VPN Setup Guide for Beginners: From Checkout to Connected

This guide is for anyone setting up a VPN for the first time. Payment is only the beginning; what really decides whether it works is the four steps that follow — subscription link, client import, route choice, connectivity check. Each one has a clear expected result, so if something doesn't match, that's where you're stuck, and there's no need to reinstall from scratch.

The sections below follow the order of operations. If you're already stuck at a particular step, jump to Common snags and self-check list, work through it there, then come back and fill in the earlier parts.

Three things to settle before you order

A price table in front of you makes it easy to dither. Answer three questions and the right tier becomes obvious: how long you'll use it, roughly how much traffic you need each month, and how many devices will be online at once.

How long: for long-term use, pick a monthly subscription — traffic resets on the same day each month from activation, so there's no calendar month to track. If you only need it a few times a year, a traffic pack suits better: use it up at your own pace, and it never expires.

How much: for research, email and video at normal resolution, a few tens of GB a month is plenty; 4K every day plus large downloads will multiply that several times over. The three monthly tiers differ only in monthly traffic — routes and device policy are the same.

If your usage is unpredictable, buy traffic by volume instead: ¥158 / 300GB, ¥358 / 1000GB, ¥658 / 3000GB — use it up at your own pace, and it never expires. For low-frequency situations such as business trips or short projects, a traffic pack costs less than a monthly subscription.

How many devices: there's no device limit — desktop, tablet and router can all use the same account at once, so a second device doesn't mean a second purchase.

Payment supports Alipay, WeChat and USDT. Registration needs only a username and password — no email address, which skips the wait for a verification email and leaves one less piece of personal data behind.

Step 1: Get your subscription link

A subscription link isn't a username and password — it's a URL. The client opens it and receives the node list, ports, encryption methods and transport parameters, and can re-fetch it on a schedule. Treat it as a credential: anyone with the link can use your traffic, so don't paste it into group chats or post screenshots of it.

Once logged in, copy the subscription link from the user panel. Several formats are usually offered at once — pick the one that matches your client:

• Universal format: a single block of encoded node information, the most widely compatible — choose it if you're unsure.
• Rule-based config format: a config file with routing rules, suited to clients that automatically send local traffic direct and international traffic through the route.
• Newer client format: a structured config for the current generation of clients that support the newer protocols.

The usual mistake when copying isn't the format but the length. The link often ends in a string of parameters, and it's easy to stop selecting a character or two short — the client then reports an invalid subscription or shows an empty list. After pasting, check the character count, or just copy it again and overwrite.

Step 2: Import into your client

Importing isn't complicated in itself; what varies is how each platform handles it. Follow the order below — every step has something you can observe, so if it doesn't appear, stop there.

1. Install the client for your platform

   Windows, macOS, Android, iOS and Linux all have builds. On desktop, prefer a client that supports TUN mode — it also captures apps that ignore the system proxy.

2. Add a subscription

   In the client's Subscriptions or Configs section, add a new entry, paste the whole link, and give it a name you'll recognise, such as Primary route, so it doesn't get mixed up when you change devices later.

3. Update it once manually

   Save, then update manually straight away and wait for the node list to refresh. Most clients can update on a schedule, so a daily fetch is enough — no need to click repeatedly.

4. Pick a node and connect

   For the first route, pick a node in the region closest to you with the IEPL type — confirm that it connects at all first, then switch to others as needed.

5. Turn on the system proxy or TUN

   Skip this and everything before it is wasted: the client says connected while the browser still uses the local network. On desktop, enable the system proxy or TUN; on mobile, allow the VPN configuration when the system prompts.

Differences between platforms

• Windows / macOS: the system proxy only covers apps that respect system settings, while TUN mode takes over all traffic — it needs administrator rights but has the best compatibility.
• Android: per-app proxying is supported, so only chosen apps go through the route; battery optimisation may kill background processes, so whitelist the client in system settings if you need it running long-term.
• iOS: it uses a system-level VPN configuration, and after switching networks or sitting in the background for a long time it usually needs reconnecting once.
• Linux: command-line clients are easy to script, graphical clients suit everyday desktop use, and both read the same subscription.

When the protocol doesn't match

Common protocols in a subscription include Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC. If the client is too old, protocols it doesn't recognise show as unsupported and the whole node list greys out. That's not a broken subscription — update the client, then come back and refresh the subscription once.

Step 3: Choose a route

Node lists run to dozens or hundreds of entries; filtering on two dimensions is enough — region first, then type. Region depends on which country the service you want is in; type decides how stable the path is.

For video, favour nodes marked as streaming-capable; for meetings, remote desktop and online games, favour IEPL dedicated lines — the path is fixed and jitter is low, so they won't drop out at the worst moment. A relay is enough for everyday research; there's no need to crowd onto the dedicated lines. On protocols, Hysteria2 and TUIC hold up better on lossy networks, while Shadowsocks and Trojan are more compatible and easier on older devices.

Once you've chosen, don't commit to long-term use straight away. Run two or three nodes for a while each, note which one stays stable at peak hours, pin that one and keep the rest as backups.

Step 4: Verify connectivity

A client showing Connected only means the local tunnel is up; it doesn't mean traffic actually leaves through the route. Confirm with three checks: exit IP, DNS resolution, and per-app scope.

Check the exit IP

Once connected, open any page that shows your IP and see whether the location matches the region you picked. Then disconnect and refresh again — only two different results prove traffic really went through the route. If both are the same, the problem is that the proxy isn't taking effect, not that the route is slow.

Check DNS resolution

IP alone isn't enough. If DNS queries still go to your local ISP, you end up with an overseas IP but local resolution: some sites treat that as suspicious, and you may be resolved to a more distant node. Use a DNS leak test page to see where the resolving server sits — it should match the exit region to count as clean.

Check the per-app scope

Android's per-app proxy and TUN mode on desktop can both leave a program outside the proxy while it's running. Add the app to the proxy list, or switch temporarily to global mode and try again — comparing the two results tells you where the problem is.

• ✅ The exit IP's location matches the chosen node's region, and reverts to your local IP when disconnected.
• ✅ The DNS resolver sits in the same region and doesn't fall back to the local ISP.
• ✅ The target app is inside the proxy scope, and the browser and other programs behave the same.
• ❌ Watching the status light without checking the IP — Connected doesn't mean traffic took the route.
• ❌ The browser has its own encrypted DNS enabled, bypassing the system resolver and producing results that don't match the route.

Common snags and a self-check list

Work through the items below in order; most can't-connect cases can be pinned down yourself without reinstalling the client over and over.

1. The subscription won't load: check first whether the link was truncated, then the client version, then the system clock. VMess and VLESS are time-sensitive — a few minutes of drift is enough to fail the handshake, so set the clock to sync automatically.
2. Every node is grey: the protocol isn't supported by the current client — update the client and refresh the subscription again.
3. Connected but pages won't open: the system proxy isn't on, or a browser proxy extension is overriding the settings. Disable the extension first, then check the system proxy state.
4. Only some apps fail: per-app proxying has excluded the target app, or that app uses its own DNS. Switch to TUN or global mode to check once.
5. Speeds swing up and down: changing route type helps more than repeated speed tests. At peak hours prefer IEPL dedicated lines; off-peak, switch back to a relay.