A VPN Beginner’s Guide to Key Terms: Subscriptions, Nodes, Routes, Protocols & Split Tunneling

VPN Basics: How the Connection Works

A useful way to understand VPN terminology is to follow the connection: a subscription provides configuration to the client, the client chooses a node based on its rules, and a protocol and route connect it to the destination website. Subscriptions, nodes, routes, protocols, and traffic routing each serve a different purpose; they are not interchangeable.

People often use “VPN client” as a catch-all for proxy tools, but a system-level VPN tunnel and an app-level proxy are not quite the same thing. A connected status only shows that one part of the connection has been established; it does not mean every app is using the same route. To check whether your settings are working, look at both which traffic is being captured and which rules are matching.

A subscription link is not the same as a plan subscription

A plan subscription is the billing arrangement on your account. In a client, “subscription” usually means an address used to retrieve configuration. The two are related, but they are not the same thing. Even with an active plan, the node list may fail to update if the link was copied incorrectly, the wrong import format was selected, or the client cannot reach the configuration address.

A subscription link may return a list of nodes or a complete configuration that includes policy groups, rules, and DNS settings. The format depends on what the service provides and what the client supports. Before importing, choose the option in your account panel that matches your client; a file extension alone does not tell you whether a configuration is compatible. After importing, check that the nodes appear and that the configuration is enabled.

“Update subscription” usually means fetching the configuration from the server again. It does not renew your plan and may not change the currently selected node. Updating a complete configuration can also overwrite local changes, so check how your client merges or replaces settings before adding custom rules.

You can create a VPNAudio account with a username and password—no email address required. Sign in to the user panel to get your subscription link; follow the panel’s instructions for the correct client option. Installing the app and getting a working route configuration are separate steps: completing the first does not mean the second is ready automatically.

Nodes, exit regions, and route types: what’s the difference?

In a client, a node usually appears as a selectable connection configuration that may include an address, port, protocol, and authentication settings. It does not necessarily correspond to one dedicated physical server. A region in the node name generally indicates the exit location, but it may also refer to an entry point or route label. Check the service documentation for the exact meaning.

The exit is the network location a destination website sees your request coming from. A website may also use your account region, payment details, and its own rules to determine availability, so selecting a node in a particular region does not guarantee access to every platform feature. A shorter geographic distance does not always mean a faster connection: routes can take detours, and congestion at the exit or on your local network can affect performance.

IEPL, relay, and direct connections

IEPL generally refers to an international Ethernet private line. When a service uses it for part of a route, that segment may rely less on public internet routing. It does not mean the entire path from your device to the destination website uses a dedicated line. Your local connection, entry point, exit, and the destination service can still become bottlenecks.

With a relay, you first connect to an entry point, which forwards traffic to a later exit. A direct connection usually means the client connects to the specified server without a separate relay entry point provided by the service. A “direct node” is not the same as “direct” in traffic rules: the former may still provide a proxy connection, while the latter usually means the request bypasses the proxy.

Compare routes based on what you actually need to do: for calls, check whether audio stays clear and continuous; for browsing, look for consistent response times; for file transfers, focus on sustained throughput. A client’s latency test checks a specific destination using a specific method, so it cannot tell you how well video calls will work. A route’s name is no substitute for testing it. When reviewing node and route details, consider the region, route type, and any stated conditions together.

Protocol names describe how connections work—not how fast they are

Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are commonly used proxy protocols or protocol families. They define authentication, data encapsulation, and communication methods, but whether a client supports a particular node also depends on the implementation, transport options, and version compatibility. This article explains these terms; it does not mean VPNAudio offers every protocol listed here.

• Shadowsocks: An encrypted proxy protocol family. The client and server must use compatible methods and settings; the name alone does not tell you whether they can communicate.
• VMess: A proxy protocol with authentication and encryption mechanisms that can use different transport methods. Keep the relevant settings intact when importing a configuration.
• Trojan: Typically carries proxy traffic over TLS. The domain, certificate validation, and server configuration can all affect whether a connection can be established.
• VLESS: The protocol itself does not encrypt traffic. Assess security alongside supporting mechanisms such as TLS; the protocol name alone does not mean the connection is encrypted.
• Hysteria2 and TUIC: QUIC-based proxy solutions that typically rely on UDP. Network restrictions on UDP may affect the connection.

Protocols, transports, and routes operate at different layers. Even with the same protocol, changing the entry point or exit route can change the experience. On the other hand, switching protocols will not fix local Wi-Fi interference. If a connection fails, don’t disable certificate validation just to get it to connect. Check the configuration source, device time, and client compatibility instead.

Split tunneling, global mode, and rule-based mode determine where traffic goes

Traffic routing uses conditions to choose where requests go. Conditions may include a domain, destination address, process, or other information. Rule-based mode typically sends traffic through a proxy, connects directly, or blocks it based on the matching rule. Many clients check rules in order, but consult your client’s documentation for the exact priority and fallback behavior.

Global mode typically sends all traffic that has reached the proxy core through the selected policy. It does not automatically take control of every request on the device. If only the system proxy is enabled, apps that ignore system proxy settings may still connect directly. TUN or system VPN capture can handle more traffic, but routing, excluded apps, and the client’s implementation still matter.

So if a site won’t open in rule-based mode but works in global mode, that often points to a difference in rule matching or policy selection—not necessarily a problem with the node. First check which rule matched the domain and which policy group it uses, then confirm that the group has a working node selected. Avoid changing DNS, protocol, and mode all at once, or it will be hard to tell which change helped.

• ✅ For everyday use, check where the rules come from and how they’re updated, then make sure the apps that need a proxy are within the traffic capture scope.
• ✅ When troubleshooting one website, note the matching rule and actual exit, then briefly switch modes to compare.
• ❌ Don’t treat global mode as a guarantee of anonymity, or mistake a direct-connection rule for another proxy protocol.
• ❌ Don’t run multiple clients that capture network traffic at the same time; they can conflict over routing or DNS settings.

Check DNS leaks separately from your exit

DNS translates domain names into addresses that your device can connect to. Before a browser sends a web request, the system, browser, or proxy client may handle the lookup. If you expect DNS queries to use a controlled route but they’re handled by your local network’s resolver instead, that may be a DNS leak. Whether this is unexpected depends on your traffic-routing goals.

An exit IP check only shows where the test request went out; it does not prove the DNS queries took the same route. The region shown by a DNS test may also differ from the actual exit region. Public DNS services may use distributed servers, so consider the client’s DNS logs, rules, and test results together rather than relying on a region label alone.

When troubleshooting, first check the client’s DNS capture settings, then see whether the browser has encrypted DNS enabled separately. Encrypted DNS protects the relevant lookup path, but does not automatically ensure that it goes through a proxy. If the issue only occurs in one browser, compare that browser’s settings before changing all your nodes.

From import to verification: check each step

Once you understand the terminology, break setup into steps you can verify. Desktop clients for Windows, macOS, and Linux commonly offer a system proxy or TUN option; iOS and Android commonly request system VPN permission. The labels vary by app, so don’t assume a button will be in the same place across platforms.

1. Check the client’s source and compatibility. Sign in to the user panel to find the option for your platform, then check which subscription formats it supports. For iOS, follow the availability instructions shown in the panel.
2. Import and update the subscription. Use an option that matches the required format, then check that a valid configuration was received. If the list is empty, troubleshoot retrieval or parsing first instead of immediately switching nodes.
3. Enable the configuration and choose a policy. Check the active configuration, node, and rule-based mode. Allow the system network permissions the client requires.
4. Test the task you need. Check the target website, exit, and matching rule, then open the meeting or collaboration app you actually use. A website loading does not mean other apps are being captured too.
5. Troubleshoot based on the symptoms. If the subscription fails, check configuration retrieval; if the connection fails, check compatibility and the network route; if only a particular app has issues, check traffic capture, rules, and DNS.

Plan data allowances are separate from these technical settings. VPNAudio monthly plans reset data each month on the activation date; data add-ons remain available until used and never expire. Updating a subscription link does not reset plan data. To compare costs, see plan pricing and usage rules rather than guessing from the protocol name.

VPNAudio’s privacy policy is not to keep logs, but that does not mean websites cannot identify your account, and it does not replace managing device permissions or protecting subscription credentials. To get started, read the beginner’s guide. If you run into an issue you can’t resolve, contact support through the support page.