This VPN glossary starts with the basics: subscriptions provide configuration, nodes are connection endpoints, protocols define how data is exchanged, routes describe its network path, and routing rules determine where requests go. Global and rule-based modes are traffic-handling strategies—not plan tiers or direct measures of connection speed.
People often use “VPN” as a catch-all term for proxy subscriptions, but a client may proxy only selected apps rather than create a network tunnel for the entire device. The key is not memorizing abbreviations, but understanding what each setting changes and how to verify that it’s working.
Subscriptions: Plans and Configuration Links
“Subscription” can mean different things. A plan subscription is the billing arrangement for a service, including its validity period, available traffic and renewals. In a client, a subscription usually means the source of its configuration. A subscription link is an address the client uses to retrieve nodes and related settings—not a regular webpage or an app installer.
After importing a subscription, the client reads details such as server addresses and connection parameters. Some configurations also include proxy groups, rules and DNS settings, depending on the format provided by the service. Updating a subscription fetches the configuration again; it doesn’t renew a plan or necessarily update the client app.
The same link may not work with every client. Some apps accept a list of nodes, others require a complete configuration file, and some support only specific import formats. Follow the client instructions in your account panel. Don’t paste a link into any field at random, and don’t assume a format error means every node is down.
Check billing separately. Z7VPN monthly plan traffic resets each month on the day you activated the plan; traffic bundles never expire and remain available until used. The client’s “Update subscription” button does not reset your traffic usage. Review plans and traffic bundles to compare billing options, rather than relying on the configuration name shown in the client.
Nodes and Routes: An Exit Location Isn’t the Whole Path
A node is usually a proxy connection profile you can select in a client. It includes a server address, port and authentication details, and its name may indicate a region or route type. The name alone doesn’t prove the actual exit location, physical server location or full transmission path.
The exit IP is the source address a destination website typically sees; the entry point is the server address your device connects to first. They can be different. A region in a node’s name doesn’t mean there are no forwarding hops between your device and the exit, or that the node will work the same way with every website.
| Name | What it usually describes | What the name alone can’t tell you |
|---|---|---|
| Direct | The device connects directly to an overseas proxy entry point, usually over the public internet | It doesn’t prove the route is shortest, latency is lowest or access will always work |
| Relay | The device connects to an intermediate entry point, which forwards traffic to a later exit | It doesn’t prove the intermediate link uses a dedicated line |
| IEPL dedicated line | An international Ethernet private line that a service may use for part of a route | It doesn’t mean the entire path from device to website uses a private line or is congestion-free at all times |
“Direct” has another common meaning: in routing rules, DIRECT usually means a request bypasses the proxy. That’s different from a “direct node” in a route plan. The first determines whether a proxy is used; the second describes how the proxy server is reached.
Compare routes on the same network and with the same destination app. A speed-test indicator can help narrow down your options, but a client’s connection probe doesn’t measure real download speed. Web performance also depends on DNS, the website’s server, routing and your local network, so don’t treat a single test as proof of how a site will work.
Protocols: How Clients and Servers Communicate
A protocol is neither a route nor a plan. It defines how a client exchanges data with a server. Even if two nodes are in the same region, a connection may fail if the client doesn’t support the required protocol or transport options. Conversely, nodes using the same protocol can perform differently depending on their routes and server load.
- Shadowsocks: An encrypted proxy protocol. The client must support the encryption method used by the configuration, so checking the protocol name alone isn’t enough.
- VMess: A proxy protocol with authentication and encryption mechanisms. Implementations may check timestamps, so if a connection fails, make sure your system clock is synchronized.
- Trojan: Commonly carries proxy traffic over TLS. Settings such as the server name and certificate validation must match. Disabling certificate validation should not be a routine fix.
- VLESS: A lightweight proxy protocol that does not encrypt content on its own. It’s usually paired with security mechanisms such as TLS or REALITY, so the protocol name alone doesn’t tell you whether the entire connection is encrypted.
- Hysteria2 and TUIC: Both are based on QUIC and depend on UDP network conditions. UDP restrictions, client incompatibility or incorrect settings can all prevent a connection.
This glossary explains industry terminology; it doesn’t mean Z7VPN supports every protocol listed. Check your account panel and client compatibility for currently available options. If an import fails, first check the app version, configuration format and protocol support, then investigate the route. Don’t remove authentication or security settings at random.
Global vs. Rules: Where Your Traffic Goes
Rule-based mode selects how to handle traffic according to conditions such as domain, destination IP or app. Common actions include connecting directly, using a proxy group or blocking the connection. Rules are usually checked in order, followed by a fallback rule. Refer to your client’s current documentation for the exact order and syntax.
Global proxy mode usually sends requests handled by the proxy core through the selected policy. “Global” does not mean every connection on the device is being intercepted. Apps that ignore the system proxy may still bypass this setting unless another mechanism captures their traffic. In some clients, “Global Direct” means the opposite, so check the full label.
A system proxy points the operating system’s proxy settings to the local client. Browsers and other apps often follow those settings, but not every program does. TUN mode uses a virtual network interface to capture traffic that matches its routing conditions. It usually covers more traffic, but requires closer attention to permissions, DNS and compatibility with other network software.
A proxy group is a selection container that routing rules can point to. You can choose a node manually, or the configuration may select one automatically. Switching nodes within a group doesn’t necessarily change the rules; changing rule mode doesn’t necessarily change the current exit. When troubleshooting, check both which rule matched the request and which node that rule selected.
For everyday use: If you need access to both local services and international websites, start with a rule-based mode from a trusted source and a sensible configuration. To check whether a routing issue is affecting a particular site, temporarily switch to global proxy mode for comparison. Then restore the appropriate rules—global mode isn’t automatically faster.
DNS and Leaks: Domain Lookups Take a Route, Too
DNS translates domain names into addresses a device can connect to. Routing a webpage request through a proxy doesn’t mean its DNS lookup follows the same path. Lookups may come from the system resolver, the client’s proxy core or the browser’s encrypted DNS feature. If these settings aren’t aligned, you may see lookup failures, inconsistent results or queries taking an unexpected route.
A DNS leak generally means queries aren’t following the intended privacy and routing policy—for example, when DNS requests expected to go through a proxy are instead sent to the local network’s resolver. However, seeing a resolver in a different region from the exit doesn’t by itself prove there’s a leak. Distributed deployments of public DNS services can also affect the location shown.
Check the client’s DNS settings, connection logs and test results together. If your browser uses its own encrypted DNS, make sure it’s consistent with the client’s policy. Don’t enter an unfamiliar resolver address or disable necessary security checks just to make a test page show the same region.
From Import to Verification: Follow the Steps in Order
Beginners often change the node, DNS and mode all at once. Even if access comes back, it’s then hard to tell what fixed the problem. A more reliable approach is to start with the basic configuration, change one thing at a time and keep a working setup available.
- Get a compatible client. Open the account panel through the client download page, sign in to retrieve your subscription and choose an app for your platform. System proxy and TUN settings on desktop follow a different process from the system VPN permission prompt on mobile.
- Import the configuration from your account panel. Use the matching format or import option. Make sure the node list appears. If there’s an import error, check the format and client compatibility before repeatedly switching networks.
- Choose a node and policy. Make sure the proxy group isn’t set to a direct connection, and start with the rule-based mode provided by the configuration. Grant the network permissions requested by the client.
- Verify real traffic. Check the browser’s exit IP, then open the destination website. If other apps need to use the proxy, check each app’s network settings and connection logs.
- Pinpoint the problem. If a node won’t connect, check the network and authentication. If the node connects but domain names don’t load, check DNS. If only certain apps have problems, check their proxy support, routing rules and traffic-capture coverage.
On Windows and macOS, some apps need their proxy settings configured separately. Linux command-line tools may also read proxy environment variables. A system VPN indicator on mobile means a network extension or tunnel is enabled, but doesn’t prove that every app routes traffic the same way. Follow the instructions for your specific client and platform.
- ✅ The configuration updates successfully, and the relationship between the selected node and proxy group is clear.
- ✅ System proxy or TUN is enabled as needed, and the destination app’s actual traffic route has been checked.
- ✅ The DNS settings have a known source and can be restored if something goes wrong.
- ❌ Don’t treat a “Connected” status, a node name or a single speed test as complete verification.
Understand the Settings—and the Limits of the Service
Traffic totals in the client and on the service’s billing system may be calculated differently. Check your account panel for remaining traffic and billing periods. Device limits are a separate matter: Z7VPN has no limit on the number of devices connected at the same time, but that doesn’t mean traffic is unlimited. If you share a plan with your household, keep an eye on total usage and don’t share subscription credentials publicly.
Privacy policies don’t remove technical limitations. Z7VPN states that it follows an anonymous, no-logs policy, but a proxy can’t make a website forget an account you’ve signed into or eliminate browser cookies, device fingerprinting or endpoint risks. Understanding what the proxy covers is more useful than focusing on a protocol abbreviation.
For help, start with the guides and FAQ. When contacting support, include your platform, client, mode and the step where the issue occurs, and hide your subscription credentials. This makes it easier to pinpoint the cause than simply saying “the node doesn’t work.”
In short: A subscription provides configuration, a node provides a connection endpoint, a protocol defines how data is exchanged, a route describes the path traffic takes, and rules determine where requests go. Keep these layers separate, then verify in order: import, connect, route and resolve. This makes client settings much easier to understand.