This VPN glossary for beginners starts with how subscriptions, nodes, routes, and protocols fit together. A subscription provides configuration details, a node is a connection endpoint, a route is the path data takes, and a protocol defines how the connection is established and carried. They are different things and are not interchangeable.
The client applies these configurations, while rules determine which traffic goes through which exit. When something goes wrong, identifying the layer at fault is more useful than toggling every setting. The technical terms below explain general concepts and do not mean ClipVPN offers every protocol or route type mentioned.
Subscriptions, nodes, and configuration files
“Subscription” can mean different things in an app. On a plan page, a monthly subscription refers to a recurring service. In a client, it usually means an address used to retrieve connection configurations. Purchasing a service does not automatically import its configuration into the client; importing a configuration does not necessarily mean the account currently has available usage.
A subscription link is usually a URL containing access credentials. The client requests this URL to retrieve node details. Some subscriptions also include proxy groups, routing rules, or DNS settings, depending on the subscription format. Client compatibility varies, so being able to open a link does not mean it can be imported correctly.
A node is a selectable connection configuration that includes details such as a server address, port, authentication information, and protocol parameters. The node name is just a label for identification. Its listed region often describes the exit location, not necessarily the location of the first connection endpoint, and the name alone cannot tell you the actual route.
| Term | What it does | Common confusion |
|---|---|---|
| Subscription link | Lets the client retrieve or update configurations | Not a regular website address or proof of payment |
| Node | Describes a proxy endpoint you can connect to and its parameters | A region label is not the complete data route |
| Route | Describes how the entry point, transit path, and exit are arranged | Not the same as the proxy protocol used by a node |
| Protocol | Defines how the client and server communicate | The name alone does not guarantee a faster connection |
| Proxy group | Organizes nodes into a group for manual or automatic selection | How automatic selection works depends on the configuration and may not suit every app |
Route types: direct, relayed, and IEPL
Direct connections usually mean the client connects to an overseas server through the local network, without an extra relay endpoint arranged by the service provider. “Direct” does not mean a physically straight path or one without carrier routing. Your experience still depends on local access, inter-network connectivity, and the destination server’s load.
A relay adds a forwarding step between the client and the exit. The client connects to an entry point, which then forwards traffic to another server. A longer route is not necessarily slower: a relay may improve performance if it avoids a congested interconnection, but congestion at the entry point or farther along the route can make things worse. An extra hop is no guarantee of better performance.
IEPL stands for International Ethernet Private Line, a dedicated transmission service between specified endpoints. When a commercial route is labeled IEPL, it usually means that part of the route uses this type of resource; it does not mean every segment between your home and the destination website is a private line. Local access, entry capacity, and connectivity at the exit still affect performance.
Choose a route based on what you need to do. For calls, check whether audio stays clear; for websites, see whether the page loads reliably; for file transfers, look at sustained throughput. The latency shown by a client reflects a specific test and does not represent the full experience. Some tests may reach only the proxy endpoint, not the destination website.
Protocol names and client compatibility
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC may all appear in proxy clients. They are different proxy protocols or implementations, not operating-system-level VPN protocols. Even when an app uses the system VPN interface to route traffic, that does not mean it is using a traditional VPN tunneling protocol.
- Shadowsocks: An encrypted proxy protocol commonly used to forward TCP and UDP traffic. Its actual capabilities depend on compatible client, server, and configuration settings.
- VMess: A proxy protocol with authentication and encryption mechanisms. Incorrect authentication parameters or system time can affect the connection, so check the configuration and time synchronization if authentication fails.
- Trojan: Common deployments rely on TLS to protect traffic. When troubleshooting, check certificate validation, the server name, and whether the client and server configurations match.
- VLESS: A lightweight proxy protocol that does not encrypt traffic by itself. Understand it in combination with secure transport mechanisms such as TLS or REALITY; the name alone does not mean traffic is encrypted.
- Hysteria2 and TUIC: Both are based on QUIC and rely on UDP. If your network restricts UDP, the connection may be affected. Whether fallback is supported depends on the implementation and configuration.
The same protocol can still be incompatible across clients because of differences in transport methods, extensions, or implementation versions. If an import fails, first check whether the client supports the subscription’s format and parameters. Don’t change the protocol to a different name on your own. A protocol name describes an interface, not a performance ranking.
Split tunneling, rule-based mode, and global mode
Split tunneling routes requests according to conditions such as domain names, destination addresses, processes, or geographic database matches. A matched request may connect directly, go to a proxy group, or be blocked. Rule order often matters: an earlier match may determine the outcome, while the final rule handles requests that did not match anything else.
Rule-based mode routes traffic according to these conditions, making it useful for handling local services and international websites differently. It cannot guarantee that every domain is classified correctly: an app may request separate domains for sign-in, images, and APIs. Adding a rule for the home page alone may not cover all of its features.
Global mode usually sends all requests handled by the client through the selected proxy. It does not mean every bit of device traffic must use the proxy. Apps that ignore the system proxy, or traffic not captured by a virtual network interface, may not be covered. Check local network exceptions and DNS settings separately as well.
A system proxy tells apps that support the setting to use a proxy. TUN mode uses a virtual network interface to capture traffic matching the routes; it usually covers more traffic, but may require extra permissions and can conflict with enterprise security software or another VPN. Global and rule-based modes describe how an exit is chosen; system proxy and TUN describe how traffic is captured. They are not the same thing.
What DNS resolution and leaks mean
DNS resolves domain names to addresses that devices can connect to. If the proxy connection works but DNS requests fail or return results unsuitable for the current route, websites may still be unreachable. So “the node passes a latency test” and “the website opens” are separate checks.
A DNS leak usually means domain queries that were expected to use a specific channel were instead sent to an unexpected resolver. For example, the connection may go through a proxy while DNS queries still use the local network’s resolver. Whether this counts as a leak depends on your privacy expectations and routing policy; intentionally resolving local domains locally is not automatically a configuration error.
A browser’s encrypted DNS, system DNS, and client DNS can all be active at the same time. DoH and DoT protect DNS queries in transit to the resolver, but do not by themselves ensure queries go through a proxy or prevent the resolver from seeing them. When using an online test, check the resolver, client logs, and actual route instead of drawing conclusions from the region shown on the test page alone.
Some clients use Fake-IP, returning synthetic addresses for domain names and mapping them back to the destination during a later connection. This is a mapping mechanism, not a permanent change to the website’s real address. If a particular app is incompatible, configure an exception using the client’s documentation rather than disabling the entire DNS module.
Steps to import a configuration from the dashboard to your client
The ClipVPN client entry point is the dashboard. Sign in to download the client on Android, Windows, macOS, or Linux; for iOS, eligibility is determined by the active plan shown in the dashboard. After signing in, retrieve your subscription and follow the dashboard and client instructions to import it. There’s no need to find configurations on unfamiliar websites.
- Verify the source. Open the download and subscription page from the user dashboard, and check that you have selected the right platform. Don’t enter your service login details into an unfamiliar client.
- Import in a compatible format. Use the import option in the dashboard, or paste the link into subscription management in your client. If the format is unsupported, first check whether the app and subscription type are compatible.
- Update and select the configuration. After a successful import, confirm that the newly imported configuration is enabled. A configuration appearing in the list does not mean it is active.
- Choose a route and connect. Start with the default rule-based mode and grant the network permissions requested by your system. Don’t skip certificate validation just to connect.
- Test the task you need. Open the target website or collaboration tool, check sign-in, loading, and continued use, then look for DNS or authentication errors in the logs.
System proxy behavior differs across Windows, macOS, and Linux; some command-line tools require proxy environment variables to be configured separately. Network capture on Android and iOS also depends on system permissions and background behavior. A button name on one platform is not necessarily a universal set of instructions.
Understand the error before changing settings
A subscription update failure happens while retrieving configuration. Check that the link is complete, its access credentials are valid, the current network can reach the subscription URL, and the server returns a configuration the client supports. This is related to, but not the same test as, checking whether an imported node can connect.
A connection timeout means an operation did not complete within the allotted time. Possible causes include an unreachable network, a firewall, an entry-point issue, or a failed handshake; “timeout” alone does not identify which part failed. For a certificate error, check the system time, server name, and configuration source. Disabling validation is not a routine fix.
- ✅ Turn off the proxy first and confirm that your local network connection works.
- ✅ Check your account status, active subscription, and whether the client needs an updated configuration.
- ✅ On the same network and in the same app, try another route while leaving other settings unchanged.
- ✅ If only certain websites have problems, check the matching routing rule, DNS, and the website’s own sign-in restrictions.
- ✅ When submitting a support ticket, include your system, client, error message, and steps to reproduce the issue. Redact your subscription credentials.
Keep in mind what a proxy can and cannot do: its exit affects the network route and the externally visible exit address. It does not automatically change an account’s region, payment details, browser location, or a website’s risk assessment. A successful connection does not mean every platform permits access; always follow local laws and the target service’s terms.