What Is a VPN? A Beginner’s Guide to Subscriptions, Servers, Protocols, and Routing

Strictly speaking, a VPN is technology that creates a virtual private connection over a public network. In everyday conversation, people also use “VPN” to refer broadly to proxy clients and subscription services. To understand these products, start by distinguishing subscriptions, servers, protocols, and routing rules: they determine where configuration comes from, what you connect to, how the connection works, and which route each request takes.

These concepts belong to different layers. More servers don’t necessarily mean more independent exit IPs; a newer protocol doesn’t guarantee a faster connection on your network; and a client showing “connected” doesn’t mean every app is using it. The sections below explain how setup and access work in practice, so you can distinguish plan details, route labels, and client features.

VPNs vs. proxies: start with what they cover

A traditional VPN typically connects a device to another network through a tunnel. A proxy forwards specific connections through an intermediary service. Modern clients may offer both a system proxy and a virtual network interface, making the two feel similar in use. But an app’s name alone doesn’t tell you how it works.

System proxy settings are made available to the operating system or apps, but whether they’re followed depends on each app. Some programs bypass the system proxy. TUN mode uses a virtual network interface to capture traffic and pass it to the client. It generally covers more traffic, but is still subject to routing rules, exclusions, permissions, and protocol support.

Mobile operating systems often label these connections as VPN in their status display. That only indicates that a related network feature is enabled; it doesn’t confirm the exit region, routing behavior, or DNS path. If a browser works but other apps don’t, check what traffic the client captures before assuming there’s a server-side problem.

Glossary: From Configuration to Connection

Term	What it means	Common point of confusion
Client	Software on your device that reads configuration, establishes connections, and applies routing rules.	An app being installable doesn’t mean it can read every subscription format.
Subscription link	An address a client uses to retrieve or update servers and related configuration.	It isn’t a billing period, and may not include a complete set of routing rules.
Server	A connection profile containing details such as an address, port, credentials, and protocol.	Different names may share the same entry point, exit, or parts of a route.
Entry and exit	The entry point receives the connection; the exit connects to the destination website.	The region a website detects is usually closer to the exit than to the entry point.
Protocol	The format and communication method a client and server use to exchange data.	A protocol’s name alone says nothing about bandwidth or network congestion.
Proxy group	A collection of candidate servers for manual selection, automatic testing, or failover.	Automatic selection depends on the test target and the client’s implementation.
Routing rule	A rule that directs, proxies, or blocks traffic based on criteria such as domain, address, or process.	When a rule matches a proxy group, check which server the group actually selected.
DNS	A mechanism that translates domain names into network addresses.	Website traffic and DNS queries may take different routes.

Think of the process this way: the client receives a request, identifies its destination, matches a rule, selects a proxy group, and connects to the corresponding server. DNS lookups may happen at different stages or be handled remotely. Following this chain step by step gives you a clearer basis for troubleshooting than repeatedly switching servers.

A Subscription Link Isn’t a Paid Plan

A paid subscription describes a plan, such as one that provides traffic on a monthly basis. A subscription link is an entry point for configuration; refreshing it updates the configuration, not your billing. These links often contain credentials, and anyone who obtains one may be able to access server details and use account traffic. Treat it like a password.

Common configuration formats include single-server share links, server collections, and complete configuration files. A single-server link usually describes connection parameters; a full configuration may also include proxy groups, routing rules, and DNS settings. Configuration syntax varies by client, and a successful import doesn’t necessarily mean every field is supported.

Check the official documentation for your device platform and recommended client first. F4VPN’s dashboard download section provides client information.
In the dashboard, choose the subscription format that matches your client and import it using the client’s subscription feature. Don’t paste the link into a public conversion website.
After updating, check that the server list appears. Review any messages or logs for errors such as unsupported fields or parsing failures.
Select a server in the proxy group, make sure the system proxy or relevant traffic-capture mode is enabled, then test apps that should use the proxy and apps that should connect directly.

Direct connections, relay routes, and IEPL dedicated lines: what’s the difference?

Route types describe the network path, not the protocol used by the client. A direct route usually means the device connects straight to an overseas service entry point, with cross-network traffic relying on public internet paths along the way. Here, “direct route” may still involve proxy forwarding; it’s not the same as connecting directly to a destination website under a routing rule.

A relay route usually adds an access or forwarding step: the device connects to an entry point first, which then connects to another server. This can change the access and cross-region path, but an extra forwarding step doesn’t automatically make a connection slower or more reliable. Performance depends on the entry point, downstream links, load, and exit.

IEPL dedicated line commonly refers to an international Ethernet private line, typically describing a dedicated transmission segment in a provider’s network. Even when one segment uses a dedicated line, the connections from your device to the entry point and from the exit to a website may not be dedicated. The term doesn’t prove that the entire route is congestion-free, and it can’t replace testing the connection from the client to the destination website.

When comparing routes, first make sure the exit region suits your app, then test them on the same device and network at similar times. A server name is just a label; it can’t prove the physical route, dedicated resources, or website availability on its own. F4VPN covers 90+ countries and 220+ routes. Choose based on the route list and your own experience.

What Protocol Names Tell You—and What They Don’t

Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are all common in the proxy ecosystem, but their configurations aren’t interchangeable. The client must support the relevant implementation, parameters, and transport method offered by the server. The descriptions below cover general concepts and don’t mean F4VPN offers every protocol listed.

Shadowsocks: Forwards traffic using an agreed encryption method and credentials. The client and server must use matching parameters; a server address alone isn’t enough to connect.
VMess: A proxy protocol with mechanisms such as authentication, often used with different transport configurations. Check the client documentation for implementation and configuration requirements.
Trojan: Typically uses TLS to protect traffic. Certificate validation, the server domain, and related parameters affect whether a connection succeeds. Don’t leave validation disabled as a long-term troubleshooting workaround.
VLESS: The protocol itself doesn’t encrypt payloads. It needs an appropriate secure transport mechanism, such as TLS or REALITY; the name alone doesn’t tell you how secure the full setup is.
Hysteria2 and TUIC: Both use QUIC-related technology and typically rely on UDP network paths. Their performance on restricted networks depends on whether the network permits this traffic; the protocol name alone can’t predict speed.

It’s also important to distinguish protocols, transports, and encryption. WebSocket is a transport method, TLS protects communications, and TCP and UDP are transport protocols at a lower layer. A complete server configuration may combine these components, so seeing one familiar field doesn’t mean the others can be omitted.

Routing, Global Mode, and Rule-Based Mode

Rule-based mode chooses how to handle requests according to set conditions. For example, local network resources can connect directly, selected international websites can use a chosen proxy group, and other requests can follow a fallback policy. Many clients match rules in configuration order, so a broad rule near the top may override more specific rules below it. Exact syntax depends on the client’s core.

Global mode generally sends all requests captured by the client through the global policy. It doesn’t mean the device captures all traffic. If only the system proxy is enabled, apps that ignore it may still use the regular network. The global policy may also select a direct connection, so check the proxy group’s contents too.

Rule-based mode is a better fit when work websites and video services need different exits. To check whether a rule is routing a website incorrectly, you can temporarily switch modes for comparison. Restore the original setting afterward to avoid affecting access to local devices, work networks, or other apps.

How to Check for DNS Leaks Across Platforms

A DNS leak generally means domain lookups aren’t following the intended privacy or routing policy and are instead sent through an unexpected resolver path. It doesn’t necessarily mean webpage content is sent in plain text. Conversely, HTTPS on a website doesn’t automatically fix the route used for domain lookups.

Encrypted DNS in the browser, remote resolution by the client, system caches, and in-app resolvers may all be in use at once. Seeing a different DNS provider from the exit provider on a test page doesn’t, by itself, prove a leak. Check the expected configuration, lookup path, and client logs together rather than relying only on the region label shown by a test page.

System proxy settings on Windows, macOS, and Linux may not cover every program, and virtual interfaces may require permissions and routing changes. On iOS and Android, clients are also subject to system network extensions, background policies, and app capabilities. A subscription that imports on multiple platforms doesn’t guarantee identical process rules, DNS behavior, or traffic capture.

✅ First confirm your regular internet connection works, then check that the subscription updated successfully and the credentials are valid.
✅ Check whether the failing app appears in the client logs. If it doesn’t, start by checking which traffic the client captures.
✅ If requests are logged, check the matched rule, proxy group, and final server—not just the connection toggle at the top.
✅ If websites work but an app doesn’t, check the app’s proxy settings, UDP support, and client permissions.
✅ If domain lookups fail, check the browser and client DNS settings, then reconnect and test again after making changes.
❌ Don’t change the protocol, DNS, rules, and server all at once. Even if the problem goes away, you won’t know what fixed it.

When submitting a support ticket, include your device platform, client name, current traffic-capture mode, the app that fails, and a redacted error message. Don’t paste your full subscription. For more on configuration layers, see Routes and protocols. If you’re setting things up for the first time, start with the setup guide.

Finally, keep these concepts separate from plan details: F4VPN has no device limit, but each device still needs a compatible client. Monthly subscription traffic resets on the activation date, while traffic packages remain valid indefinitely until used. You can create an account without an email address using a username and password. Before choosing a plan, make sure your configuration imports and your routing rules meet your needs, then compare traffic allowances and billing options.