Complete handbook · 90+ countries / 190+ routes

Complete Guide: From Sign-Up to Stable Connection

Eight chapters, in order: first understand what the service is made of, then decide which tier to buy, then activate, get your subscription, install a client, verify the connection, and finally handle renewals and advanced configuration. Read it in sequence and you won't need any other reference.

This page is a reference manual, not a three-minute quick fix. The site also has a Quick Start that follows the shortest path — sign up, pay, import, connect, four steps and done. The split is simple: if it's your first time and you just want the connection working, read Quick Start; if you want to weigh the differences between tiers, understand why a subscription link must never be shared, get set up on five devices running different systems, and troubleshoot on your own later, read this page. The two documents don't contradict each other — terminology and figures match exactly, so you can read them side by side.

CHAPTER 01

What this service is: subscriptions, routes and clients

VPNQK is a subscription-based cross-border network acceleration service. What it does is concrete: it builds an encrypted tunnel between your local device and the destination site, carrying requests from your local carrier network into an international link whose quality is more controllable, then out to the public internet from the exit side. In practice you notice two changes — overseas services that used to fail or drop out become usable, and connections that used to stutter at peak hours become steady. It doesn't change the destination site, and it doesn't change any other setting on your device.

A subscription consists of four things

Understand how these four divide the work and every later chapter gets easier. First, the account, made up of a username and password; no email address is needed at sign-up, which is the most convenient part of getting started here — no verification mail to wait for, no inbox to dig through. Second, the data allowance, set by your monthly tier: the ¥9.9 tier includes 60GB, the ¥18 tier 250GB and the ¥28 tier 500GB, reset monthly on your activation date. Third, the route pool, covering 90+ countries and 190+ routes, split into dedicated, relay and direct types; you pick one when connecting. Fourth, the client, the program running on your device that sends traffic into the tunnel according to your rules.

All four are needed, but they change on completely different schedules: the account and data allowance follow your order, the route pool is maintained on the service side — you just refresh your subscription to see changes — and the client is locally installed software that stays on whatever version you installed unless you update it. Many "why does it work for them and not for me" differences come down to client version or a subscription that was never refreshed.

How the three route types differ

Route type is the single most important piece of information when picking a line, because it decides how steady that path is at peak times. Dedicated routes run over carrier-grade point-to-point links that skip congested public internet nodes, at the cost of being expensive and usually limited to popular regions. Relay routes connect to an intermediate node first and hop from there — the best value, and the default for most everyday use. Direct routes connect straight from your location to the entry point in the target region: the shortest path, but the most exposed to the quality of your local carrier's international gateway.

Route types by use case; the route list in your panel is the authoritative source for what's available
Route typePath characteristicsBest forPicking advice
IEPL dedicatedPoint-to-point dedicated link that avoids public peering congestionPeak-hour video, long meetings, large file transfersUse as your main route; switch back to it first when things stall
RelayConnects to an intermediate node, then hops to the target regionEveryday browsing, AI tools, social and shoppingDefault choice; enough for most situations
DirectLocal direct connection to the target region's entry point, shortest pathQuick lookups, low-latency interactionBest when your local gateway quality is good

The route list changes as the service side adjusts; the region count and type labels on this page are indicative — check the panel after signing in.

Billed by data, not by time

This service bills by data volume, not by time online. That means leaving the client running doesn't consume your allowance; only actual upload and download traffic counts. It's worth stressing because many users come from time-based products and habitually disconnect every day, which just adds work. The right approach: keep your usual devices connected and use routing rules to exclude domestic traffic that doesn't need the tunnel, so your allowance is only spent on requests that actually need acceleration.

The number of simultaneous devices is unlimited, so phone, tablet, laptop and desktop can all stay connected — no need to log in and out to "save a slot". The allowance is shared at account level: several devices draw on the same pool.

The client is just a shell; the subscription is the content

Many people treat "download the client" as step one, but the order is the other way round: the client is an empty container, and the subscription link is the credential that fills it with routes. The same client, fed subscriptions from different accounts, shows completely different route lists. So when you change devices, the right move isn't "download the client again" but "install the client on the new device, then import the same subscription". Once that clicks, moving between devices becomes very simple.

On security, the tunnel uses bank-grade encryption, so traffic stays encrypted between your device and the exit. The service side runs a no-logs policy and does not record what users browse. That's a standard industry privacy commitment and part of what this service promises.

CHAPTER 02

Plan choice: three monthly tiers and data packs compared

Choosing a plan answers one question: roughly how much data will you use in a month. The price tiers are clear enough; the hard part is estimating your own usage. This chapter covers the three monthly tiers and the three data packs together, gives you an estimation method, and explains two easily overlooked rules — data reset and upgrade proration.

The three monthly tiers differ only in data

Monthly subscriptions come in three tiers: ¥9.9/month for 60GB, ¥18/month for 250GB and ¥28/month for 500GB. The only difference between them is the data allowance — the route pool, simultaneous device count, payment methods and refund commitment are identical. In other words, buying the cheapest tier doesn't restrict you to slower routes, and buying the top tier doesn't unlock an extra region. The point of that design: on a tight budget you don't have to wonder whether the cheap tier is second class, you just work out how much you'll use in a month.

Data resets monthly on your activation date. For example, if you activated on the 12th, your allowance refreshes on the 12th of each following month, not on the 1st. That's fairer for people who start mid-month, and it means you don't have to wait for the 1st to buy. Your activation date is shown in the subscription details in the panel.

How to estimate your monthly usage

You don't need precision to the gigabyte — just the order of magnitude. A rough grouping:

  • Light: mostly web browsing, messaging, lookups and the occasional short video, with almost no long-form video or large files. This usually fits the lowest tier.
  • Moderate: an hour or two of HD video a day plus normal browsing and social apps, with the occasional software download. Start from the middle tier.
  • Heavy: long 4K streaming sessions, frequent large file transfers, several devices online at once all playing video. Go straight to the top tier, or combine a monthly plan with a data pack.

Video is the main driver of data use: each step up in resolution multiplies consumption per minute, while browsing, chat and document work are small by comparison. So the rule of thumb reduces to one line: video hours and resolution decide your tier; everything else is close to negligible.

Data packs: use them up, they never expire

If your monthly allowance isn't enough, or your usage swings a lot with some heavy months, you can add a data pack. There are three: ¥158/300GB, ¥358/1000GB and ¥658/3000GB. The big difference from a monthly plan is that they are used up, never expiring — they don't reset with the monthly cycle; they last until consumed. That suits seasonal users especially: a stretch of intense project work or binge-watching, then months of near-zero use — a data pack beats upgrading.

Monthly plans and data packs compared; prices and capacities in this table are authoritative
TypePriceDataValidity
Monthly · Entry¥9.9 / month60GBResets monthly on activation date
Monthly · Standard¥18 / month250GBResets monthly on activation date
Monthly · Advanced¥28 / month500GBResets monthly on activation date
Data pack · Small¥158300GBUsed up, never expires
Data pack · Medium¥3581000GBUsed up, never expires
Data pack · Large¥6583000GBUsed up, never expires

Mid-cycle upgrade: the difference is prorated over remaining days

If you find you picked too low a tier, you don't have to wait for the month to end. Mid-cycle upgrades work like this: the price difference is prorated over the remaining days, topping up the rest of the current cycle at the new tier. A simple example — upgrading from the low to the middle tier mid-month means paying only the difference between the two, then using the middle tier's allowance for the remaining half month; data already used isn't wiped and you don't buy a whole extra month. The exact prorated amount appears on the order page before you pay.

Tip Upgrades are prorated over the remaining days of the current cycle, not reset to a calendar month. If only two or three days are left, it's often cheaper to wait for the next cycle or top up with a data pack to bridge those days. The order page shows the prorated figure — just decide based on the amount displayed.

Payment methods and the refund commitment

Payment supports Alipay, WeChat and USDT. Which one you pick is a matter of habit; all three land within minutes, and once payment completes you can refresh the panel to see the allowance. If the service doesn't meet expectations after activation, this service offers a 7-day no-questions refund; chapter seven explains how to request it.

If you're still torn between two tiers, start one step lower: upgrading when you run short only costs the difference, while downgrading means waiting for the next cycle. Low first, high later keeps the cost of trying things out down. For the full price list and what each tier includes, see the plans page; to check route coverage before deciding, the servers page lists regions by group.

CHAPTER 03

Sign-up and checkout: getting started without an email address

This chapter breaks down every step from zero to "allowance credited". The whole flow involves no email verification and no personal details; normally it takes a minute or two.

Step one: create an account

Open the registration page in the user panel; only two fields are required: username and password. No email address needed — username plus password completes registration. This deserves a longer note: many services treat email as the account identity, so you wait for a verification mail, recover a forgotten password by mail, and get completely stuck when your provider blocks the message. This service removes that layer: register and you're done, log in and you're using it.

Three suggestions for the username: moderate length, letters, digits and common symbols only, and nothing resembling your real name or usual handle. Set a unique password and don't reuse it from other sites — that's not a formality, because the account holds your subscription link, and the subscription link is a credential (chapter four explains). Record the password somewhere reliable: with no email to fall back on, a forgotten password means going through the panel's recovery flow, which takes extra time.

Step two: choose a plan and place the order

After logging in, go to the plans area; all three monthly tiers and all three data packs are on the same page. Pick a tier and place the order; the page creates a pending order showing the amount and payment methods. Nothing has been charged yet — the order is awaiting payment.

Three things commonly go wrong at checkout; spelling them out here saves a lot of back and forth:

  • Don't order twice. A slightly slow page transition after clicking order is normal — don't click repeatedly. If two pending orders really were created, the unpaid one won't be charged and can be cancelled from the order list.
  • Check the amount when paying. The figure on the payment page should match the order amount; if it doesn't, stop and start again from the panel.
  • Watch the network when paying with USDT. Use the same network the order page specifies; the wrong network can mean the funds never arrive, and sorting that out is far more trouble than with Alipay or WeChat.

Step three: pay and confirm the credit

With Alipay or WeChat, the success confirmation usually arrives within seconds of scanning or redirecting; USDT waits for on-chain confirmation, which depends on network congestion. After paying, go back to the panel, check that the order status shows as paid, and confirm the allowance in the subscription details has increased.

If payment succeeded but the panel hasn't changed, don't pay again. Work through it in this order: refresh the page; check the order status in the order list; if it still shows pending, the payment callback hasn't arrived — wait a minute or two and refresh again; if nothing changes for a long while, submit the order number through the ticket link in the footer and let the backend check it. A duplicate payment can be refunded, but it means going through a process, so confirm first.

Step four: get to know the panel areas

Once activated, four areas of the panel come up again and again. The overview shows your current plan, remaining data and expiry date; the plans area is for upgrades, renewals and data packs; the subscription area holds the subscription link and client downloads for each platform; the orders area records past orders and is where refund requests start. Learn these four locations and every later chapter stays inside them.

Do it in one sitting Registration, ordering, payment and confirming the credit are best done in one go without long gaps. An order left pending for too long expires and has to be placed again — the account is unaffected, but it's an extra step.

A first impression of refunds

This service offers a 7-day no-questions refund counted from your first payment. The point of that commitment: you don't have to "research for three days before deciding" — buy a tier, use it for a few days, and refund it if it doesn't fit. The exact request path, timing and exclusions are covered in chapter seven; here you only need to know it exists and needs no extra conditions.

CHAPTER 04

Subscription link: formats and security boundaries

The subscription link is the most important string in the whole flow. It determines which routes the client can see, and it defines the security boundary of your account. This chapter explains what it is, how to get it, how to use it, and why it must never be shared.

What the subscription link actually is

A subscription link is an address with a token in it. The client requests that address, the service side returns a list of route configurations, and the client parses it into a selectable node list. So the subscription link is not a "download URL" or an "installer" — it's more like a key: whoever holds it can ask the service side for your account's route configuration.

Copy the full link from the subscription area of the panel. It looks like this:

https://example.com/sub?token=YOUR_TOKEN

That's the example format; the link shown in your panel is the real one. Note that the token at the end is a unique identifier, not a parameter you can swap at will.

Import protocol priority

For the same subscription link, the client may offer several import methods. By compatibility and completeness of features, the recommended order is: clashplus:// first, then Shadowrocket, then Stash, then sing-box, and Clash last. The earlier ones support rule-based routing, automatic subscription updates and node grouping more fully; the later ones are more broadly compatible, suited to older clients or when you're unsure which to pick.

In practice you don't need to memorise the order — most clients detect the best option automatically. If the node list is empty after import, or the rules don't take effect, come back and try another protocol in that order; it usually solves it.

Three security boundaries

The subscription link is equivalent to your account credentials, and that has to translate into concrete behaviour:

  • Don't forward it to others. Anyone with the link can use your account's data allowance, the consumption counts against you, and there's no way to tell who used it.
  • Don't post it in public. Forums, group chats, screenshots, screen recordings and code repositories all count as public. If a subscription link appears in a screenshot, crop it out or mask it first.
  • Reset it if you suspect a leak. The panel offers a subscription reset; the old link stops working immediately and every device has to import the new one. Better to spend two extra minutes than to leave a leaked link active.
Note Don't try converting the subscription link into a "config file to share with friends". The config carries the same token, so it's no different from forwarding the link. If family members need access, the right approach is for each of them to open their own account — or, on a small number of devices, to share your login, knowing that whoever shares it can see your subscription details.

When to refresh your subscription

A subscription isn't a one-off snapshot — routes on the service side change. Refresh manually in three cases: a region suddenly disappears or a new one appears in the client; you changed tiers and the client needs to read the new configuration; or the client hasn't been opened for a long time (a month, say), in which case update before connecting. Most clients support an automatic update interval; once a day is about right — more frequent updates achieve nothing and may hit rate limits on the service side.

The subscription-client relationship, once more

When you change devices, you only need to install the client on the new device and import the same subscription — no new purchase. Conversely, uninstalling the client doesn't affect your account or allowance; install it again and import. The only thing that can really be "lost" is the subscription link itself — if you didn't save it, log into the panel and copy it again; if you reset it, the old link is dead, use the new one.

For how subscriptions behave differently across clients, the VPN terms explained article breaks down subscription, node and protocol in more detail; after reading it the import process will feel much more predictable.

CHAPTER 05

Five platforms: client import, one by one

This service supports five platforms: Windows, macOS, iOS, Android and Linux. Clients for all of them come from the download area of the user panel — marketing pages deliberately carry no direct installer links: both installers and subscriptions require a login, which keeps third-party sites from repackaging them. This chapter goes platform by platform, spelling out what you see and what to do next at each step.

Windows

Log into the panel, open the download area and pick the Windows build. Installation is the usual next-next-finish; on first launch the program sits on an empty configuration screen. Now go back to the panel, copy the subscription link, find the "Subscription" or "Profile" entry in the client, paste the link and confirm the import. Once imported, the node list shows region groups — pick a region, click connect, and wait for the status to read connected.

Two small issues are common on Windows. First, the first connection triggers a system network permission prompt; you must allow it or the tunnel won't come up. Second, if another network tool is installed, routing conflicts can appear as a connected status with no web access — quit the other tool and retry. Turning on launch-at-startup in the client saves opening it by hand every time.

macOS

macOS follows much the same path: download, install, import the subscription, pick a node, connect. The difference is stricter system permissions — the first connection asks you to authorise adding a network configuration, which you confirm in System Settings; on newer system versions a pending prompt may also appear under Privacy & Security, and it only takes effect once you allow it.

Another difference is the menu bar icon. macOS clients usually live in the menu bar, with connection status shown by icon colour; click it to see the current node and upload/download rates. For daily use, close the window and keep just the menu bar icon, opening it when you need to switch nodes. Before uninstalling, turn off the system proxy inside the client, otherwise leftover settings can leave you without internet after removal.

iOS

iOS takes a different install path: get the client from the App Store, open it and choose "import from subscription", then paste the subscription link. On the first connection the system shows an "add VPN configuration" prompt; you must allow it and authenticate with your device passcode. That's a system-level requirement — skip it and no tunnel is built.

One iOS behaviour is easy to misread: after connecting, the VPN indicator appears in the status bar, yet some apps still go direct. That's usually not the client's fault but the app using its own network channel (some apps have built-in proxy settings, for example). The test is simple — open an overseas site in a browser; if it loads, the tunnel is working. Also, iOS background policy is aggressive: after a long spell in the background an app may be suspended, so check the connection status when you return to it.

Android

Android also gets its installer from the panel's download area; during installation the system may warn about apps from unknown sources, which you allow once in settings. Open the app, import the subscription link, choose a node and connect. The first connection shows the system VPN request dialog, which you must confirm.

Two Android settings are worth attention. First, battery optimisation: some manufacturers' systems clean up background apps when the screen is off, dropping the connection — adding the client to the battery optimisation whitelist prevents that. Second, per-app proxying: if you only want certain apps in the tunnel, choose per-app routing in the client so everything else stays direct, saving data and avoiding disruption to local services. Per-app proxying is a genuinely useful Android advantage over other platforms.

Linux

Linux users download the client package for their architecture from the panel, unpack it and run it from a terminal in that directory. Most distributions require making the executable file executable before launching; follow the instructions inside the package for the exact commands. After that it's the same three steps: import the subscription, pick a node, connect.

The most direct way to verify connectivity on Linux is to send a request from the command line and look at the status code:

curl -sS -o /dev/null -w "%{http_code}\n" https://example.com

A 200 means the request went through; a timeout or connection failure means the tunnel isn't up or the rules aren't taking effect. If the system uses NetworkManager, don't let another tool change DNS after the client takes over the proxy — the two will fight. On a server without a graphical interface, complete the subscription import and node selection locally first, then sync the configuration across.

What all five platforms share

Whatever the platform, the flow is the same: log into the panel → download the client → import the subscription → pick a node → connect → verify. The differences are only in system permission prompts and background policy. So once you've set up one platform, the rest go much faster. One account allows unlimited simultaneous devices, so all five can be installed and connected at the same time without switching back and forth.

If the node list is empty after import on some platform, check three things first: whether the subscription link was copied in full (no missing characters at the end), whether the network works (importing itself needs connectivity), and whether the client version is too old. If all three are fine and the list is still empty, try another import protocol, following the priority order in chapter four.

CHAPTER 06

Connection checks: confirming traffic really goes through the route

"Connected" and "traffic actually goes through the route" are two different things. The client showing connected only means the tunnel is up, not that traffic is routed correctly. This chapter gives you verification methods, route selection principles, and the troubleshooting order for common failures.

Three verification steps

The first step is checking your exit. Open any IP lookup site in a browser and see whether the location matches the region of the node you picked. A Japan node showing your local IP means traffic isn't entering the tunnel, or the rules excluded this request. The second step is visiting an overseas site that normally won't load; if it loads, the link works. The third step is watching the client's own statistics — after connecting you should see upload and download counters rising; a permanent zero means no traffic is passing through.

Of the three, the exit check is the most reliable. It isn't affected by caching and doesn't depend on any particular site being available. Make a habit of checking the exit once after connecting; later, when something goes wrong, you'll quickly tell whether it's the link or the destination site.

How to pick a suitable route

Route selection isn't "the higher up the list the better" — it's about matching the situation. For everyday browsing and office collaboration, relay routes are usually enough; for peak-hour video or long meetings, switch to an IEPL dedicated route for stability; for a quick lookup, direct routes have the shortest path. On region, prefer places that are geographically close and where the target service has nodes: Japan for Japanese and Korean content, the United States for North American content, Singapore when you need a Southeast Asian node.

A practical habit is keeping two or three routes ready: one main, one backup, one for video. When the main one stalls, switch to the backup instead of scrolling the list again. Most clients let you pin or favourite frequently used nodes — a minute of tidying saves trouble for months.

Common failures and the order to handle them

Troubleshoot from the nearest cause outward; don't start by switching nodes. First confirm your local network works (with the client off, can you open local sites?), then confirm the client is really connected, then check the exit, and only then suspect the route.

Common symptoms and what to do
SymptomLikely causeWhat to do
Client shows connected but pages won't loadRules not applied, DNS not taken over, or a conflict with another network toolQuit other network tools; toggle the rule mode once; restart the client
Pages load but video keeps bufferingThe current route is congested at peak hoursSwitch to an IEPL dedicated route; try another route in the same region
Some apps work, others can't connectThat app doesn't use the system proxy, or is excluded by routing rulesCheck per-app proxy settings; add the app to the proxy list
Everything is slower after connectingThe node region is too far away, or local gateway quality is poorPick a geographically closer node; compare against direct routes
Disconnects automatically after a whileSystem background cleanup, or the client being suspendedAdd it to the battery optimisation whitelist; enable auto-reconnect

Reasonable expectations on speed

The real speed of a cross-border link is decided by three segments: local to entry, entry to exit, and exit to the destination site. The client can only influence the middle one; the other two are outside the service's control. So the same node performing differently at different times and on different networks is normal — one disappointing speed test doesn't prove the route is faulty. The way to judge: test again at several times of day. Slow only in a fixed window usually means congestion; slow all day means it's worth changing routes.

Tip To learn how to test speed objectively and which metrics matter, read speed test methods compared. The core conclusion is simple: the same set of tools, run at different times of day, watching only a few metrics, tells you more than refreshing a speed test site over and over.

When to suspect the account instead

If no node connects, subscription updates fail and the panel won't open either, it's most likely not a route problem but account status or your local network. First check whether the plan has expired and whether the data is used up — both are visible at a glance in the panel overview. Expired means renew; used up means wait for the reset or add a data pack. That check takes under a minute and saves a lot of pointless node switching.

CHAPTER 07

Daily upkeep: data resets, upgrades and refunds

Once the service is running, day-to-day there are only four things to handle: watching data, dealing with expiry, occasional upgrades, and refunds if needed. This chapter covers all four, plus device and password operations.

Data resets and checking what's left

Monthly plan data resets on your activation date. The panel overview shows data used and remaining for the current cycle; glance at it weekly, especially after a few HD videos. When data runs low the panel usually warns you, and you have three options: wait for the next cycle, upgrade to a higher tier, or add a data pack. None is better in the abstract — it depends on days remaining: two or three days left, wait; half a month left, upgrade; highly variable usage, buy a data pack.

Data pack balances are shown separately and don't reset with the month. So if you hold both a monthly plan and a data pack, the system applies its own rule about which is consumed first, but you can see both balances in the panel. The used-up, never-expires rule means data packs are safe to stockpile — nothing is wasted.

Expiry and renewal

Before expiry the panel shows the days remaining. Renew from the plans area by choosing the same tier; the period extends from the current expiry date, so renewing early doesn't waste remaining days. That matches most monthly subscription services — renewing a few days ahead is safe.

If you forget to renew after expiry, the account isn't deleted, it just can't connect. Renew and it's restored; route configuration and subscription link are unchanged, so no re-import is needed. That's the advantage of a subscription over a one-off purchase: state follows the account, not a single transaction.

Upgrades, downgrades and stacking data packs

Upgrade rules were covered in chapter two: the difference is prorated over remaining days, you pay only that, and you don't rebuy the whole month. Downgrades differ — they take effect in the next billing cycle, and the current cycle continues at the old tier. That design avoids the awkwardness of data suddenly shrinking mid-month. Data packs can be added at any time, credit immediately, and don't affect the expiry date.

When each of the four operations takes effect
OperationTakes effectAffects current cycle?
Upgrade tierImmediately after paymentRemaining days topped up at the new tier
DowngradeNext billing cycleCurrent cycle unchanged
Buying a data packCredited immediately after paymentDoesn't affect the monthly cycle
RenewalExtends from the current expiry dateRemaining days unaffected

Refunds: 7 days, no questions asked

This service offers a 7-day no-questions refund counted from your first payment. To request it: log into the panel, open the orders area, find the paid order and submit a refund request; you can also use the ticket link in the footer and quote the order number. Once approved, the money goes back through the original payment channel, and timing depends on that channel's processing speed.

Two notes. First, refunds are handled per order, so if there are several, specify which one. Second, after a refund the data allowance on that order stops being valid; any unused data pack in the account is unaffected and remains usable. So there's no need to worry before requesting a refund that a purchased data pack will be refunded along with it.

Tip If you are not sure this is a long-term thing, start on the lowest tier for a few days: run your usual routes and your usual devices through it, then decide whether to upgrade. 7 days is enough to judge how a route actually performs on your own network — more reliable than any review.

Device management and passwords

Simultaneous devices are unlimited, so there's no need to "kick out" an old device. But if a device is lost or sold, the subscription link on it still works, and then you should do two things: change the account password, and reset the subscription link in the panel. After both, the client on the old device can't refresh its configuration because the token is invalid, and the tunnel stops working.

Change the password periodically, especially if you suspect you logged in on a shared device. Changing the password doesn't affect subscriptions already imported, but resetting the subscription does — every device must import again, so think it through before acting.

CHAPTER 08

Advanced use: routing rules, fixed exits and multiple devices

Once the basic flow works, the remaining optimisation falls into three areas: send the traffic that should use the tunnel through it and keep the rest out; give services that need a stable exit a stable exit; and let multiple devices each do their own thing without interfering. This chapter covers those three.

Rule mode and global mode

Clients usually offer two routing modes. Rule mode splits traffic by preset rules: requests matching a rule go through the tunnel, the rest go direct. Global mode sends everything through the tunnel. For daily use, rule mode is recommended — local services, intranet access and domestic sites stay direct, which is faster and more compatible, and your allowance is only spent where it's really needed.

Global mode suits two situations: an app whose traffic isn't covered by the rules and won't work at all, where you switch to global temporarily to check whether routing is the problem; and cases where all traffic must leave through the same exit, such as services that demand exit consistency. Switch back to rule mode afterwards — running global long term noticeably speeds up allowance consumption.

How to write routing rules

A routing rule set is essentially a series of "which traffic goes where" decisions. The usual layout, from highest to lowest priority: match specific services by domain, then match by region, then fall through to the default policy. Here's a structural sketch, not a complete configuration you can use as is:

rules:
  - DOMAIN-SUFFIX,example.com,PROXY
  - DOMAIN-KEYWORD,example-api,PROXY
  - GEOIP,CN,DIRECT
  - MATCH,PROXY

This configuration means: traffic matching the given domain suffix goes through the proxy, traffic containing the given keyword goes through the proxy, anything judged to be a mainland China IP goes direct, and everything else goes through the proxy. In real use, replace example.com with the domains you need. Rules match from top to bottom and stop at the first hit, so more specific rules belong higher up.

Note Don't blindly copy large rule sets circulating online. More rules mean slower matching and harder fault-finding when something breaks. Start from a minimal working set: add only the rules you actually need, and add more when something won't load. After editing a rule file, remember to make the client reload the configuration.

Fixed exit: a stable route for API calls

Calling AI APIs is not the same as browsing the web. A broken web page just needs a refresh; a broken API call may be a failed request, a retry loop, a timeout. These scenarios demand more from the exit: an exit IP that changes frequently can trigger risk controls, and frequent connection rebuilds push up timeout rates.

The approach is to give this traffic its own route and keep it long term. Specifically: write a separate rule for the API domains pointing at a fixed node, and let everything else route as usual; once chosen, don't swap that route just because it's occasionally slow — stability matters more than peak speed. At the same time, set the client's timeout and retry parameters conservatively: better a little slower than frequently failing. For more on choosing routes, see AI API route picks.

Streaming: region matters more than route type

What you can watch on a streaming platform depends on the region of your exit, so the first job is picking the right region and the second is picking the route type. Once the region is right, if playback keeps buffering, switch to an IEPL dedicated route. Note too that the same platform differs by region in subtitles, bitrate and catalogue; when a title is only available in one region, changing region works better than changing route. For measured region comparisons, see Disney+ region comparison — the method applies to other platforms as well.

Arranging multiple devices online at once

Unlimited simultaneous devices means you can give each device a role: the desktop stays on the main route for long tasks, the laptop switches as needed, the phone keeps a power-friendly route, the tablet is dedicated to video. Each device imports the same subscription and picks its own node, independently.

The only thing to watch is the shared allowance: all devices draw on the same pool. If one device at home runs heavy traffic for long stretches, give it its own rule to limit scope so the allowance doesn't quietly run out. As for "should each device have its own account" — no, unless you need per-device usage statistics; one account for all devices is simpler.

Where to go deeper

After these eight chapters you can complete the whole flow on your own. To go further there are three directions: for the technical detail of protocols and routes, read terms explained; to run the shortest path again from scratch, go back to Quick Start; to confirm route coverage before adjusting configuration, see the grouped list on the servers page. If you have questions about prices and tiers, the plans page has the full table.

One last reminder: every figure in this handbook — the prices and data allowances of the three monthly tiers, the capacities of the three data packs, the 7-day no-questions refund, unlimited simultaneous devices, 90+ countries and 190+ routes — is what this service currently publishes. If you ever see a conflicting claim elsewhere, the panel and this site are authoritative.