This VPN glossary for beginners starts with how the pieces fit together: a subscription provides configuration, a node is a connection entry point, a protocol defines how data is exchanged, and routing determines which requests use a proxy. These are separate layers. A protocol name alone cannot tell you how good a route is, and a successful import does not mean the connection is active.
When reviewing a plan, distinguish usage allowances from network configuration. In the client, distinguish the configuration source, selected node, and operating mode. The sections below follow the order you are likely to encounter them. Button names vary by client, and not every app has the same features.
Subscriptions and Subscription Links: Allowances and Configuration
“Subscription” has two common meanings. A plan subscription refers to billing and service entitlements, such as a monthly data allowance. A subscription link is an address a client uses to retrieve configuration. Having an active plan does not mean a device has imported its configuration; having a configuration saved in a client does not mean the plan is still active.
A subscription link usually contains credentials used to identify an account or authorize access to configuration. The client uses the link to retrieve a node list and other settings; the returned content depends on the format provided by the service. Some links require a compatible client format, while some clients can identify it automatically. If an import fails, check the format first rather than changing the link to an unrelated protocol prefix.
“Update subscription” means retrieving configuration again. It does not renew a plan or reset data. Node names, groups, or rules may change after an update, and whether manual edits are kept depends on the client. When setting up another device, retrieve the link from the account panel rather than sending a screenshot to someone else for help.
Nodes and Routes: A Name Is Not the Full Path
A node is a connection configuration you can select in a client. It typically includes a server address, port, protocol, and authentication details. Labels such as “Japan” or “United States” can help identify a node, but a name alone cannot confirm the actual entry point, exit point, or network path. The entry point is where your device first connects; the exit point is generally the location websites see as the source of a request. They may be in different regions.
A route describes the path data takes and how it is carried. A node is the configuration entry point a client uses for that route. Different nodes may share parts of a network path, and having more nodes does not mean every route is independent. If you need content from a particular region, check the exit location and how the target service works after connecting.
“Latency test” results in a client also have limits. Some tests measure connection setup time; others send a request to a specific address. Results from different test targets are not directly comparable. Lower latency does not necessarily mean faster downloads, and a successful test in the list does not mean every app is using that node. Real-world responsiveness, data transfer, and disconnections are more useful to observe than a label on its own.
Direct, Relayed, and IEPL Dedicated Routes
These terms mainly describe network paths, not protocol names. Direct connections usually connect a device to a proxy server over the public internet. A relay uses an entry point to forward traffic to another server. IEPL is an international Ethernet private line, a term often used in service descriptions for the transport used on some cross-region links.
| Term | What it mainly describes | What to check |
|---|---|---|
| Direct | The device connects directly to a proxy server, usually over the public internet. | Local carrier routing, the destination region, and conditions at the time of use. |
| Relay | Traffic is forwarded through an entry point; entry and exit points can be in different regions. | Entry-point reachability, the quality of the next link, and congestion. |
| IEPL dedicated route | Part of the path uses an international Ethernet private line. | Which segment uses the private line, and how the access and exit segments are arranged. |
A relay is not inherently slower than a direct connection: a better-routed entry point may provide a better experience. A dedicated line does not mean the entire connection avoids the public internet; the path from your device to the entry point and from the exit point to the destination may still use public networks. Compare the full path and real-world performance, not just the name.
Likewise, a dedicated-route label cannot guarantee access to a particular streaming service or AI tool. A platform may also assess the exit address, account region, and its own rules. Check the panel for VPNCopy’s specific node details. Use the node selection guide to choose a region, then confirm that the connection meets your needs.
Protocol Names: Communication Methods, Not Speed Rankings
Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC are common proxy protocol names. They differ in authentication, encryption arrangements, and transport design, but a name alone cannot prove that a route is faster or more reliable. Server deployment, client implementation, network conditions, and parameter combinations all affect performance.
- Shadowsocks: An encrypted proxy protocol. Both sides need compatible encryption methods and authentication details; a client recognizing a link does not mean it supports every configuration in it.
- VMess: A proxy protocol with authentication and encryption mechanisms, often combined with different transport methods. Troubleshooting may require checking both protocol parameters and the outer transport configuration.
- Trojan: Commonly uses TLS to carry proxy traffic. Domain names, certificate validation, and authentication details can all affect the connection. Do not disable certificate validation just to dismiss an error.
- VLESS: The protocol itself does not encrypt content; confidentiality depends on the security transport layer used with it. Check the complete configuration rather than treating the name alone as an encryption guarantee.
- Hysteria2 and TUIC: Both are based on QUIC and use UDP underneath, but their designs differ. Connections may be affected if the network restricts UDP or the client does not support the relevant implementation.
Beginners usually do not need to assemble these parameters manually. Start with the configuration provided in the service panel and choose a client that is explicitly compatible. This article explains general concepts; it does not claim that VPNCopy offers every protocol listed above. Check the panel configuration and user guides for current support.
Global Mode, Rule Mode, and TUN: What Each Controls
Rule mode uses domains, addresses, or other conditions to decide whether requests connect directly, use a proxy, or are blocked. It is useful for handling different types of traffic separately. Rules have an order, and the first matching rule usually determines where a request goes; the fallback behavior for unmatched requests depends on the configuration. Rule mode does not automatically send every international website through a proxy.
Global mode usually sends all requests handled by the client through the selected exit, making it useful for checking whether a routing rule is causing an issue. However, “global” often describes only the routing choice inside that client. It does not guarantee that all app traffic enters the client. If only the system proxy is enabled, software that ignores system proxy settings may still connect directly.
TUN is a way to capture traffic through a virtual network interface. It is often used to route more app traffic into a client, which then applies its rules. It is neither a separate node nor a guarantee that all traffic will be proxied once enabled. Permissions, routes, DNS, and the client implementation still need to be configured correctly, and conflicts with other network-capture software are possible.
DNS Leaks and Exit Checks: A Website Loading Is Not the Whole Picture
DNS resolves domain names to addresses. A client may resolve a domain locally, send the request to a remote resolver, or use mechanisms such as virtual address mapping. Different configurations have different goals; local resolution is not automatically a fault. The key is whether it matches your routing and privacy requirements.
A DNS leak usually means that a resolution request expected to follow a specified path instead went to an unexpected resolver. Encrypted DNS built into a browser, system settings, and client DNS configuration may all be active at once, so check which one actually handled the request. Encrypted DNS does not automatically mean the request went through a proxy.
To verify a connection, first check the current exit region, then check the resolver and the target app’s behavior. A browser test page shows only some of the activity it can observe; it cannot reach a conclusion for every app. If the device also uses other address families, check how that traffic is handled too. Testing only part of a connection is not enough to confirm that everything behaves as expected.
A no-logs policy describes how a service handles data. It does not mean websites keep no records of visits or that your identity is hidden after you sign in. VPNCopy states that it follows a no-logs policy. To understand privacy boundaries, also consider client configuration, account sign-ins, and how destination websites handle data.
From Import to Verification: A Beginner Workflow
- Get a compatible client. Download software from the account panel or a trusted official source, and check that the platform and configuration format match. Windows, macOS, iOS, Android, and Linux may have different interfaces and traffic-capture methods; do not assume buttons are in the same place across platforms.
- Import the subscription link. Find the subscription or configuration section in the client and use the matching format from the panel. Confirm that a node list appears. If it is empty, check the subscription status, network access, and any error message.
- Select a node and mode. Choose a region for your use case and start with the recommended rule configuration. Allow necessary system network permissions, but do not disable security checks you do not understand just to dismiss a prompt.
- Enable traffic capture. Follow the guide to enable a suitable method, such as the system proxy or TUN. The system proxy switch and the client’s connection button may be separate on desktop systems. A network connection indicator on a mobile device also does not confirm that every app is routed as expected.
- Verify and note the results. Check the exit, DNS resolution, and target app, then confirm that your usual local services still work. When troubleshooting, change one condition at a time and keep any error messages. Changing the node, mode, and DNS all at once makes it harder to identify the cause.
On Android, also check background activity restrictions. On iOS, follow the panel’s instructions for setup and configuration. Linux command-line tools may not automatically work with desktop network settings. For platform-specific steps, see the client setup guide; do not assume one client’s features are standard across the whole system.
- ✅ The subscription is updated, and the current plan status and remaining data have been checked.
- ✅ The selected node, operating mode, and traffic-capture setting have each been confirmed.
- ✅ The target app has been tested, not just the client’s “Connected” status.
- ❌ Configuration details, subscription links, and screenshots containing authentication information have not been shared publicly.
Use These Terms When Comparing Plans: Read the Terms, Then the Labels
When comparing plans, separate “how billing works” from “how connections work.” VPNCopy monthly subscriptions are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB, all billed monthly; data resets each month on the activation date, and the upgrade price difference is converted into remaining days. Data packages are ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB. They expire when used up and never expire by date. Remaining data is handled differently depending on the billing type.
VPNCopy offers 100+ countries, 190+ routes, unlimited simultaneous devices, and support for Windows / macOS / iOS / Android / Linux. An account can be created without an email address using a username and password. Device limits, supported platforms, and account requirements are explicit terms; they do not mean every app is compatible or every route supports every service.
The “60-day no-questions-asked refund” promotion refers to the full terms: a full refund may be requested within 60 days of the first payment. Before choosing a plan, check the plan pricing page for billing details. For connection and routing questions, consult the buying guide or FAQ, rather than relying only on node names.