VPN beginner setup guide: every step for day one after checkout

Four things to check right after checkout

Payment going through doesn't mean you can start using the service. Spend two minutes on the four items below on day one — it saves a lot of detours when something goes wrong later.

• Account: a username and password are all you need — no email address required, so there's no “wait for the verification email” step. The password is your only credential, so keep it in a password manager.
• Plan tier: ¥9.9/month for 60GB, ¥18/month for 250GB, ¥28/month for 500GB. Data resets every month on your activation date; if you upgrade mid-cycle, the price difference is prorated across the remaining days.
• Payment methods: Alipay, WeChat Pay or USDT. After paying, the matching entry appears in the order history in your dashboard.
• Devices: no limit on simultaneous connections — phone, laptop and tablet can all be online at once, with no kicking one off to make room for another.

If 60GB runs out mid-month, you can buy a standalone data pack: ¥158/300GB, ¥358/1000GB, ¥658/3000GB. They're used until they run out, never expire, and don't reset when the month rolls over. Data packs and monthly subscriptions are billed separately, so check how much you've already used this month in the dashboard before buying.

How a subscription link is built — and keeping it safe

A subscription link isn't a node itself; it's an address that returns a list of routes. Every time you hit “Update subscription” in the client, it trades that address for a fresh node list — so when routes change you don't need to reinstall anything, one update is enough.

https://<subscription-domain>/pulse/v3/client/subscribe?token=<subscription-token>&flag=<client-format>

# Three parts, one job each:
#   subscription-domain  —— panel address, decides where the list is fetched from
#   token     —— identity credential, decides whose routes you get
#   flag      —— return format, decides whether the client can parse it

Of the three, flag is the easiest to get wrong: pick the wrong format and the client usually reports “subscription parse failed” or hands back an empty list rather than a network error. If you see that, check the format parameter first, then make sure the link wasn't truncated by a chat app.

If you suspect the link has leaked, reset the subscription token in the dashboard — the old link stops working immediately — then re-import on each device. Resetting doesn't automatically refresh the node list already on your devices, so update manually on every one.

How to import on five platforms

The five platforms use different clients, but importing is always three steps: find the subscription entry, paste the link, hit update. The table below gives the overview; the sections after it cover the details.

Always get clients from the download page in your dashboard — never install packages from third-party sites. With an outdated version the subscription format parameter may not match, which shows up as “update succeeded but the list is still empty”.

Windows and macOS: step by step on desktop

Desktop is the easiest place to get it right first time; the flow is always six steps.

1. Copy the subscription link. Hit copy on the subscription page in your dashboard; the expected result is an address starting with https:// in your clipboard, usually over a hundred characters long.
2. Install the client. Grab the matching installer from the download page. On macOS, if the system blocks the first launch, allow it once under System Settings → Privacy & Security.
3. Import and update. In the client choose Subscription → Add, paste the link and save, then hit update once. The expected result is a node list grouped by region — not a blank panel.
4. Pick a route and connect. For the first connection, choose an IEPL route (Tokyo, for example): the path is fixed and jitter is lower at peak times. The expected result is the status switching to connected and the tray icon changing colour.
5. Verify the exit. Open the on-site IP lookup page; the exit region should match the route you picked. Then open two or three sites you use often to confirm they load.
6. After switching routes, disconnect and reconnect once. The client re-handshakes, and split-routing rules take effect again on the new route.

Traffic between the client and the nodes uses military-grade encryption, and that part needs no manual setup; what you actually need to confirm is whether the subscription imported and whether your exit lands in the region you expect.

Common snags on desktop

• Empty list or a parse failure: most often the link was copied incompletely and the token parameter is missing; next most common is a flag format that doesn't match the client.
• Connects but pages won't load: first check that the system clock is accurate — a large time offset makes the TLS handshake fail; then check whether another proxy or security tool is running at the same time.
• Only a few sites are slow: usually split routing is sending that site direct — switch to another route or adjust the rule group and try again.

iOS and Android: two differences on mobile

iOS: permission prompts and background limits

The first time an iOS client connects, the system asks whether to add a VPN configuration — you must allow it, otherwise tapping connect won't actually build the tunnel. Another common behaviour: after the screen has been locked for a while the system reclaims the connection, so it shows as disconnected the moment you return to the home screen. That comes down to Low Power Mode and background refresh limits; adding the client to the list of apps allowed to run in the background helps. To verify, turn off Wi-Fi and connect once over cellular — if that works, the subscription and account are fine and the problem is the original network.

Android: permissions and battery policy

On Android the first connection asks for VPN permission; tick “always allow” to avoid the prompt every time. Some devices' battery policies kill background processes once the screen goes off, so set the client to unrestricted in battery settings. If you install an APK rather than the app-store version, the system asks you to allow installs from that source first — a one-time permission in settings.

On mobile you import the subscription once, then update manually in the client. Don't send the subscription link into a chat window and copy it from there — chat history keeps that credential around for a long time. Phone and laptop share the same subscription, simultaneous connections are unlimited, and each can pick its own route.

Linux: importing from the command line and checking ports

On Linux you'll usually run a command-line client or a lightweight GUI client — there's no one-click connect button, so you confirm both the import and the checks yourself.

# 1) Import the subscription (command name and flags follow the client's help output)
client sub import "https://<subscription-domain>/pulse/v3/client/subscribe?token=<subscription-token>"

# 2) Start the service
client service start

# 3) Confirm the local proxy port is listening (example port 7890)
ss -lntp | grep 7890

# 4) Request through the local port to confirm the link works
curl -x http://127.0.0.1:7890 -I https://www.example.com

Expected result: step 3 shows a LISTEN line and step 4 returns an HTTP status line. If curl hangs with no response, first confirm the service actually started, then check that the port number matches your configuration; if both are fine, go back and check whether the subscription pulled any routes at all.

One more thing that's easy to overlook in a command-line setup: DNS. If the system resolver still uses the local network you can get “connects but domain lookups fail”, or lookups that resolve locally. Point system DNS at the local DNS port the client provides, or turn on “resolve DNS through the proxy” in the client, then reconnect.

Day-one connectivity checklist

The checklist below can be finished on day one; get through all of it before you think about tuning.

• ✅ Subscription imported, node list not empty, routes grouped by region
• ✅ After connecting, the exit region on the on-site IP lookup page matches the route you picked
• ✅ News, video and code-hosting sites all load normally, one after another
• ✅ The phone still connects after switching to cellular, which means the account and subscription are fine
• ✅ A second device imports the same subscription and connects independently; simultaneous connections are unlimited
• ❌ Pasting the subscription link into a group chat, a public document or a support-ticket screenshot
• ❌ Judging connectivity by “one website opens” without checking the exit region
• ❌ Reinstalling the client at the first problem without reading the error in the client log

Troubleshooting: narrow it down in order

Troubleshooting isn't about changing every setting at once — change one variable at a time and see whether the result moves. The order we recommend:

1. Read the status and the log. Clients usually say whether the subscription fetch failed, the handshake timed out or authentication failed — three very different directions to fix.
2. Switch routes. Try another route in the same region, then another region. If two routes in the same region both fail, it's more likely your local network or the account.
3. Switch networks. Swap Wi-Fi and cellular — that quickly separates a local network restriction from a client configuration issue.
4. Update the subscription. When the route list is stale, the client keeps connecting to nodes that are no longer in use.
5. Reset the subscription token and re-import. Use this when you suspect the link leaked, or when a new device simply won't pull the list.
6. Open a ticket. Include the client version, platform, chosen route and the exact error text — far faster than “it won't connect”.

If the IP lookup page shows the right exit but individual sites still say you're in the wrong region, the usual cause is DNS lookups bypassing the proxy: the client is proxying traffic while the system resolver still uses the local network. Turn on DNS resolution through the proxy in the client, or turn off private DNS at the system level, then reconnect.