Here’s the short version: a subscription provides configuration to a client, a node is a connection option, a route describes the network path, a protocol defines how data is exchanged, and traffic routing determines which requests use a proxy. These terms refer to different parts of the setup. Knowing the difference helps you work out whether an issue lies with the configuration, the network, or the app itself.
What people casually call a “VPN client” is sometimes actually a proxy client. A traditional VPN usually creates a network-layer tunnel, while a proxy tool may handle only selected apps or connections. Some proxy clients can also route traffic through a virtual network adapter. Similar names in an interface don’t mean every app automatically follows the same path.
What are subscriptions, clients and nodes?
A client is software that runs a configuration; a subscription is a way to get that configuration; and a node is a connection entry within it. Having a plan on your account doesn’t mean the client has a working configuration. Seeing nodes in the client doesn’t mean your device’s traffic is being routed through it.
| Term | What it means | Common misconception |
|---|---|---|
| Plan | The data allowance and usage terms included with your account | A plan isn’t a configuration file you can import directly |
| Subscription link | The address a client uses to retrieve nodes or configuration, usually containing access credentials | It isn’t an ordinary sharing link or an installer |
| Client | Software that reads configuration and handles connections and traffic routing | Clients don’t all support the same formats and protocols |
| Node | A connection entry containing details such as a server address, port, authentication and protocol | The displayed region may not be where the first server in the route is located |
| Policy group | A collection of nodes or selection logic that rules can refer to | After choosing a policy group, check which option is actually selected within it |
“Update subscription” usually means fetching the remote configuration again. It doesn’t renew your plan or reset your data allowance. If your plan has expired, updating won’t restore your benefits. If the service has changed its nodes, the client may get the new entries after an update. A node-only subscription also differs from a full configuration subscription: it may not include traffic-routing rules or DNS settings.
Route types: direct, relayed, and dedicated
A node is more like a connection entry shown in the client; a route describes how traffic reaches its exit point. The entry point is the first server your device connects to, while the exit point is the address seen by the destination website. They may be in different regions, so a node name, entry address and exit IP can show different locations.
Direct connections generally mean your device connects to an overseas server without an additional relay arranged by the provider. “Direct” doesn’t mean a physical fiber-optic connection all the way there; traffic still passes through carriers and internet routing. Performance depends on your local network, international connectivity and the destination server.
A relay typically means your device connects to an entry server, which then forwards traffic to the exit point. A well-chosen relay route may improve reachability over international links, but congestion at the entry point or a detour can add latency. An extra forwarding step isn’t necessarily slower; the whole route matters more than the node name.
An IEPL dedicated line is an international Ethernet private line, a term describing the transport path. In a subscription service, using a dedicated line for one segment doesn’t mean the entire path from your home to the destination website is exclusive to you, nor does it guarantee that an app connection will work. Consider the dedicated line, entry-point load, exit quality and local access separately.
Choosing a route: First check whether the target app works on your own network, then compare how consistently it performs. Don’t judge a route by the words “dedicated line,” geographic distance or a response indicator in the node list alone; none of these replaces testing the full connection.
Protocols define how data is transmitted, not the entire experience
A protocol defines how a client and server authenticate, encapsulate and transmit data. Shadowsocks, VMess, Trojan, VLESS, Hysteria2 and TUIC are common proxy protocol names, not regions or plan tiers. The client must support the protocol and its specific configuration, and the client and server settings must match.
How to understand common protocol names
- Shadowsocks: An encrypted proxy protocol. Both ends need to support the same encryption method and configuration; support for extensions can vary between implementations.
- VMess: A proxy protocol with authentication and encryption mechanisms. A significantly inaccurate system clock may interfere with authentication, so keep your device’s time correct.
- Trojan: Usually uses TLS to protect communications. Settings such as the server name, certificate verification and connection address need to work together. Disabling certificate verification isn’t a suitable routine fix.
- VLESS: The protocol itself doesn’t provide general-purpose transport encryption, so it needs to be paired with an appropriate secure transport mechanism. The name alone doesn’t tell you which transport or security settings are in use.
- Hysteria2 and TUIC: Both are based on QUIC, which relies on UDP. If your local network restricts UDP, connections may be blocked. The protocol names alone don’t tell you which will work better on your network.
TLS, WebSocket, QUIC and the proxy protocols above aren’t terms from the same layer. TLS provides secure transport, WebSocket is a way to carry communications, and QUIC is a secure transport protocol based on UDP. When several of these names appear in a configuration, they usually work together at different layers.
This article explains these terms; it doesn’t mean VPNHigh supports every protocol listed. Check the dashboard, client and current subscription configuration for the protocols actually supported. For beginners, a compatible configuration is usually a safer choice than changing low-level settings yourself.
Traffic routing, rule-based mode, and global mode
Traffic routing uses rules to decide where connections go—for example, directly, through a proxy or nowhere. Rules can match domains, destination addresses, app processes and other conditions, depending on the client and platform. Many clients evaluate rules in order: once a connection matches an earlier rule, later rules no longer determine its route.
Rule-based mode applies different rules to different requests. Global mode typically sends all traffic captured by the client through the selected proxy policy. Direct mode sends requests handled by the client straight to their destinations. Global mode doesn’t mean every connection on your device must use the proxy; traffic the client doesn’t capture may still follow its usual route.
System proxy settings generally affect only apps that follow them. Some programs use their own networking stack and need to be configured within the app. TUN mode captures network traffic through a virtual network adapter and usually covers more traffic, but it’s still affected by routing, exclusions, permissions and DNS settings. Changing modes and capturing traffic are related, but not the same thing.
DNS resolution and exit checks
DNS translates domain names into addresses that can be reached. A failed connection may be caused by a problem during name resolution or after an address has been returned. Switching nodes won’t necessarily fix incorrect DNS settings, and changing DNS won’t fix authentication failures or an unreachable exit point.
A DNS leak occurs when DNS requests don’t follow the intended route and are sent to a different resolver. The resolver’s location alone doesn’t prove there’s a leak: the proxy exit and DNS resolver can be in different locations. Check the intended configuration, client logs and whether your browser has its own encrypted DNS enabled.
Start by checking your browser’s current exit IP on the IP check page, then review the client’s connection logs. A browser exit that matches your expectations only confirms the route for that browser request; it doesn’t prove that background apps, DNS requests or traffic over other address families follow the same route.
If a webpage loads but a particular app doesn’t, check whether the client is capturing that app’s traffic. If a domain returns an error but the node connects, check the DNS logs first. When contacting support, distinguish between “DNS resolution failed,” “connection timed out,” “authentication error” and “website refused the connection”—that’s more helpful than saying the network is broken.
From importing a subscription to verifying the connection
Client interfaces and system permissions differ across Windows, macOS, iOS, Android and Linux, so the menus from one platform may not match another. Desktop clients may distinguish between a system proxy and a virtual network adapter. Mobile devices usually require a system network extension or VPN permission; Linux setups may also involve a service process and routing configuration. Granting permission doesn’t mean the node has been verified.
- Check your account and plan status. VPNHigh lets you create an account with a username, without an email address. Sign in to the dashboard and get your subscription, then check your current benefits before configuring the client.
- Choose a compatible client and import the configuration. Check the client download options in the dashboard and follow the instructions for your platform. After importing, you should see a configuration or node list. If the client says the format isn’t supported, first check that you selected the right subscription format.
- Check the policy group and traffic capture settings. Select a node, enable the system proxy or TUN feature you need, and grant the required system permissions. Don’t stop at selecting a node.
- Test a real request. Open the target website and check the exit IP and connection logs. A successful node check is only an indicator; test the website, sign-in or app request you actually need to use.
- Keep details you can use to reproduce the issue. Note your platform, client name, mode, displayed node name and what went wrong. Change one type of setting at a time so you can tell what made a difference.
- ✅ Import error: Check that the subscription address is complete, the format is supported, and the client can retrieve the subscription.
- ✅ Node connects but an app fails: Check rule matching, the selected policy group and whether the client is capturing the app’s traffic.
- ✅ Exit region doesn’t match: Check whether you’re still in direct mode, selected the wrong policy, or your browser is using a different proxy.
- ❌ Don’t post your subscription link publicly to troubleshoot, and don’t change nodes, DNS and all your rules at once.
For platform-specific steps, see the Guides. For account or subscription access issues, visit the Help page. For iOS client downloads and permissions, follow the rules shown in the dashboard.
Updating a subscription doesn’t reset your data
“Subscription” commonly has two meanings in this industry: a paid service plan, or a link a client uses to retrieve configuration. An expired plan, exhausted data, an invalid subscription link and outdated local configuration are different issues. Check your account status, data usage, retrieval errors and last update separately.
VPNHigh monthly subscriptions reset data on the same day each month that the plan was activated. Data packages never expire and remain available until used. Updating a subscription in the client only attempts to retrieve configuration; it doesn’t change billing or restore used data. Unlimited devices don’t mean unlimited data. Check the plan details for the available data allowance.
Troubleshooting checklist for beginners: First confirm your plan is active, then check that the configuration was imported, followed by the node and policy. Finally, verify traffic capture, rules and DNS. Separating what your account includes, what the client received and how traffic actually flows is usually more useful than reinstalling everything.