VPNbasicsglossaryguide: Subscriptions, Nodes, Routes, Protocols & Routing Rules

Here’s the gist: a subscription provides configuration, a node is a connection option, a route describes the network path, a protocol defines how the connection works, and routing rules decide where requests go. Understanding these differences makes it easier to import a profile and connect without randomly changing settings.

People often call proxy clients VPNs, but they may work differently. A system proxy may affect only apps that follow proxy settings. A virtual network adapter can handle more traffic, but routing and exclusion rules still apply. So a “connected” status alone doesn’t prove that every app uses the same exit.

Subscriptions and nodes: a configuration source, not an installer

In a plan description, “subscription” usually means a service term; in a client, it usually means a configuration source. That’s an easy distinction to miss. A subscription link is an address the client can use to retrieve configuration. Once imported, it tells the client which nodes are available, how to authenticate, and which rules may be included. It isn’t a client download link or a webpage that connects you automatically when opened in a browser.

A node is a connection option in the configuration, usually made up of a server address, port, authentication details, and protocol settings. Region labels help you choose, but they don’t prove the network route. Nodes in the same region may use different entry and exit points, while differently named nodes may share some infrastructure.

Updating a subscription retrieves the latest configuration published by the service. It doesn’t change your plan or clear the client. If the service changes its nodes, an older configuration may stop working; updating can sync those changes, but it won’t fix a local network issue. Before editing subscription-generated nodes manually, check whether the next update will overwrite your changes.

Routes: IEPL dedicated lines, relays, and direct connections

A route describes how data travels from your device to its exit point. A direct connection usually means the client connects straight to a server outside mainland China; a relay adds a forwarding point along the way. IEPL is a dedicated international Ethernet service provided by a carrier. A service may use a dedicated line on only part of the route, so “dedicated line” in a plan description doesn’t mean the entire path from your device to a website is exclusively reserved for you.

It’s also important to distinguish the entry point from the exit point. The entry is where your device connects first; the exit is the source location seen by the destination website. The exit region may affect content catalogs and account risk checks, but websites may also consider account region and other signals. A route label isn’t a guarantee that a streaming service will work; access still needs to be tested.

Protocols: connection methods, not a speed ranking

A protocol defines how the client and server exchange data, verify identities, and protect traffic. Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are common protocol names, but they aren’t interchangeable options in every client. The client’s core, version, and server configuration all need to be compatible.

Shadowsocks is an encrypted proxy protocol, and both sides need to support compatible algorithms. VMess has its own authentication and encryption mechanisms. Trojan typically protects connections with TLS; VLESS doesn’t encrypt data on its own and is often paired with TLS or another secure transport. So a protocol name alone doesn’t tell you how the entire connection is protected.

Hysteria2 and TUIC are based on QUIC, which uses UDP. They may fail to connect on networks that restrict UDP. But UDP doesn’t automatically mean faster: congestion control, local packet loss, server resources, and route quality all affect performance. Beginners should use configurations explicitly supported by their service and avoid changing protocols, transport settings, or certificate options at random.

If your client reports a TLS certificate error, first check the system clock, server name, and whether the configuration has expired. Don’t turn on “skip certificate verification” just to dismiss the warning; doing so weakens checks on the remote server’s identity. This article explains industry terminology and doesn’t mean JiuVPN supports every protocol listed.

Routing rules and modes: match a rule, then choose an exit

Routing rules direct requests based on a domain, address, or other condition. Common actions include direct, proxy, and reject. Rule mode checks the configured rules in order and usually applies the first matching rule; if none matches, it uses a fallback policy. A rule set is a reusable list of matching criteria, while a policy group chooses from available nodes. They serve different purposes.

“Global mode” usually sends all requests that reach the proxy core through a selected policy. “Rule mode” handles requests according to individual rules. But global mode doesn’t mean the entire device is covered: traffic from apps that never reaches the core may be unaffected. Global mode and a virtual network adapter solve different problems: one determines how traffic is routed, while the other affects which traffic is captured.

For everyday use, start with the rules provided by the service. If a particular site won’t load, check which rule matched the request and which exit it used. Switching between global and rule mode repeatedly can make a node problem hard to distinguish from a routing mistake. Change one setting at a time and keep the original configuration so you can tell what made a difference.

DNS and leaks: a working website doesn’t confirm the DNS route

DNS translates domain names into addresses. Proxy traffic and DNS queries don’t necessarily follow the same route: an app may use the system resolver, its own encrypted DNS, or a client’s remote-resolution or fake-IP setup. A website loading only shows that the connection works; it doesn’t confirm that DNS queries followed the expected path.

A DNS leak generally means that a query didn’t follow the expected resolution path, allowing a party you didn’t intend to receive it to see the domain request. To check, consider DNS settings in the client, operating system, and browser rather than relying on a test site’s reported region alone. A routing configuration may deliberately resolve direct-connection domains locally; that’s different from a misconfiguration.

Encrypted DNS in a browser protects the DNS query in transit; it doesn’t automatically send website traffic through a proxy. If you encounter a resolution error, first restore the DNS settings recommended by the service, then check for separate browser settings. Avoid piling on rules and resolver addresses from multiple unknown sources.

Client setup: from dashboard to connection check

Choose a compatible client before importing your subscription. Not every app supports the same subscription format: being able to open a link doesn’t mean the app can parse its configuration. If you see a “format error,” first check the import method provided in the dashboard rather than editing parameters in the link. JiuVPN client downloads and subscription links are available after you sign in.

1. Check platform and source. Download a compatible client from the service’s official download page and follow the installation guide for your platform. Don’t overwrite the current client’s configuration with a file meant for a different core.
2. Get the right subscription. Find the subscription option in your user dashboard and choose the import method for your client. If importing via a copied link, paste the full address into the subscription URL field, not a single-node editor.
3. Update and check the result. Make sure the node list appears. If it’s empty, check for subscription retrieval or parsing errors, your local network, whether the link is complete, and your account status. Don’t just keep clicking Connect.
4. Choose a node and mode. Start with the default rules and a node you can select. If your system asks to add a network configuration or grant virtual adapter permissions, make sure the prompt comes from the client you just installed.
5. Test the app you need. Open the target website or app, then check the client’s connection log for the matched rule and exit. If your browser works but another app doesn’t, first check which traffic the client is set to capture.

On Windows, macOS, and Linux, common connection methods include a system proxy and a virtual network adapter; the latter may require extra permissions or components. Android usually captures traffic through the system VPN interface, while iOS clients typically need to add a system network configuration. Menus vary by client, and not every app on a platform supports the same features.

JiuVPN clients for Windows, Android, macOS, and Linux are available to download after signing in; the iOS link requires an active plan. The download page and subscription page serve different purposes, so you’ll still need to follow the setup instructions after downloading the app. Get a client from the user dashboard, and see the platform guides for setup instructions.

Connection checklist: find the cause before changing settings

A successful node test doesn’t guarantee that everything works as expected. A client test may only check whether a connection can be established or a test address reached; video calls, websites, and file syncing may use different paths and transport methods. Start troubleshooting with the specific symptom: can’t update the subscription, can’t connect, or only one app is having trouble?

• ✅ Disconnect the proxy to confirm your local network works, then check that the client updated the subscription successfully.
• ✅ Make sure the selected policy group points to a working node, not direct, reject, or an inactive option.
• ✅ Check the matching rule and exit for the affected request to tell a route issue from a rule mismatch.
• ✅ Compare your system proxy, virtual adapter, and app settings to confirm the target app’s traffic reaches the client.
• ✅ When submitting a support ticket, include your platform, client, error message, and steps to reproduce the issue. Hide any access credentials.
• ❌ Don’t run multiple clients that capture network traffic at the same time; their routing, proxy, and DNS settings may conflict.

If only one website fails on the same node, the cause may be the website’s own status, account requirements, or restrictions on the exit address. Trying another node can help you compare, but it doesn’t prove that a protocol has “stopped working.” Keeping the error message is more useful than repeatedly reinstalling the client. Clear reproduction steps also help support distinguish configuration problems from route issues.