support—deleting a chat message alone doesn’t resolve the issue.

Check your client. Review the supported platforms and configuration formats in the service dashboard, then install a compatible client.
Get the right import method. Choose the subscription or import option provided for your client, and avoid mixing configuration formats.
Import and update. Use your client’s subscription manager, then check that valid nodes appear and that the update completes without errors.
Choose a node and mode. Make sure the configuration is enabled, then turn on the system proxy or the client’s traffic-capture feature as needed.
Test the app you need. Open the target website or app. Seeing nodes in the list doesn’t mean its traffic is using the selected route.

If an import fails, check whether the error is related to fetching the link, parsing its format, or an unsupported protocol. Opening a subscription URL in a browser doesn’t mean the client can parse its contents. Don’t paste the full link into a public screenshot to troubleshoot; the error text and client version are usually more useful.

Subscription formats and protocols are different layers: a client that can read a configuration file may still lack support for some protocols or extensions specified in it.

IEPL Circuits, Relays, and Direct Connections: How the Routes Differ

A direct connection usually means the client connects straight to a remote service entry point. A relay usually means it connects to a forwarding entry first, which then connects to another server. These terms describe how a route is arranged, not whether it’s encrypted. Check the actual protocol and configuration to understand encryption and authentication.

IEPL stands for International Ethernet Private Line, a type of transmission resource. In subscription services, an IEPL circuit may be used for only part of a route; it doesn’t mean every leg from your device to the destination website uses a private line. Your local network, entry point, exit network, and destination service can all affect performance.

So it’s not as simple as “private line is always better than relay, and relay is always better than direct.” Entry-point distance, carrier interconnection, congestion, and the exit route all affect results. Relays and private lines aren’t mutually exclusive: a route forwarded through an entry point may still use private-line capacity for a later segment.

✅ Compare routes on the same device, local network, and target app. Record what you observe instead of judging by the route name alone.
✅ If websites load but calls are choppy, check sustained transfers, real-time traffic, and your local Wi-Fi separately.
❌ Don’t treat a region label as proof that a streaming service will always work, or a private-line label as a promise of a congestion-free route.

VPNLed covers 110+ countries with 160+ routes. Coverage shows which resources are available; it doesn’t mean every route works for every website. Check the dashboard for current nodes and connection options.

Protocol Names: Check Compatibility First

Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are names of commonly used proxy protocols or protocol suites—not regions, plans, or route tiers. The descriptions below explain general concepts and don’t mean VPNLed supports every protocol. Check the dashboard and client documentation for current support.

Shadowsocks protects proxy traffic with a selected encryption method, and the client and server must use matching parameters. VMess has its own authentication and encryption mechanisms. VLESS focuses on lightweight authentication and doesn’t encrypt data on its own; it’s typically used with secure transport settings such as TLS. The protocol name alone doesn’t tell you how well a connection is protected.

Trojan typically uses TLS to establish a protected connection and requires correct domain, certificate validation, and authentication settings. Hysteria2 and TUIC are based on QUIC and depend on UDP being reachable. If a network restricts UDP, they may fail to connect or perform poorly—but that doesn’t mean every UDP app will be unusable.

Keep protocols, transport methods, and security layers distinct. Seeing WebSocket, TLS, or QUIC in a configuration doesn’t mean they’re interchangeable options at the same layer. If you’re new to this, use the complete configuration provided by the service. Don’t disable certificate checks or change the server name just to “improve compatibility.”

Split Tunneling, Rules, and Global Mode: Where Requests Go

Split tunneling selects a network path based on conditions; rule mode is a common way to do this. Rules may match a domain, destination address, or process, then send requests direct, through a proxy group, or block them. Match order and fallback behavior depend on the client, so don’t assume every app follows the same logic.

Global mode generally routes requests captured by the client through a selected proxy policy, but it doesn’t necessarily capture every connection on your device. With system proxy enabled alone, apps that ignore system proxy settings may still connect directly. A browser extension may affect only the browser itself.

TUN is a common way to capture traffic through a virtual network interface and can cover more apps. Its effectiveness still depends on routing, permissions, exclusion rules, and the client’s implementation. Enabling TUN doesn’t guarantee that DNS uses the proxy or that no other network path is available on the device.

A practical troubleshooting step is to keep the same node and temporarily compare rule mode with global mode. If a service works only in global mode, check rule matches, DNS resolution, and whether the app’s traffic is captured instead of immediately assuming the node is down. When testing is done, restore the settings that suit your everyday use.

DNS Leaks: Resolution Paths and Privacy

DNS translates domain names into addresses. A website connection going through a proxy doesn’t necessarily mean its DNS queries follow the intended route. If queries still go to a resolver on your local network, they may reveal the domains you visit and cause region detection or routing decisions to differ from what you expect.

A DNS leak generally means resolution requests are going outside the intended protection path. Check your client’s DNS settings, your browser’s encrypted DNS settings, and the system’s resolver behavior together. A test page showing a particular resolver is a clue, not proof that all traffic is exposed or all communication is protected.

To troubleshoot, first check whether the client captures DNS, then see whether the browser has a separate resolver configured. Change one type of setting at a time, reconnect, and test again. Avoid changing the node, protocol, and DNS settings all at once, or it’ll be hard to tell what made a difference.

VPNLed’s no-logs policy describes the service’s approach to privacy; it doesn’t replace device security, website account settings, or correct client configuration. A proxy connection also won’t erase login sessions or browser identifiers a website already has.

Platform Differences and Plans: Separate Setup from Billing

Windows and macOS clients may offer different traffic-capture options, such as a system proxy or TUN. Follow the client’s prompts to see whether additional permissions are needed. iOS and Android often use the VPN interfaces built into the operating system, but a VPN status indicator alone doesn’t prove every app uses the same route. On Linux, distinguish between service processes, environment variables, and desktop proxy settings.

VPNLed supports Windows, macOS, iOS, Android, and Linux, with unlimited simultaneous devices. Find the client downloads for each platform on the dashboard downloads page. For iOS, availability depends on what the dashboard currently shows. When switching devices, check the configuration and traffic-capture permissions again rather than assuming settings from another device will carry over.

VPNLed monthly plans include ¥9.9/month for 60GB, ¥18/month for 250GB, and ¥28/month for 500GB. Data resets monthly on the activation date; mid-cycle upgrades are prorated based on the remaining days. Data add-ons cost ¥158/300GB, ¥358/1000GB, and ¥658/3000GB. They’re valid until used and never expire. Configuration updates don’t change these billing terms.

If you use the service frequently and your monthly needs are fairly steady, compare monthly data allowances first. For occasional use, consider a data add-on. Unlimited devices refers to the number of devices that can be online at once; it doesn’t mean unlimited data or that total capacity increases with each device. Check current prices on the Plans page.