How to Use a VPN: The Complete Beginner's Guide, from Setup to First Connection

Using a VPN comes down to one fixed chain: create an account, choose a plan, get the subscription link, import it into a client, and confirm that traffic really leaves through the route. When any link in that chain breaks, the symptom looks the same — the client says connected, but pages won't load. So the walkthrough below follows the actual order of operations, with a checkpoint you can verify yourself at each step, and notes on how importing differs across Windows, macOS, iOS, Android and Linux.

First, separate four things: subscription service, client, protocol, subscription link

Beginners rarely get stuck on the steps themselves; they get stuck because several terms blur together. Keep these four apart and every step that follows becomes concrete.

The subscription service determines which regions you can reach, whether traffic runs on dedicated or relayed routes, and how much data you get each month; the client determines whether your device can send traffic out according to your rules; the protocol determines how that traffic is encrypted in transit. The protocol is normally issued by the server, so you don't pick it yourself — but your client has to understand it. An empty node list right after importing a subscription usually means the client is too old to read the protocol type being issued.

Why a subscription link shouldn't be forwarded casually

A subscription link isn't an ordinary URL — it carries account credentials. Every time a client updates the subscription, it is effectively trading that link for a fresh node configuration from the server. Once the link leaks, someone else is spending your data allowance.

You don't need to memorize protocol names, but your client must recognize them

Shadowsocks, VMess, VLESS, Trojan, Hysteria2 and TUIC are all protocol names. They differ in encryption, handshake and congestion control. Regular users don't need to understand each one; just know two things: your client has to support them, and a single subscription may contain several protocols at once, so there's no need to avoid a particular one when picking nodes.

If a client reports an unsupported protocol, the fix is usually not to edit parameters but to upgrade the client — or switch to a client that's still maintained. Parameters are issued by the server; hand-editing them tends to introduce errors and removes the baseline you need for troubleshooting.

Choosing a plan: match the traffic tier to your usage

Think of a plan as two axes: monthly traffic and how many people use it at once. VPNVan accounts don't limit the number of devices, so what you really need to estimate is traffic — and whether you're willing to pay a little more for stability during peak evening hours.

Traffic resets monthly on your activation date, not on the first of the calendar month, so the day you first activate sets the start of every later cycle. If you want to upgrade mid-cycle, the price difference is prorated by the remaining days — no need to wait for the next cycle.

If your usage clusters into a few months a year, look at data packs: ¥158/300GB, ¥358/1000GB and ¥658/3000GB. They're used until they run out and never expire. The upside is no deadline pressure, which suits people who only need a few intensive weeks a year; if you use it every day, a monthly subscription gives you a smoother per-unit price.

Signing up and ordering: a username and password are all you need

VPNVan sign-up doesn't require an email address — pick a username, set a password, and you're done. What you skip isn't just waiting for a verification email, but also the familiar dead ends like 'the message landed in spam' or 'the link expired'.

Payment and activation

Checkout supports Alipay, WeChat Pay and USDT. The account is activated as soon as payment completes, and the user panel shows your current plan, traffic reset date, traffic used and subscription address.

1. In the user panel, choose a plan and billing cycle, and check the price against the traffic tier.
2. Pick a payment method and complete payment; don't close the result page midway.
3. Go back to the subscription section of the panel and copy the subscription link.
4. Import and update the subscription on one device first, confirm the node list appears, then roll it out to your other devices.

A no-questions-asked refund can be requested within 7 days of your first payment, so don't agonize over the tier: validate the whole chain on the lowest one and adjust if it doesn't fit.

Importing into a client: how the five platforms differ

The same subscription link behaves quite differently across systems. On desktop it's usually four steps — paste the link, update the subscription, pick a node, turn on the proxy. Mobile is simpler, but iOS adds one extra hurdle. Linux often has no GUI at all, so you write the configuration yourself.

System proxy vs. TUN mode

A system proxy only affects apps that respect the system proxy settings. Browsers are generally fine, but plenty of desktop programs and command-line tools never read that setting — which is why 'the browser works but nothing else does'. TUN mode creates a virtual network adapter, takes over traffic as a whole, and then decides where it goes according to your routing rules, so it covers far more; the trade-off is that it needs administrator rights, and a few LAN tools or games may need to be added to the direct list first.

Routing rules: rule mode vs. global mode

Rule mode decides by domain and IP: domestic sites go direct, international sites use the route, and LAN addresses skip the proxy. Day to day you should stay in rule mode — it guarantees that reaching domestic services doesn't take a detour abroad and back. Global mode pushes all traffic through the route and is only good for troubleshooting: if you suspect a rule is wrong, switch to global and check. If the site loads then, the problem is in your rules.

Remember subscription updates too: when the server adds or adjusts nodes, the client won't know immediately — you have to click update once. Most clients support scheduled updates, and once a day is enough.

After the first connection: three steps to verify it really works

'Connected' is only the client's own status; it doesn't mean traffic is actually leaving through the route. Verify with the three steps below — far more effective than reinstalling the client over and over.

• ✅ Check the exit IP: open an IP lookup page and see whether the location matches the node region you selected.
• ✅ Check DNS: confirm that domain resolution is handled on the route side, not by your local ISP.
• ✅ Compare per app: let only the browser use the route and keep other apps direct, then visit the same site from each and compare.
• ❌ Assuming success because the client icon changed color, without checking the exit IP.
• ❌ Judging the proxy by whether ping works — ICMP doesn't travel through the proxy tunnel, so a reply or a timeout proves nothing.

DNS is the step most often skipped in that second check. If domain resolution still goes to your local ISP, then even when traffic uses the route, the ISP can tell from the resolution records which sites you visit — and the answers may be poisoned, which shows up as 'the IP lookup says another country, but the site won't load'. The fix is to enable remote DNS resolution (or fake-ip mode) in the client so that resolution requests also travel through the route.

# macOS: check the DNS servers currently in use
scutil --dns | grep nameserver

# Windows (PowerShell): check DNS configuration per network adapter
Get-DnsClientServerAddress -AddressFamily IPv4

# Linux (systemd-resolved): check resolution status and upstreams
resolvectl status

Common problems at a glance, and a few closing tips

The table below covers the situations beginners hit most often. Look up the symptom and its cause — faster than trying parameters one by one.

If it still doesn't work after all that, have three things ready before contacting support: the client name and version, the specific site that fails, and the location reported for your exit IP. Those three narrow the problem down to a route or a rule instead of starting the conversation from scratch. The site's contact support and help center pages already answer most common questions.

Once you've been through these five steps, moving to a new device or a new OS is just repeating the import and verification — no need to start from zero. To compare tiers and data packs, see the pricing page; to check account status and your subscription address, sign in to the user panel.