VPN Glossary for Beginners: Subscription, Nodes, Protocols & Split Tunneling

The hardest part of getting started with a VPN is not installing the client. It is the wall of terms that appears the moment you open the subscription page. Subscription, node, route type, protocol, split tunneling, global mode — you know every word on its own, but strung together they mean nothing, so you end up tapping whichever line happens to say Japan or United States.

This quick reference follows the order you see things in a client, top to bottom, and takes the six terms one at a time. Each gets an example that really appears in the interface, plus a note on how it differs from the concept next to it. You do not need to memorise every parameter afterwards; being able to judge three things is enough: whether the subscription actually updated, what the suffix in a node name means, and why rule mode saves bandwidth compared with global mode.

Subscription: the account and data allowance behind one link

In a client, a subscription is usually just a URL. The server packs the node list, protocol parameters, transport settings, and traffic and expiry information into one configuration; the client fetches it at a fixed interval and writes the result into its local node list. Nothing has to be typed in by hand — no server address, port, credentials or encryption method — which is exactly why subscriptions replaced the early practice of adding nodes manually.

In a client, the subscription leaves traces in three places: the subscription URL field on the settings page, the “Subscription updated · 230+ routes” notice at the top of the node list, and the used traffic and expiry date in the account panel. If those three do not agree, first confirm the subscription was fetched successfully, then check whether the node connects.

A subscription link is the same thing as an account credential. It carries your identity parameters, and anyone who gets it can burn through your traffic. So do not paste it into a group chat, do not submit it to a public subscription converter, and do not leave it in a screenshot. When you need it on a new device, copy it again from your account instead of forwarding the old link.

There are three moments to update a subscription: you changed plans, so traffic and expiry changed with it; the server adjusted its routes and the addresses in the old list no longer work; or the client reports that the fetch failed. Most clients allow a manual update and also an automatic interval. The interval does not need to be short — once every few hours is plenty.

The subscription page also shows a few fixed numbers. They describe what the account includes, not the performance of any single route:

Nodes: four pieces of information in a name

A node is one concrete connection that a subscription expands into. It contains at least a server address, port, protocol, encryption method, transport layer and obfuscation parameters. All of that is already written in the subscription; the client just opens the connection with those parameters, and the only choice left to you is which one to connect to.

Node names are written for humans. Naming habits differ between providers, but the common structure breaks into four parts:

One warning: the region in a node name refers to the exit, not the physical location of the entry server. A node labelled “United States · Los Angeles” may have its entry point in mainland China, with traffic leaving over a relay or dedicated line before landing in Los Angeles. To judge whether a route is stable, look at the route type; to judge what content you can reach, look at the exit region.

Another common misunderstanding is that more nodes is better. 230+ routes describes the scale of coverage; in practice you will keep using a handful of them. Rather than trying them one by one down the list, lock in a region for your use case first, then sort by route type within that region.

Route types: direct, relay and dedicated lines

Route type describes the path data takes from entry to exit. It decides whether a route holds up at peak hours, and it is the most useful part of a node name suffix.

Dedicated lines are expensive to build, so a region usually has fewer IEPL nodes than direct ones. That does not affect your choice: one person only uses one route at a time.

Route type and protocol are different things: route type governs how data travels, protocol governs how it is encapsulated. In a node name one usually comes before the other, and reading them together gets confusing.

Protocols: how six common ones differ

The protocol decides how the client and server handshake, how traffic is encrypted, and what that traffic looks like to devices in between. Whatever protocol the subscription specifies is the one the client uses; there is nothing for you to tune. Still, knowing the differences helps explain why a particular node will not connect.

Two practical points about protocols

First, VMess is time-sensitive. If the device clock is a few minutes off from standard time, the handshake fails outright — every node times out at once even though the network itself is fine. When that happens, sync the system clock first, then look at the routes.

Second, QUIC-based protocols run over UDP. Some networks rate-limit or block UDP, which shows up as a connection that works but is strangely slow, or one that drops a few seconds after connecting. If a region has both TCP and UDP nodes, test with the TCP one first — that quickly tells you whether the problem is the route or the protocol being throttled.

Split tunneling and global mode: what rule mode is deciding

Clients usually offer three modes at the top: global, rule and direct. Global sends all traffic into the tunnel; rule mode matches traffic against a rule set line by line, sending matches through the proxy and everything else direct; direct mode bypasses the proxy entirely.

Split-tunneling rules usually match on four dimensions: domain suffix, IP range, process name and port. The rule set is evaluated from top to bottom and stops at the first match, so order matters. A broad IP-range rule placed above a specific domain rule means the later rule never fires.

DOMAIN-SUFFIX,example.com,PROXY
DOMAIN-KEYWORD,update,PROXY
GEOIP,CN,DIRECT
PROCESS-NAME,chrome.exe,PROXY
MATCH,DIRECT

Reading the example above: traffic matching the listed domain suffixes goes through the proxy, traffic matching the keywords goes through the proxy, anything resolving to a mainland China IP range goes direct, traffic from the listed processes goes through the proxy, and everything else goes direct. Rule syntax differs slightly between clients, but the matching order works the same way.

What DNS leaks are

How accurate split tunneling is depends heavily on which path DNS queries take. A DNS leak means the domain lookup never entered the tunnel and instead went out in plaintext to the DNS server handed out by the local ISP. There are two consequences: the answer may not match the exit region, so a node in the United States still gets locally targeted content; and the queries themselves reveal which domains you visited.

Most clients take over DNS in rule mode, routing lookups to a proxy DNS or a local DNS according to the rules. Checking is straightforward: connect to a node, open this site's IP lookup page, and see whether the country or region shown matches the node name. If it does not, check the DNS settings first, then the rule set.

• ✅ For everyday use, pick rule mode: domains in mainland China go direct, cross-border traffic goes through the proxy, and both bandwidth and speed make more sense.
• ✅ If you are not sure which domains should go through the proxy, run global mode first and add rules one at a time.
• ✅ Keep the rule set updated, or new domains will have no matching entry.
• ❌ Leaving global mode on permanently: a site in mainland China goes all the way out and back, which is slow and burns through traffic.
• ❌ Putting MATCH,DIRECT at the very top of the rule set: every rule below it stops working.

Three checks: is the subscription really working

Once the terms make sense, use three steps to confirm the subscription is actually in effect:

1. Update the subscription and confirm the number of entries in the node list matches the route count in your account.
2. Connect to a node, open the IP lookup page, and check whether the exit country or region matches the node name.
3. Open one site in mainland China and one international site, and confirm rule mode splits them as expected.

If any of the three steps does not match expectations, troubleshoot in the order subscription, node, rules — do not skip ahead. If the subscription did not fetch, the conclusions from the next two steps do not count; if the node will not connect, try another route in the same region before suspecting the rule set.