If you're new to VPNs, start by separating subscriptions, nodes, protocols, and split tunneling: a subscription provides configuration, a node determines the connection's entry and exit points, a protocol defines how data is transmitted, and split tunneling determines which requests take which route. These are different settings and can't replace one another. When a webpage won't load, identifying which layer is causing the problem is more useful than repeatedly switching nodes.
Subscription: plan benefits and configuration links are not the same thing
On a plan page, “subscription” usually means paid access. In a client, it often means a subscription link. The former tells you how long you can use the service and how much data is included; the latter is an address used to retrieve nodes and configuration. Importing a link doesn't grant new paid benefits, and deleting a local configuration usually doesn't cancel a plan.
A subscription link may provide only nodes, or it may also include rules, policy groups, and DNS settings. What it contains depends on the server's output format and the client's capabilities. When you select “Update subscription,” the client retrieves the latest remote content. This won't reset your plan's data allowance or fix a problem with your local network.
Nodes, exit points, and route types: what each one describes
A node is a connection profile you can select in your client. It typically includes a server address, port, authentication details, and protocol settings. The region in a node's name usually describes its exit point, but the name itself doesn't prove where that server is located. The entry point may be near you, while the exit point is the apparent source of your connection to the destination website; they don't have to be in the same region.
A route type describes the path traffic takes, not the protocol used. Think of a node as a selectable journey and the route type as the road it follows. These common terms describe typical setups; they are not additional claims by VPNCab about the type or performance of any specific node.
| Route type | Typical path | What to consider |
|---|---|---|
| Direct | The client connects to a server outside mainland China through the local network, without an additional relay entry point configured by the service provider. | Performance depends on your local ISP and the international route. Fewer hops don't necessarily mean a faster connection. |
| Relayed | Traffic first reaches a relay server, which forwards it to a subsequent node or exit point. | Performance depends on the entry point, forwarding route, and exit point. A region name alone isn't enough to judge quality. |
| IEPL dedicated line | Usually means that some segments of the route use an international Ethernet private line. | It doesn't mean every segment—from you to the entry point or from the exit point to the destination website—is on a dedicated line, nor does it guarantee access will succeed. |
When choosing a node, first check which regions the destination service allows you to use, then consider how the connection works for you in practice. IP geolocation can vary between databases. Changing your exit point won't automatically change your account region, billing region, or the service's terms.
Protocol: the transmission rules shared by a client and server
A protocol defines how a client authenticates, encapsulates, and transmits data. Proxy protocols are not the same as VPN tunneling protocols built into operating systems. Some proxy clients use the system VPN interface or a virtual network adapter to route traffic, but that doesn't turn the underlying proxy protocol into a different protocol.
- Shadowsocks: An encrypted proxy protocol that requires compatible encryption methods and credentials at both ends. Some extensions also require an additional plugin, so the name alone doesn't tell you whether a client can use it.
- VMess: A proxy protocol with authentication and encryption mechanisms. A working connection also depends on settings such as the underlying transport, so a server address alone isn't enough to configure it.
- Trojan: Typically carries proxy traffic over TLS. Certificate validation and the server name affect the connection. If you see a certificate error, disabling validation shouldn't be your routine fix.
- VLESS: The proxy protocol itself doesn't encrypt content and is typically used with a security layer such as TLS or REALITY. The name VLESS alone doesn't tell you how secure the complete connection is.
- Hysteria2 and TUIC: QUIC-based proxy protocols that rely on UDP network support. They may fail to connect if UDP is restricted or the client implementation is incompatible, even when other nodes work.
These protocol names explain options you may see in a client; they don't mean VPNCab offers every protocol listed. Check your dashboard configuration and the client's supported protocol list. No protocol name alone determines connection speed: network routes, congestion, device load, and configuration all matter.
Split tunneling, rule mode, and global mode: where requests go
Split tunneling determines where a request goes when it's sent. Rules can match domains, destination IP addresses, or application processes, and commonly route traffic directly, through a proxy, or block it. Rule mode evaluates each item against the configured rules. Global mode usually sends traffic captured by the client through the selected proxy policy, but apps the client doesn't capture may not be affected.
A system proxy usually works only with apps that follow the system proxy settings. TUN mode routes IP traffic through a virtual network interface and often covers more apps, but is still subject to routing, permissions, and exclusion settings. Don't assume that enabling the system proxy routes every connection on your device through the proxy.
A policy group sits between rules and nodes. For example, a rule can send a request to a policy group, which then selects a node. If switching nodes doesn't change how a webpage behaves, the request may match a direct-connection rule, or you may have changed a policy group that the active rule doesn't use.
For everyday use, prefer rule configurations that are clearly maintained.When troubleshooting, you can temporarily switch to global mode to see whether rule matching is the cause, then restore the settings that suit your regular use. Global mode controls routing; it isn't a switch for stronger encryption or greater privacy.
DNS and privacy: a page loading doesn't mean the check is complete
DNS translates domain names into addresses. A client may use different resolution methods for direct and proxied requests, and your browser may enable encrypted DNS on its own. DNS results, connection routes, and exit regions are related but distinct: a DNS query going through a particular region doesn't mean the webpage connection uses the same exit point.
A DNS leak generally means that queries expected to use a controlled route are instead sent to an unintended resolver. If your configuration deliberately connects to local websites directly and uses local DNS, seeing a local resolver doesn't by itself prove anything is misconfigured. Check it against the rules you expect to apply.
To investigate, first identify which domains should use the proxy. Then review the client's request logs and DNS settings, and cross-check them with a DNS test page. Don't share logs containing credentials publicly. Anonymous, no-logs policies describe a service's privacy practices; they don't prevent websites from identifying visitors through sign-in status, cookies, or other browser data.
From import to connection: follow these steps
- Check the client source and compatibility.Get the client from the service's instructions or a trusted release channel, and confirm it supports the subscription format and protocols you need. Don't submit your link to an unfamiliar online conversion tool.
- Import and update the configuration.Use the client's subscription import option and check that it successfully retrieves the nodes. If the client only offers file import, confirm the required format first; don't paste a webpage address as if it were configuration file contents.
- Choose a node and policy.Check the active configuration, policy group, and selected node. Follow the guide to enable the system proxy or system VPN interface. When a network permission prompt first appears, verify which app triggered it.
- Test with a real destination.Open the webpage or app you actually need and check loading behavior and connection logs. A “Connected” status only means that one part of the connection has been established; it doesn't guarantee that the destination service is accessible.
- If something goes wrong, adjust one setting at a time.Check your local network first, then the subscription update, protocol support, rule matching, and DNS. Keep the original configuration so you can identify the cause.
How do clients differ across platforms?
Windows and macOS clients commonly offer system proxy and virtual network adapter options; using a virtual adapter may require additional permissions. iOS and Android clients often route traffic through the system VPN interface. App-level split tunneling depends on the operating system and client implementation. Running another tool that uses the same interface at the same time may cause conflicts.
On Linux, also check whether your desktop environment, command-line programs, and background services follow the same proxy settings. Some command-line tools read environment variables; others require separate options. Support for a platform doesn't mean clients on every platform have identical button labels, protocol support, or split-tunneling features.
Understanding plan pages: check data allowances separately from connection settings
Technical settings determine how you connect; your plan determines the resources available to you. VPNCab monthly plans are ¥9.9/month for 60GB, ¥18/month for 250GB, and ¥28/month for 500GB. Data resets monthly on your activation date. If you upgrade mid-cycle, the price difference is prorated for the remaining days; don't assume your data allowance will automatically reset immediately.
Data packs cost ¥158/300GB, ¥358/1000GB, and ¥658/3000GB. They last until used and never expire. Compare monthly plans and data packs based on how often you use the service. Unlimited devices doesn't mean unlimited data: VPNCab allows unlimited simultaneous devices, but each plan still has its own data allowance.
- ✅ Before importing: Check that your client supports the format, and keep your subscription link secure.
- ✅ After connecting: Test access to the destination you need instead of relying only on the node status.
- ✅ When comparing plans: Check data allowance, reset schedule, validity, and refund terms.
- ❌ Don't treat “global,” “dedicated line,” or a protocol name as a guarantee of performance.
VPNCab requires no email address; you can get started with a username and password. You can request a full refund for any reason within 14 days of your first payment. Find client setup instructions in the Guides, check plan terms on the Plans page, or browse common questions in the Help Center.
A beginner's checklist: configuration, route, rules, and plan benefits.First, check whether the subscription imports correctly. Then verify node and protocol compatibility, check how requests are routed, and finally review data allowances and billing. Keeping these layers separate makes the similar-looking switches in a client easier to understand.