This VPN glossary for beginners starts with subscriptions, nodes, protocols, and traffic routing: subscriptions provide configuration, nodes determine which entry point to connect to, protocols govern how data is transmitted, and routing rules determine which path requests take. Understand these roles first, and client settings will make more sense—you’ll also avoid assuming that a successful import means every app is connected.
People often use “VPN subscription” as a catch-all for international routes, but a traditional VPN tunnel and a proxy client are not the same thing. The terms below focus on practical use. A client’s features depend on its version and configuration format, so check the service panel for details.
Subscription links and configurations: getting your connection details
“Subscription” can refer to either billing or configuration. A monthly subscription describes the billing period; in a client, it usually means a URL used to fetch configuration. The response may contain a node list, policy groups, routing rules, and DNS settings, depending on the format provided by the service.
After copying a subscription link, paste it into a compatible client using an option such as “Import from URL” or “Add subscription,” then update it. Pasting the URL into your system proxy’s server field usually won’t work: system proxy settings require connection details such as a host and port, and don’t parse subscription URLs into configurations.
A configuration file is a document that stores these settings. A YAML or JSON extension doesn’t mean that every client using the same format is compatible; fields, protocol implementations, and rule syntax can still differ. If an import fails, first check which client the service panel specifies rather than assuming the route is down.
Subscription links often contain tokens that identify your account, so treat them as sensitive credentials. Don’t share them in public screenshots, forums, or with unfamiliar conversion sites. If you suspect a link has been exposed, check whether the panel offers a reset option, then update the old link on all your devices.
“Update subscription” means fetching the configuration again. It doesn’t renew your plan or reset your used data. A successful update only confirms that the configuration could be retrieved and read; the actual connection still depends on the node, network, and destination site.
Nodes, entry points, and exits: understanding location labels
A node is usually a set of connection details, including a server address, port, authentication credentials, and protocol settings. It’s an option you can select in a client, but it doesn’t necessarily correspond to a dedicated physical server. A single region may also have different entry points, exits, or routes.
The entry point is where your device first connects to the service; the exit is the location a destination site sees your request coming from. A region in a node name often refers to the exit, but don’t rely on the name alone—check the service documentation and actual exit information. A site’s content availability may also depend on your account, payment details, location permissions, and the platform’s policies.
| Common term | Typical meaning | What to verify |
|---|---|---|
| Direct | The device connects to an overseas server directly through its own network | Cross-border routing depends on the local carrier, routing, and congestion |
| Relay | The connection reaches an intermediate server first, which forwards it to another route or exit | Forwarding adds a routing hop; it doesn’t automatically make a connection faster or slower |
| IEPL dedicated line | Usually refers to a carrier-provided international Ethernet private line connecting specified locations | Check which segment the dedicated line covers. The connection from your device to the entry point, and from the exit to the website, may still use the public internet |
A dedicated line and a relay aren’t always mutually exclusive: a relay route may use a dedicated line for one segment. A “dedicated line” label also doesn’t mean the entire route is exclusive. Choose based on how the connection performs on your network; a route name doesn’t guarantee bandwidth, stability, or access to a particular service.
Common protocols: compatibility matters more than names
A protocol defines how the client and server negotiate, authenticate, and transmit data. The client must support the protocol and settings used by the node. Use the server’s protocol with a compatible client—changing a protocol name in a menu won’t give you a different connection.
- Shadowsocks: An encrypted proxy protocol. Connection details typically include a server, port, password, and encryption method; not all versions and extensions are compatible.
- VMess and VLESS: Both are common in proxy ecosystems, but their authentication and protocol designs differ. VLESS doesn’t provide transport encryption on its own and is usually paired with a secure transport such as TLS. The protocol name alone doesn’t mean the connection is encrypted.
- Trojan: Typically relies on TLS to protect communications and requires the correct credentials and certificate settings. If certificate verification fails, check the configuration and system time rather than disabling verification.
- Hysteria2 and TUIC: Both use QUIC-based transport and depend on UDP network conditions. Performance may be affected on networks that restrict UDP, and support for one doesn’t imply support for the other.
These are general explanations of common terms, not a claim that G8VPN offers every protocol listed above. Check whether your current client can read the configuration from the service panel, whether authentication is correct, and whether your network allows the required transport. A protocol name doesn’t prove a connection will be faster or replace reviewing the service’s privacy policy.
Routing rules, policy groups, and global mode
Traffic routing selects a path based on request attributes. Common rules match domains, destination IP ranges, or processes, then apply an action such as direct, proxy, or reject. Rules are usually evaluated in the order defined by the configuration. A broad rule placed too early may prevent more specific rules from matching.
A policy group sits between rules and nodes. For example, requests to certain international sites can be assigned to a policy group, where you choose an exit. Some groups support automatic selection or failover, but whether and how these work depends on the client and configuration. Changing a policy group doesn’t change all the rules.
Rule-based mode vs. global mode
Rule-based mode routes requests according to rules, making it useful for handling local services and international traffic differently. Global mode generally sends requests that enter the client’s proxy core through the selected proxy policy. “Global” doesn’t necessarily cover every app on your device, and it won’t automatically handle traffic that never enters the client.
If a site won’t load, temporarily switch modes to compare. If it works in global mode but not in rule-based mode, check the matching rules, policy group, and DNS first. If neither mode works, check the node connection and destination service. Restore your usual settings after testing rather than leaving a temporary troubleshooting setup in place.
For beginners: Start with a rule configuration from a reliable source that matches your client. Global mode is useful for comparison and troubleshooting, but it doesn’t mean “more complete.” System proxy settings, virtual network adapters, and app behavior also determine which traffic is covered.
System proxy and virtual network adapters: is the app using the route?
A system proxy tells apps that follow your operating system’s settings to send requests to a local proxy port. Browsers often use this setting, but some games, command-line tools, and apps that manage their own networking may not. A working browser connection doesn’t mean other apps are using the same route.
TUN mode uses a virtual network interface to receive IP packets for the client to process. It can often cover more apps, but still depends on routing, permissions, DNS, and exclusion rules; it doesn’t automatically take over all network traffic. Other VPNs, enterprise networking software, and virtual adapters may also conflict with it.
On Windows, macOS, and Linux, system proxy and TUN are often separate features with different permission requirements. Clients of this kind on iOS and Android usually handle traffic through the system’s VPN interface, but interface labels, app exclusions, and background restrictions vary. A system VPN indicator confirms that the interface is running; the icon alone doesn’t tell you which exit is being used.
G8VPN supports Windows, macOS, iOS, Android, and Linux. For download options, use the downloads section in the panel. Get your subscription after signing in; available iOS download options depend on your panel account status. Don’t apply instructions for a different platform to your device.
DNS and leaks: check resolution and connections together
DNS translates domain names into IP addresses. The route used for DNS lookups and the route used to establish the subsequent connection are related, but distinct. Encrypted DNS built into a browser, the operating system’s resolver, and the client’s DNS module may all be involved.
A DNS leak generally means queries that were expected to use a particular resolver path were sent through another path instead. Seeing a resolver’s name alone doesn’t prove there’s a leak. First define what you expect, then check the client logs, browser settings, and test results. Encrypted DNS protects queries in transit, but doesn’t necessarily send them through the proxy exit.
If your configuration uses Fake-IP, the client typically returns a synthetic address first, then maintains a domain mapping for routing. It isn’t the real address of the website’s server. Some local device discovery features and apps may not work with it; follow the configuration guidance for exceptions instead of replacing the entire DNS setup at random.
Don’t publicly share subscription links, authentication fields, or complete logs containing account tokens when troubleshooting. Before sharing diagnostic information, redact sensitive details; the error type, client version, and circumstances are usually enough.
From import to testing: a beginner’s checklist
To put the terms into practice, follow this sequence: get the configuration, choose a route, confirm traffic is being captured, and test a request. Change one setting at a time to make it easier to pinpoint what caused a difference.
- Check the client: Confirm the platform and configuration type in your account panel, install a compatible version, then import the subscription and check the update result.
- Check the node: Choose a specific exit and see which policy group it belongs to. Selecting a node doesn’t necessarily change every group.
- Check how traffic is handled: Enable system proxy or TUN as instructed by your client, and check for permission issues or conflicts with other networking software.
- Test access: Open the destination site and check the client’s connection logs to see which rule matched and which policy and exit were used.
- Narrow down the issue: Identify whether the problem is a failed subscription update, node handshake, DNS lookup, or access denied by the destination platform, then adjust the relevant setting.
- ✅ After importing, test the connection. A readable configuration doesn’t guarantee a working route.
- ✅ Test browsers and other apps separately; don’t assume one app’s result applies to the whole device.
- ✅ Check the destination platform’s location and account requirements; a changed exit doesn’t guarantee content will be available.
- ❌ Don’t leave certificate verification disabled for convenience, and don’t share subscription credentials with unfamiliar tools.
Keep billing and technical settings separate: G8VPN monthly subscription data resets each month on the activation date. Data packages remain available until used and never expire; updating a client subscription doesn’t change these rules. G8VPN follows a no-logs policy. That’s a privacy commitment, not a guarantee against every network risk. For more help with setup, see Guides and the Help Center.