What trips up most VPN beginners isn't finding a tool — it's not knowing the order: learn the theory first, or compare prices first? This guide follows the order people actually go through: what it is, how to choose, how to buy, how to connect, and how to check it once connected. Every step is a concrete action, not a pile of abstract concepts.
By the end you should be able to do three things: read terms like route type and protocol without confusion; pick the right billing model for your monthly usage; and import a subscription on any device you use, connect to your first route and confirm it is actually working.
What a VPN is: an encrypted tunnel and an exit region
A VPN builds an encrypted tunnel between your client and a route server. Requests you send enter the tunnel, reach the server, and are forwarded from there to the destination site; the response travels back the same way. To the destination site, the visitor's address is the server's exit address, not your local network address.
So it really changes only two things: where your traffic exits, and how the link between you and the server is encrypted and routed. What it does not change is who you are. Logins, cookies, browser fingerprints and the account itself can still tie separate visits together. Get this straight and marketing copy will be much less likely to mislead you.
Another common misconception is treating a VPN as a replacement for security software. It covers the link, not malware on your device and not system patches. Those are separate jobs — don't expect one tool to do everything.
Choosing a service: start with route type and protocol
Two routes both labelled international can take completely different paths. For a beginner, telling the three types below apart is more useful than memorising a pile of parameters.
| Route type | Path | Stability | Best for |
|---|---|---|---|
| Direct | Local exit connects straight to the destination; the cross-border leg runs over the public internet | Noticeably affected by public internet congestion; unstable at peak hours | Occasional lookups where latency doesn't matter |
| Relay | Traffic enters a relay entry point, then a relay node forwards it onward | A controllable path, steadier than direct, still dependent on relay load | Everyday browsing and document collaboration |
| IEPL dedicated line | A carrier dedicated line carries the cross-border leg, so it doesn't compete with public traffic | Latency and jitter are more predictable; cost is higher | Long meetings, remote desktop, API calls |
Common protocols at a glance: what each one is, in a sentence
- Shadowsocks: a lightweight encrypted proxy with simple configuration — good for getting the whole flow working first.
- VMess: a protocol from the V2Ray family that pairs with several transport layers and carries more parameters.
- VLESS: a leaner version of VMess with no built-in encryption of its own; it relies on TLS for the security layer, so the handshake costs less.
- Trojan: disguises traffic as ordinary HTTPS on port 443, so it looks much closer to a normal web request.
- Hysteria2 and TUIC: QUIC (UDP) based protocols that recover faster on lossy or weak networks, but are sensitive to local UDP quality.
Beginners don't have to pick a protocol: once the client imports the subscription, routes are delivered automatically from the server-side configuration. What you do need to judge is whether a route is direct, relay or dedicated, and whether the refund terms are written out clearly.
Plans and data packs: matching three price tiers to your usage
There are only two billing shapes: a monthly subscription and a one-off data pack. The first suits people who use it every day; the second suits people whose usage varies and who don't want to be tied to a monthly fee. Understand the difference first, then talk about price.
| Type | Price | Data | Notes |
|---|---|---|---|
| Monthly | ¥9.9 / month | 60GB | Light use, a phone plus one computer |
| Monthly | ¥18 / month | 250GB | Everyday main tier, browsing and video mixed |
| Monthly | ¥28 / month | 500GB | Several devices online at once, long HD streaming |
| Data pack | ¥158 | 300GB | Use it up at your own pace — it never expires |
| Data pack | ¥358 | 1000GB | Use it up at your own pace — it never expires |
| Data pack | ¥658 | 3000GB | Use it up at your own pace — it never expires |
Monthly plan data resets each month on the day you started. If you upgrade mid-cycle, the price difference is prorated over the remaining days — you don't have to wait for the next billing period. Data packs work the other way: they don't reset monthly and last until used up. Device count is unlimited, so a second or third device costs nothing extra.
Payment is by Alipay, WeChat Pay and USDT. Sign-up needs no email address — a username and password are enough. For anyone who doesn't want another marketing email in their inbox, that's worth more than a discount.
Five steps to your first connection
This sequence works on any platform; only the client in step three differs. Follow it in order and you'll have a working route.
- Create an account. Open the user panel and enter a username and password — no email address required.
- Pick a plan and pay. Choose a monthly tier or buy a data pack outright; checkout accepts Alipay, WeChat Pay and USDT.
- Download the client. There are clients for Windows, macOS, iOS, Android and Linux; sign in and grab your subscription. Don't download installers of unknown origin from third-party sites.
- Import the subscription. Copy the subscription link from the panel and paste it into the client's import field, or scan the QR code in the panel with the client. Once imported, the client pulls the route list automatically.
- Pick a route and connect. Filter by region first, then choose a route type within that region. For the first connection, try an IEPL dedicated line; once you know the link is clean, switch to cheaper types and compare.
After importing, change these three settings first
Mode: Rule (split routing)
DNS: Remote resolution, leak protection on
UDP: Enable as needed (turn on for video calls and online games)
Rule mode sends only domains that match the rule set through the route and keeps local sites on a direct connection, which feels more natural. Global mode pushes all traffic into the tunnel — simple, but it slows down local access. Resolving DNS remotely keeps lookup requests from leaving through your local ISP, which is what people mean by DNS leaks.
Once connected: three checks to confirm it really works
The client showing connected only means the handshake succeeded — not that traffic is actually going through the route. A few minutes on the three checks below saves a lot of wrong conclusions later.
- ✅ Exit address. Open any IP lookup page and confirm the address shown belongs to the region of the route you picked and has nothing to do with your local ISP. Switch to another route and look again — the address should change with it.
- ✅ Where DNS resolves. Use a DNS leak test page to see where lookup requests come from. If it still shows your local ISP's resolver, the split rules or DNS settings aren't taking effect.
- ✅ Peak-hour stability. During the evening peak, hit the same destination for a few minutes and watch for drops or repeated reconnects. Stability says more than a single speed-test number.
- ❌ Trusting the status light alone. The light only reflects the handshake between your device and the server; it doesn't mean the destination site is reachable.
- ❌ Judging from one speed test. A single test is shaped by the time of day, the target server and your local network, so it can't represent how a route performs over time.
Beginner FAQ: from sign-up to refunds
Is a client required?
Yes. A subscription link is just a string of addresses; a client has to turn it into usable route configurations. There are clients for desktop and mobile — sign in to the panel, grab the subscription, and you don't need to write config files yourself.
Split routing or global mode: which to choose?
Use rule mode day to day: only domains matching the rule set go through the route, while local sites stay direct. Global mode is for temporary troubleshooting — when a site won't open in rule mode, switch to global and try again to tell quickly whether the problem is the rules or the route.
Connected but a site won't load — what to check first?
Check three things in order: switch to another route in the same region; change the mode from rule to global; clear the browser's DNS cache. If it still won't load after those three, consider that the destination site's own regional restrictions may be the cause rather than a route fault.
How is a mid-cycle upgrade priced?
When you upgrade a monthly plan, the price difference is prorated over the remaining days — no need to wait for the next billing period. Data packs have no upgrade path: buy another one when you need more capacity, and whatever is left of the old pack stays.
How do refunds work?
A full refund can be requested within 7 days of your first payment, no questions asked. Use that window to run your usual routes on your usual devices, confirm the exit region, DNS source and peak-hour stability all match expectations, and then decide about the long term.