Using a VPN subscription comes down to one chain: confirm the order, get the subscription link, import it into the client, connect, verify. What actually trips people up isn't the difficulty of any single step, but the in-between state at every step where the client says success and nothing is really working. Here they are in order, each with the expected result and the usual sticking point — work through them and you're done.
After checkout, confirm the order first
Payment going through doesn't mean the service is live. Back in the dashboard, check three things: whether the order shows as activated, whether the plan and data allowance match what you bought, and when it expires. Confirming these before you install a client saves you a round of "is it the route, or is my order not active?" troubleshooting.
Monthly plans come in three tiers: ¥9.9/month for 60GB, ¥18/month for 250GB and ¥28/month for 500GB. Data resets monthly on your activation date rather than on the 1st; if you upgrade mid-cycle, the price difference is prorated by the days remaining. Data packs are a separate product line: ¥158/300GB, ¥358/1000GB and ¥658/3000GB — use them until they run out, they never expire, which suits people whose usage swings a lot.
On the account side, creating an account takes only a username and a password — no email address required. The price of skipping that verification step is no email recovery channel, so save the username and password in a password manager right after the first login and don't count on a "forgot password" button to save you. Devices aren't capped: mobile, computer and tablet can all be online at once, so there's no slot to worry about on your first device. Payment options are Alipay, WeChat Pay and USDT.
No email address means a very short sign-up process, and it also means recovery is entirely in your hands. Save the username and password right after the first login — you'll need them to fetch the subscription, change devices and open the dashboard.
- 120+ Countries and regions covered
- 150+ Routes in total
- Unlimited Simultaneous devices
- 7 days Money-back guarantee
Here's the whole chain laid out first so you can see the overall shape, then work through it step by step:
| Stage | What you do | Expected result | Common sticking point |
|---|---|---|---|
| Order confirmed | Check order status and expiry date in the dashboard | Shows as activated; plan and data match | Payment succeeded but the page didn't refresh, so it looks inactive |
| Get the subscription | Copy the subscription link and save it in a password manager | A complete URL | The copy is truncated, or picks up leading or trailing spaces |
| Import into the client | Add the subscription in the client and update it | A non-empty node list | Format doesn't match the client: import succeeds, zero nodes |
| First connection | Connect through an IEPL dedicated route | Client shows connected and the system VPN indicator appears | System permission denied, or only the system proxy was enabled |
| Verify it works | Check exit country and DNS resolver | Exit matches the chosen route; DNS isn't your local ISP | Browser cache creates a false picture |
Getting the subscription: the link matters more than the nodes
The subscription link is a URL. The client requests it and gets back a configuration: node list, protocol parameters, routing rules. It's also a credential — the token in the link maps directly to your routes, and anyone who has the link can use your data without a password. So it shouldn't turn up in public groups, screenshots or shared documents.
Three formats are common: a Base64-encoded node list, YAML for Clash / mihomo, and JSON for sing-box. When the format doesn't match the client, most clients won't raise a clear error — you get "import successful, zero nodes". If the list comes back empty, check the format first, then whether the link is complete.
Two details for copying and saving
When you copy the link, make sure there are no leading or trailing spaces, and don't pass it through a chat window that wraps lines — a truncated link usually still adds fine and only returns nothing when it updates. Save it straight into a password manager, with a note on the plan tier and expiry date, so you don't have to dig through the order page when you switch devices.
Turn on automatic updates in the client; once a day is enough. Old configs stop working after routes are adjusted, and it's easy to forget to hit update manually. When auto-update fails, the typical symptom is "it was fine yesterday, today everything times out".
A subscription link is the same thing as account credentials. If you want to share with a friend, have them create their own account — don't send the link. Once it's out there, it's your account's data that gets consumed.
Importing into a client: how the five platforms differ
Importing differs quite a bit between platforms, but underneath there are only two ways to take over traffic: system proxy and TUN. A system proxy only affects apps that honour the system proxy settings — browsers are usually fine, but games and some desktop clients ignore it entirely. TUN creates a virtual network adapter in the system and captures all traffic, which is more compatible at the cost of needing administrator rights. On day one, verify the route works with the system proxy first, then decide whether to enable TUN.
Protocols and client cores
Nodes in a subscription may use any of Shadowsocks, VMess, Trojan, VLESS, Hysteria2 or TUIC. A client core that's too old won't recognise newer protocols, and the symptom is "the subscription updated fine, but a few nodes drop the moment you connect". Upgrade the client first; don't rush to blame the route.
Where to import on each of the five platforms
| Platform | Common clients | Import path | Watch out for |
|---|---|---|---|
| Windows | v2rayN、Clash Verge | Subscriptions → Add subscription → Paste link → Update | The firewall prompts on first run — allow it; TUN mode needs administrator rights |
| macOS | ClashX、sing-box | Menu bar icon → Profiles → Add subscription URL | On first connect, allow the network extension in System Settings |
| Android | v2rayNG、Clash Meta | Side menu → Subscription settings → Add subscription | Battery optimisation kills background processes — whitelist the client |
| iOS | Shadowrocket、Stash | Plus icon at the top right of the home screen → Add subscription | The first connection installs a VPN configuration profile and needs your passcode or biometric confirmation |
| Linux | sing-box、mihomo | Write the subscription URL into the config file, then start the service | Needs root or equivalent network permissions; pull the config with curl from the command line |
Menu names in the table shift slightly between client versions; what they have in common is a "Subscription / Profile" entry. After importing, update the subscription once manually, confirm the node count isn't zero, then move on.
First connection: confirm the route is actually working
For the first connection, pick an IEPL dedicated route as your baseline. A dedicated route runs end to end over a private link with no public-internet detours, so it jitters less at peak times; a relay route forwards from an entry node to the exit, costs less and fluctuates more at peak; direct means connecting straight to the exit, with latency set by the physical distance to it. Confirm the link itself is fine on a dedicated route first, then compare other routes — do it the other way round and you'll mix route problems with local network problems.
After connecting, don't just read the client's status text — work through this checklist item by item:
- ✅ The client shows connected and a VPN indicator appears in the system tray or status bar.
- ✅ Open an IP lookup page: the exit country matches the route you picked.
- ✅ Open it again in a private window to rule out browser cache.
- ✅ The resolver on a DNS test page isn't your local ISP's address.
- ✅ Try an app that doesn't use the system proxy, to confirm the capture scope is what you expect.
- ❌ Stopping at "connected" in the client — under system proxy mode, plenty of apps don't go through the proxy at all.
- ❌ Judging a route by a single speed test — one result depends on your local network and the time of day, and says nothing about long-term performance.
Traffic going through the proxy doesn't mean DNS lookups do. If DNS requests still go to your local ISP, the answers can be poisoned, and the symptom is "the client says connected, but some sites won't open or keep throwing captchas". Enabling remote DNS or DoH in the client avoids this; to verify, open a DNS leak test page and check whether the resolver is your local ISP's address.
Split routing has two modes worth using. Global pushes all traffic to the proxy and is the fastest way to verify the link; rule mode routes by domain and IP, with sites in mainland China going direct and everything else through the proxy — lighter on data and steadier. Rule lists go stale, and a new domain can be misclassified as direct, which shows up as "every other site is fine, this one just spins". On day one, use global mode to confirm the link works, then switch back to rule mode for daily use.
The four places people get stuck on day one
These are the issues new users report most on day one — match your symptom against them:
- ❌ Zero nodes after updating the subscription: wrong format. The client wanted YAML and got Base64, or the other way round.
- ❌ Drops a few seconds after connecting: on mobile, battery saving clears the client from the background — whitelist it; on desktop, it's usually the system proxy not coming back after sleep and wake.
- ❌ Only the browser works: other apps ignore the system proxy — switch to TUN mode to capture all traffic.
- ❌ One site keeps spinning: the routing rules sent it direct, or DNS isn't going through the proxy.
Fix the troubleshooting order and you'll save a lot of time: first confirm the subscription updated with nodes present, then confirm traffic is actually going through the client, and only then suspect the route itself. The first two steps locate most problems; the route itself is the least likely culprit.
When to switch routes, and when to change plans
A region usually has several routes. When one gets jittery at peak times, switching to another route in the same region works far better than reconnecting ten times; hopping to a different region (Asia to Europe, say) won't fix congestion on your local connection — it just adds latency.
Pick a plan by usage: ¥9.9/month for 60GB suits light use on a single device, ¥18/month for 250GB is the tier most people settle on, and ¥28/month for 500GB fits multiple devices and regular 4K streaming. If your usage is uneven, buy a data pack starting at ¥158/300GB — use it until it runs out, it never expires, so nothing is wasted at the end of the month.
A no-questions refund can be requested within 7 days of the first payment. What that means in practice: you can spend the first week trying every route you'd normally use, instead of drawing conclusions from a single one.
What you want to keep from day one isn't "I've tried a lot of routes" but a reproducible baseline: which client, which route, which mode, which exit country. With that baseline you have something to compare against when problems come up.