VPNVO Complete Handbook

1. What the service is: four layers

Before touching anything, take the service apart once. VPNVO does not ship an installer; it ships a continuously updated set of route configurations. What you get after paying is a subscription, the client parses that subscription, and the client then connects to one of 120+ countries / 150+ routes according to the configuration. Keep these four layers straight and every later step has a place to sit.

Layer 1: the account

The account carries your identity and your orders. Registration needs only a username and a password — no email address — which chapter 3 covers in detail. The account holds plan status, remaining data, order history and the subscription link. Losing the account means losing the routes, so write the username and password down separately; there is no email-based recovery to fall back on.

Layer 2: the subscription

A subscription is a link with a token in it, shaped like https://example.com/sub?token=YOUR_TOKEN. It is not an installer and not a set of credentials, but an index of configuration the client can pull again and again: the client requests the address, the server returns the currently available route list and connection parameters. When routes are adjusted, nodes added or removed, or protocols switched, the change happens server-side and the client picks it up on the next subscription update — nothing needs to be downloaded again. That is the core difference between a subscription and a one-off config file, and the reason moving to a new device only means importing a link.

Layer 3: the routes

Routes are what actually carry traffic, spanning 120+ countries / 150+ routes. They fall into three types by path characteristics:

The three types are not good versus bad, they are trade-offs: dedicated lines are stable but limited in capacity, direct routes are light but exposed to public links. The route-picking advice and troubleshooting branches later on all use this table as their baseline. For the full route list see the Servers page, which groups cities and route types by region.

Layer 4: the client

The client parses the subscription, builds the encrypted tunnel, and routes traffic by rule. The site supports five platforms — Windows / macOS / iOS / Android / Linux. Importing differs per platform, but the subscription you end up with is the same one. The client itself costs nothing, and switching clients does not affect plan status.

Traffic and billing

Plans are billed monthly, and data resets every month on the activation date. Note that this is the activation date, not the 1st of the calendar month: activate on the 15th and it resets on the 15th of each following month, and so on. Every billing period is therefore the same length, and you never get a first month charged in full for half a month of use. The exact figures for the three monthly tiers and the data packs are in the next chapter.

Encryption and transport

The transport layer uses military-grade encryption throughout. This is the same sentence used elsewhere on the site; there is no second version of it. Encryption solves the problem of the link being read in the middle. It does not change where the exit is, and it does not directly determine speed — speed comes from route quality and your local network together, a point that comes up repeatedly in chapters 6 and 9.

2. Choosing a plan: three monthly tiers and data packs

There are only two kinds of plan: monthly subscriptions and data packs. No quarterly or annual terms. The structure is simple, but picking the right tier means first knowing where your usage lands.

Three monthly tiers

The only difference between the three tiers is data. Route coverage, device count and encryption are identical, and unlimited devices applies to all three. So choosing a tier comes down to one question: roughly how much data will this period use?

How to estimate your usage

You do not need to be precise to the gigabyte; sorting by use case is enough:

• Light: web, email, document collaboration, messaging. These uses consume single-digit gigabytes, so the 60GB tier leaves plenty of headroom.
• Moderate: light use plus one to two hours of 1080p video a day, or long video meetings. 1080p burns 1GB or more per hour depending on bitrate, which adds up to somewhere between a few dozen and a hundred-plus GB a month, so the 250GB tier is the safer pick.
• Heavy: 4K streaming, all-day remote desktop, several devices online at once. 4K bitrates are several times those of 1080p, and an hour can cost as much as half a day of browsing — go straight to the 500GB tier.

If you are unsure, start low. Upgrading mid-period prorates the difference against the remaining days, so the money you already paid is not wasted; the calculation is in chapter 7.

Data packs: use them up, they never expire

Data packs and monthly subscriptions are two separate meters. Monthly data resets on the activation date and does not roll over; data pack data only goes down, until it runs out, with no expiry date. Buy a 300GB pack before a trip, come back with half of it left, and use the rest on the next trip — that is the point of a data pack.

Payment and refunds

Alipay / WeChat / USDT are supported. The first payment is covered by a 7-day no-questions refund, for both monthly subscriptions and data packs; the exact terms are in the Terms of Use at the bottom of the page. Seven days is enough to run through the first six chapters of this handbook: if it will not connect, if you do not like it, if you picked the wrong tier, there is still time.

The full tier comparison and common questions are on the Plans and Pricing page, which also has a comparison table arranged by period.

3. Account and checkout: no email needed

Registration here is cut to the minimum: no email verification, no activation link — fill in a username and password and you are in the panel. One less verification step means one less place where your information is stored, and it also means account recovery depends entirely on credentials you remember yourself.

Registration needs two things

Open the login entry and switch to the register view; only two fields are required: username and password. No email address. Submit and you go straight into the panel — no confirmation link to click, and no stuck state where the verification email never arrives.

Username rules are loose, but two habits are worth keeping. First, do not use your real name, a familiar nickname, or an ID you use on other platforms. Second, keep it a moderate length with letters and numbers so you can remember it without email recovery. The username is the account's unique identifier and cannot be changed after registration.

For passwords, length comes first. A random string of sixteen characters or more plus a password manager is more practical than eight characters mixing upper case, lower case and symbols. With no email as a second factor, the password is the only lock on the door, so it is worth two extra minutes.

What is in the panel

After logging in you land on a long scrolling panel: account overview, client downloads, plan and orders, tickets and settings, in that order. On the first login the overview shows plan status and remaining data; if you have not bought a plan yet, it prompts you to choose one. In-panel navigation jumps to any section, so there is no scrolling back and forth.

Five steps to place an order

1. Choose a plan in the plan section: 60GB, 250GB or 500GB, or a data pack. Prices and data are in the table in chapter 2; whatever the page shows at checkout is what applies.
2. Choose a payment method: Alipay / WeChat / USDT. The first two clear quickly; USDT waits for block confirmations, and the time depends on how congested the chain is.
3. Complete the payment using the receiving details shown on the page. The amount must match the order, and any note or order number should be filled in as the page instructs.
4. Wait for the order status to update: go back to the panel after paying and the order moves from pending to paid. This usually takes tens of seconds; on-chain payments take longer.
5. Confirm the plan is active: when remaining data and the expiry date update on the overview, activation is done. Now you can go and get your subscription.

Three common snags

Payment succeeded but the order has not changed. Refresh the panel once; on-chain payments also have to wait for block confirmations. If it is still pending after ten minutes, open a ticket with the order number — do not pay twice.

Duplicate orders. The page froze after paying, you clicked buy again, and now there are two orders. Unpaid orders can be cancelled from the order list; a duplicate that has been paid goes through the refund process, and the refund entry point is also in tickets.

Wrong tier. You only realise 60GB is not enough after activation. No need to refund and rebuy — just upgrade, and the difference is prorated against the remaining days. See chapter 7.

4. Getting your subscription: how the link works

Once the plan is active, the next step is to get the route configuration in hand. The output of this step is not a file but a link.

What the subscription link contains

In the subscription section of the panel you can copy an address like the one below:

https://example.com/sub?token=YOUR_TOKEN

The first half is the service address; the token in the second half is the credential. Together they are equivalent to your route list. Anyone who gets this link can pull the same configuration and burn your data, so treat it with the same secrecy as your password.

Three ways to import

• One-click import: the panel offers import links with a protocol scheme; clicking one wakes the client already installed on the machine and fills in the subscription address. This is the least effort, provided the client is already installed.
• Copy and paste: copy the subscription address, find the subscription or profile entry in the client, paste and save. Every platform supports this path, and it is the most reliable one.
• Manual configuration: only needed for the rare client that does not support subscriptions, where you enter each route's parameters by hand. Not recommended day to day — manual entries do not update when routes change, so it is easy to end up still connecting to an old address after a switch.

Import scheme priority

Different clients recognise different protocol prefixes, and the panel offers import options in the following order:

This order says nothing about quality, only about which client is already installed on this device. The same subscription pulls identical routes on all five platforms; the differences are in the client's interface and how routing rules are written.

Updating the subscription

Routes are added or removed and protocols adjusted server-side; the client only has to update the subscription to get the new configuration. Set the client's auto-update interval to once a day. When a route suddenly stops connecting, update manually once before judging — that clears a fair share of false alarms.

After a subscription leak

If the subscription link is exposed by accident, reset the subscription in the panel: the old link stops working immediately and the new one is imported afresh. Resetting does not affect the plan or your data; it just changes the key. Every device has to import again afterwards, so think about which devices are in use before you do it.

5. Importing on five platforms

Client interfaces differ a lot across the five platforms, but the actions are the same set: install the client, import the subscription, grant permission, pick a route, connect. Below is where each step lands on each platform.

Windows

Download the Windows client from the panel's download section, double-click to install, and accept the defaults. On first launch the client asks to create a virtual network adapter and change network settings; the system shows a permission prompt and you must allow it, or the tunnel will not come up.

There are two ways to import the subscription: click one-click import in the panel to wake the client directly, or find subscription management in the client and paste the subscription address. After saving, the client pulls the route list; when the list appears, the import worked.

Pick a route and click connect. The taskbar icon changes colour and the client shows connected — done. If security software is installed, it may block the virtual adapter driver; add the client to the allowlist and try again.

macOS

The macOS client also comes from the panel. On first launch the system warns that the developer cannot be verified; allow it once in System Settings, under Privacy and Security, and the prompt will not return.

When connecting, the system asks you to authorise adding a VPN configuration — enter your local password to confirm. Importing the subscription works the same as on Windows: one-click import or manual paste. On macOS, turn on connect on demand as well, so the tunnel comes back by itself after the lid is closed and the machine wakes, instead of needing a manual click each time.

iOS

The iOS client installs from the App Store; the download entry is in the panel's download section and requires an active plan on the account. After installing, open the client and paste the subscription address; the system asks to add a VPN configuration — allow it and enter your passcode.

The iOS characteristic is that the tunnel is rebuilt when the network changes: switching from Wi-Fi to cellular or back drops the connection and restores it automatically, and a few seconds is normal. If it does not come back for a long time, disconnect and reconnect once in the client.

Android

The Android client's installer comes from the panel's download section. During installation the system asks to allow installs from unknown sources; grant it once.

On first connection the system shows a VPN connection request; tick always allow before confirming, otherwise you re-authorise on every connection. Importing the subscription again supports both one-click launch and manual paste.

Android battery optimisation is the most common trap at this step: the system clears long-running clients in the background, which shows up as a disconnect after the screen has been locked for a while. The fix is to set the client to unrestricted in battery settings and add it to the background allowlist. More detailed steps are in the complete Android VPN setup guide.

Linux

The Linux client is downloaded from the panel's download section as a package for your distribution. After installing, confirm in a terminal that the process has started, then import the subscription.

In a command-line environment, the most direct way to check whether the tunnel is in effect is to look at the environment variables:

# show the current proxy environment variables (example values)
echo $https_proxy
# expected output looks like http://127.0.0.1:7890

If the client only offers a graphical interface, operate in a desktop environment much as on macOS; in a pure command-line environment, use a client that supports configuration files, write the subscription address into the config and hand it to a system service, so it starts at boot without depending on a desktop session.

Platform differences at a glance

None of the five platforms limits device count, and they can all be online at once. Once devices pile up, give each client a recognisable name so you can match them during troubleshooting — chapter 7 comes back to this.

6. Connecting and verifying

The client saying connected does not mean traffic is really going out over an international route. This step is about verification: did the exit change, who is resolving DNS, is the target site reachable.

Three checks before connecting

• Is the subscription current. After route changes, entries in an old configuration may already be offline, and failing to connect is expected.
• Which route is selected. The client's home screen usually shows the selected region and route type; confirm it matches what you think it is.
• Which routing mode is on. Global mode sends all traffic into the tunnel; rule mode sends only matching domains. The two behave very differently during verification.

Method one: check the exit address

Look up your current exit address before and after connecting; if the two results differ, traffic really did change exits. There are many ways to check — searching for your IP address in a browser works, and so do system commands. What matters is the before-and-after comparison, not the tool; a single reading tells you nothing.

Method two: check DNS resolution

If the exit changed but DNS still goes through local resolvers, you get a mismatch where a name resolves to a local node while content is pulled from overseas, which shows up as some sites failing to open or loading extremely slowly. To diagnose: after connecting, open a test page that only does resolution and see whether the resolver's location matches the exit region. Keep the client's DNS leak protection switched on.

Method three: check the actual result

Once the first two are right, verify the specific use: open the target streaming service, AI tool or work system and see whether it loads, whether quality is where it should be, and whether any region restriction appears. This is the final test; the first two only narrow things down.

Global mode and rule mode

Start troubleshooting in global mode. If global works and rule mode does not, the problem is in the rules; if neither works, the problem is the route or the local network. This split saves a lot of trial and error, and it is the starting point for every troubleshooting branch in chapter 9.

Three cases where it connects but does not take effect

The client says connected but the exit address has not changed. Usually the client has not taken over system traffic — the virtual adapter is not active or permission was denied. Reinstall the driver or authorise again.

The exit changed but the target site still reports a region restriction. The route's exit and the site's region check disagree. Try another route in the same region; dedicated lines usually pass more easily than direct ones.

The exit changed but pages will not open. DNS resolution problems or an MTU mismatch. Turn on DNS leak protection first, then drop the MTU one step; between them these usually solve most cases.

7. Daily upkeep and renewal

Once everything works, what remains is long-term use. This chapter sets out the billing and upkeep rules clearly, so there are no misunderstandings about data or expiry.

Data resets on the activation date

Monthly data does not clear on the calendar month; it resets every month on the activation date. Activate on the 5th and it resets on the 5th of each following month. Every billing period is the same length, so you never get activated at month end and cleared after two days.

The reset clears and refills; it does not accumulate. If 30GB is left last month, this month still starts from the full allowance — it does not become 60 plus 30. So there is no need to ration data near the reset date, and no such thing as stockpiling data.

Mid-period upgrades and prorating

Halfway through the 60GB tier you find it is not enough; you can upgrade straight to 250GB. The difference is not charged as a whole month — it is prorated against the remaining days: the amount already paid is counted against the days left, and you pay the difference. The upgrade takes effect immediately, the data cap goes up on the spot, and there is no waiting for the next period.

Upgrades only go up, not down. If you want a lower tier, change plans at the next period; do not step up and down mid-period, because the prorating gets hard to reconcile on paper.

How data packs and monthly plans work together

The two meters run independently. Monthly data resets each period; data pack data lasts until it is used up and never expires. If the monthly allowance runs out before the period ends, the data pack picks up automatically — no manual switch.

Conversely, if you barely use it some month, the monthly data still resets and nothing is saved, so a data pack is better value in that case. The test is simple: steady usage month after month means a monthly plan; a few times a year means a data pack.

When to renew

Renew before expiry; renewing far in advance gains nothing extra. After expiry the plan stops and the subscription link still exists but cannot connect to routes; renewing restores it immediately, with no need to re-import the subscription or reinstall the client. This runs against many people's intuition, so it is worth remembering.

Managing multiple devices

The plan does not limit device count: phones, tablets, laptops, desktops and routers can all be online at once. Once there are many devices, do two things. First, give each client a recognisable name so you can match it during troubleshooting. Second, periodically clear the subscription from devices you no longer use, so links do not linger on old hardware. If you suspect a leak, reset the subscription and re-import on every device.

Refunds

A no-questions refund can be requested within 7 days of the first payment. Refunds go through tickets; just include the order number. Seven days is enough to run through all six earlier chapters: if it will not connect, if you do not like it, or if you picked the wrong tier, there is still time. After a refund the account remains, the subscription link stops working, and you can keep using the same account if you buy again.

8. Advanced use

The first seven chapters get you running; this one is about running better. It leans towards configuration and trade-offs, so there is no need to read it all at once — come back when a specific situation comes up.

Routing rules

Rule mode is built around one list: which traffic goes through the tunnel and which goes direct. The default rules are usually enough — common international sites through the tunnel, local services direct. When adding your own rules, matching by domain is the most reliable, matching by IP range next, and matching by application depends on whether the client supports it.

Two principles for adding rules. First, list domains that need a fixed exit separately instead of burying them in a broad rule. Second, the fewer rules the better — every rule you add should have a reason you can state. Once a rule table swells to hundreds of entries, tracking down one broken rule becomes genuinely painful.

Fixed exits and AI API calls

When calling AI service APIs, a request origin that changes frequently triggers risk controls, which shows up as intermittent rejections or captchas. The fix is to bind those domains to a fixed route so the exit address stays stable.

Beyond the exit, watch concurrency and timeouts: the number of concurrent requests is limited by route bandwidth and client connection limits, and retries on timeout need a cap, or a retry storm will crush a link that was already slow. The trade-offs are covered in more detail in route recommendations for AI API calls.

Concurrency and timeouts

How much concurrency a route can actually carry depends on its type. IEPL dedicated lines have a fixed path and suit long-held connections; relay routes queue more readily under high concurrency; direct routes are the most exposed to public gateway conditions. Put batch jobs on dedicated lines, use direct routes for quick lookups, and do not squeeze all traffic onto the same path.

4K streaming

The bottleneck for 4K is usually not the bandwidth number but link stability: the higher the bitrate, the more sensitive to packet loss and jitter. That is why the same show looks different on different routes. For stable 4K, prefer an IEPL dedicated line in the target region, and avoid peak hours when doing comparison tests.

For the specifics of why quality drops to 480p, measured 4K streaming quality comparison breaks down the relationship between bitrate, bandwidth and route type, and is worth reading alongside the region notes on the streaming access page.

Testing stability yourself

To judge whether a route is stable, do not rely on a single speed test. A more practical approach is to record connection success rate and drop count over a week: connect once at a fixed time each day and note whether it succeeded first time and whether it dropped. After a week, which route suits you is obvious.

A template for the record sheet is in most stable VPN recommendations. Keep morning and evening peaks separate; the conclusion will be far more accurate than mixing them together.

9. Troubleshooting

The order of troubleshooting is always: confirm the local network first, then the subscription, then the route, and only then suspect the server side. That order stops most problems at the first two steps.

Cannot connect

You click connect and nothing happens, or it spins forever. First check whether the local network can browse normally with the client off; then check whether the subscription needs updating; then check whether every route fails. If only one fails, switch routes; only when all fail is it worth digging deeper.

If the client reports a permission error: on Windows check whether security software is blocking the virtual adapter driver, on macOS check the VPN configuration authorisation, on iOS and Android check whether the VPN request was denied. Permission problems usually leave a clear message in the client log, so read that first.

Connects but pages will not open

Three common causes: DNS resolution is not going through the tunnel — turn on DNS leak protection; an MTU mismatch — drop the MTU one step; the rules are missing the target domain — switch to global mode to check. Using global mode as the split test quickly tells you whether the problem is rules or the link.

Slow speeds

First separate always slow from slow at peak. Always slow is usually the leg from your local network to the route entry, so switch to a route with a closer entry; slow at peak is public gateway congestion, so switch to a dedicated line. Test the same 4K video once in the morning and once in the evening — only a comparison means anything.

Subscription import fails

Check three things: whether the link is complete, since truncation while copying is the most common cause; whether the client supports that protocol prefix; and whether the system clock is accurate, since a large time offset breaks the handshake. If all three are ruled out and it still fails, reset the subscription and import again.

FAQ

For anything not covered here, open a ticket in the panel or see the contact details on the Support page. Three details beyond platform and client version speed up diagnosis: which route, what time of day, and what error.