First, understand what VPN subscriptions, nodes, split tunneling, and rule mode each do: a subscription provides configuration, a node is a connection endpoint, split tunneling routes requests, and rule mode applies routing based on conditions. They are separate functions—not interchangeable settings.
A “VPN client” may use a system VPN tunnel or run a proxy core. Seeing “Connected” in the app does not automatically mean every app is using the same route. This guide explains the key terms in the order you’ll encounter them, then walks through setup and troubleshooting.
Subscriptions and Nodes: Configuration Sources and Connection Endpoints
A paid subscription and a subscription link are not the same thing
A paid subscription refers to the service’s billing arrangement; in a client, “subscription” usually means an updateable source of configuration. The service dashboard provides a subscription link. When the client reads it, it gets node settings; some configurations also include policy groups, rules, and DNS settings. Data-plan users may also import configuration through a subscription link, so having one does not necessarily mean monthly billing.
Subscription links usually contain credentials that identify account access, so treat them as sensitive information. Don’t post the full link in public comments, screenshots, or unfamiliar online conversion tools. If a link stops working, check your service status and latest configuration in the dashboard; repeatedly refreshing cannot fix expired credentials.
Nodes, Regions, and Exit IPs
A node is a set of connection parameters, typically including a server address, port, protocol, and authentication details. The region in a node name can help identify its exit location or intended route, but the name itself is not technical verification. The regions of the entry address, relay points along the route, and final exit may differ.
An exit IP is the source address seen by the destination website. After selecting a node in a particular region, check the exit using an IP lookup and the destination website’s actual behavior. Geolocation databases may show different regions, so a one-off location discrepancy does not prove the route is broken.
Connection Routes and Protocols: Path vs. Transport
A connection type describes how traffic reaches the exit; a protocol describes how the client communicates with the server. A dedicated line is not a protocol, and a protocol does not directly indicate speed. Confusing the two can lead to the mistaken belief that switching protocols will always resolve congestion.
| Term | What it means | What it does not tell you |
|---|---|---|
| Direct connection | The client connects directly to the destination proxy server, without an additional relay configured by the service. | It does not mean the request bypasses the proxy, nor does it guarantee a shorter or faster route. |
| Relay | Traffic first reaches a relay, then gets forwarded to another server or exit. | An additional relay does not necessarily increase perceived latency; route quality still matters. |
| IEPL dedicated line | Usually means that part of the transmission route uses an international Ethernet private line. | It does not mean the entire route to the destination website uses a dedicated connection. |
| Proxy protocol | Defines how connections are established, authenticated, and used to transmit data. | The protocol name alone cannot tell you the available bandwidth, privacy level, or website compatibility. |
Pay attention to what “direct” means in context. In a route description, it refers to the connection path; in routing rules, DIRECT usually means a request does not use a proxy exit. These meanings are not interchangeable. For information about 1KVPN routes, refer to the locations page and the actual labels in your dashboard.
What common protocol names mean
Shadowsocks is an encrypted proxy protocol; VMess has built-in authentication and encryption; Trojan typically carries proxy connections over TLS; VLESS does not provide transport encryption on its own and should be used with an appropriate mechanism such as TLS. Hysteria2 and TUIC are generally based on QUIC and rely on UDP, so they may fail to connect on networks that restrict UDP.
These are industry terms, not a claim that 1KVPN supports every protocol listed. Your client must support the protocol and transport specified in the configuration. Being able to open a client does not mean it can import every subscription format. Use a client and import method explicitly supported in your dashboard.
Split Tunneling, Rule Mode, and Global Mode
Split tunneling classifies requests and sends them through different routes. Conditions may include a domain, destination IP, application process, or other supported information; actions may connect directly, use a proxy policy group, or reject the request. Whether a rule works also depends on whether the client can access the information needed to match it.
- Rule mode: Checks requests against rules in order and usually applies the action for the first match. Traffic that does not match a specific condition is handled by the fallback rule at the end.
- Global mode: Usually sends requests handled by the proxy core through the selected policy. It does not automatically take over every app or network protocol.
- Direct mode: Usually connects requests already handled by the client directly to their destinations. It does not mean the client has exited, and it may not disable the virtual network interface.
A “policy group” in the rules is a set of exits you can select or have selected automatically—not a separate server. The same node may be used by multiple policy groups. If a website’s request matches a dedicated group, changing the node in the default group may not affect it.
For example, international websites might use a proxy policy while local services connect directly. If a broad direct-connection rule appears before a specific proxy rule, the request may match the direct rule first. When troubleshooting, check the request log for the matched rule and actual policy instead of focusing only on the client’s prominent connect button.
System Proxy and TUN: Which Traffic Reaches the Client?
A system proxy makes a proxy address available to apps. Browsers and apps that follow this setting pass requests to it, but some apps use their own network settings or ignore the system proxy entirely. So if a browser can reach a website but a desktop app cannot, the node may not be the problem.
TUN mode uses a virtual network interface and routing rules to take over traffic. It usually covers more than a system proxy alone, but still depends on permissions, routes, exclusion rules, system restrictions, and client implementation. If local devices become inaccessible after enabling it, check your LAN bypass rules before changing your subscription.
Platform differences mainly involve permissions and traffic routing
Windows and macOS commonly use system proxies or virtual interfaces to route traffic. On Linux, setup may differ depending on the desktop environment, network manager, and permissions available to the service. Android clients can route traffic through the system VPN interface, while app-exclusion options depend on the client. iOS typically establishes a tunnel through a system network extension, with a different interface and permission flow from desktop platforms.
A VPN indicator in the operating system only shows that the relevant tunnel or interface is active; it does not prove which exit a request uses. 1KVPN supports Windows, macOS, iOS, Android, and Linux. Clients for Windows, Android, macOS, and Linux are available from the dashboard after signing in; iOS availability is determined by the dashboard. Subscriptions are available after signing in.
DNS and Privacy: What to Check After Connecting
DNS translates domain names into addresses. Routing webpage traffic through a proxy does not mean DNS queries necessarily follow the same route. A DNS leak generally means queries use a resolver that does not match the intended privacy path—for example, a resolver provided by the local network.
When checking, review the client’s DNS configuration, the browser’s encrypted DNS settings, and whether other software is managing network traffic. An external resolver appearing in a DNS test does not necessarily mean there is a leak; it may be a remote resolver you deliberately configured. What matters is whether it matches your expectations, not whether its location exactly matches the node’s region.
Encrypted DNS protects queries in transit to the resolver; it does not automatically hide later website connections. A proxy connection also does not prevent accounts, browser cookies, or information you submit from identifying you. 1KVPN describes its privacy policy as “anonymous, no logs.” Treat this as a service policy, not a guarantee that all online activity is impossible to associate with you.
From Import to Verification: A Step-by-Step Guide
Once you understand the terms, follow these steps in order. Change one setting at a time and check the result to avoid losing track of what each change did.
- Check the client source and compatibility. Get a compatible client from the dashboard and check your operating system and configuration format. Don’t import a client-specific configuration as if it were a universal text format.
- Get and import your subscription. After signing in, copy the subscription link and use the client’s subscription import option. Once imported, check that the node list appears and that updates complete without errors.
- Choose an exit and operating mode. Start with the region you need and use the supplied rule configuration. Confirm that the relevant policy group has the intended node selected.
- Enable the appropriate traffic routing. Turn on the system proxy or TUN as instructed by your client. Avoid running multiple network-routing tools at once, as their routing and DNS settings may conflict.
- Verify real-world access. Check the exit IP, destination website, and apps you need to use. If only a specific app fails, check its proxy settings and which rule it matches.
- Record the error and narrow down the cause. Distinguish subscription update errors, node handshake failures, DNS resolution failures, and website-side access denials. Then look for the relevant guidance in the Help Center.
- ✅ Confirm the configuration appears in the node list and the subscription updates without errors.
- ✅ Confirm the matched rule, policy group, and exit in the request log are as expected.
- ✅ Verify access in your browser and the apps you actually need—not just by checking the connection icon.
- ❌ Don’t treat a successful latency test as proof that a website is accessible, or global mode as proof that all traffic is being routed.
Data, Device Limits, and Plan Terms
Bandwidth, latency, and data answer different questions: bandwidth describes transfer capacity, latency measures communication delay, and data is the amount transferred. A client’s latency test usually checks a specific test target; it cannot directly predict download speeds, video quality, or whether a particular website will be accessible.
Device limits and data allowances are separate. 1KVPN has no device limit, but that does not mean data is unlimited. Monthly plans are ¥9.9 / 60GB, ¥18 / 250GB, and ¥28 / 500GB. Monthly data resets on the activation date each month. Mid-cycle upgrades are prorated for the remaining days, so don’t assume they follow calendar months.
Data packs cost ¥158 / 300GB, ¥358 / 1000GB, and ¥658 / 3000GB. They remain valid until used and never expire. “Never expires” refers to the validity period of a data pack; it does not mean unlimited usage or guarantee a particular speed. Compare your usage and frequency in the plan details.