VPN Setup Guide for Beginners: Every Step From Checkout to a Working Connection

This guide is for anyone using a VPN for the first time: from paying to actually getting the client connected there are only a handful of actions, yet any one of them can end in “looks connected, nothing works”. Below, each step is broken out in the real order, with what you should see when it is done and where to look first when it stalls. What eats a beginner's time is rarely the install — it is a subscription that never refreshed, a system permission left ungranted, or a routing rule that sent the test traffic direct.

Before You Order: Three Checks

Line up three things before you pay: how you will sign up, which plan tier, and which payment channel. Once those are settled, the rest of the flow rarely needs redoing.

The sign-up method is what people overlook most. This service's account needs no email address — a username and a password are enough to create it, with no confirmation mail to wait for and no everyday inbox handed over. The trade-off is that those two items are your only credentials, so store them in a password manager the moment you finish signing up rather than leaving them in browser autofill.

Plans come in three tiers by monthly traffic, and traffic resets monthly on your activation date, not on the 1st of the calendar month:

If you only need it now and then, there are also pay-as-you-go traffic packs: ¥158 for 300GB, ¥358 for 1000GB and ¥658 for 3000GB — use them up whenever, they never expire. They sit on a separate track from monthly plans and never reset each month, which suits business trips or short-term needs.

Payment channels are Alipay, WeChat and USDT; the device count is unlimited, so one account can be used on several devices at once. That matters for the “test on one machine first, then roll it out” workflow — no switching accounts just to run a test.

Sign-Up and Checkout: the No-Email Flow

Work through this section in order; you never need to leave the dashboard:

1. Open the dashboard's sign-up page and enter a username and password. Once you settle on a username, keep it — you will need it later to tell configurations apart in the client.
2. Submitting takes you straight into the dashboard. The success signal is seeing the overview page, not still sitting on the form.
3. On the plans page, pick a tier, check the billing period and monthly traffic, then complete payment through your chosen channel.
4. After paying, go back to the overview page and confirm that available traffic and an expiry date now appear.

Know the success signal for each step: sign-up succeeded when you can get into the dashboard; payment succeeded when the overview page shows a traffic balance, not merely a charge notification from the payment app. There is sometimes a lag between the two — if they disagree, refresh the dashboard first, then check the order history.

Getting the Subscription: Link, QR Code and Client

A subscription is not a node itself but an address: the client requests that address, gets back a node list, and parses it into individual routes. The list usually comes in one of two forms. One is plain text with one node URI per line — ss://, vmess://, trojan://, vless://, hysteria2://, tuic:// — with the whole thing then Base64-encoded; the other is a YAML config that ships proxy groups and routing rules together. Use whichever form your client supports.

The dashboard's download page carries clients for each platform; sign in and grab the installer that matches your system. Don't hunt for a “same-name client” in search results — an installer of unknown origin can walk off with your subscription address.

A subscription link is the equivalent of account credentials: whoever has it can pull your node list. Don't paste the link into public groups and don't post a screenshot — the QR code holds the same string.

Importing Into a Client: How the Five Platforms Differ

The same subscription is imported differently on different systems, and it stalls in different places. The table below lists the import method and the most common failure for each platform.

Protocol differences affect which route is more likely to connect. Shadowsocks and Trojan are mostly TCP, and Trojan uses a standard TLS handshake, so it is sensitive to system time and the certificate chain; VMess and VLESS are also mostly TCP, with VLESS the lighter of the two and often paired with TLS; Hysteria2 and TUIC run over QUIC, meaning UDP, which holds up better on lossy networks — but some networks throttle UDP, and there a TCP route is actually faster.

Android's per-app proxy deserves its own note: once enabled, only the apps you tick go through the proxy. Tick the browser but not the app you care about and you get “web pages load, the app spins forever”. During testing, send all traffic through the proxy first, then open it up app by app once you know it works.

Verifying the Connection: a Three-Step Check You Can Repeat

The client saying “Connected” is only a local state; it does not mean traffic is actually leaving. Verify with the three steps below — the conclusion is more reliable than the icon.

1. Compare exit addresses. Before connecting, open any IP lookup page in the browser and note the result; check again after connecting. Two different results mean traffic really is going through the route; two identical results mean the proxy is not in effect, so go back and confirm system proxy or TUN is genuinely on.
2. See which path DNS resolution takes. If DNS queries are still handled by the local network, the answers reflect where you are and can land you on a node that is far away.
3. Open the site or app you actually need. If the first two steps passed and this one still fails, the routing rules have most likely sorted that domain as direct rather than the route being at fault.

# macOS / Linux: look up how a domain resolves
dig example.com +short

# Windows PowerShell
Resolve-DnsName example.com

Swap the example domain for the one you actually need, run it once without connecting and once after, and compare. If the answer after connecting is still the address your local network gave, DNS is not following the proxy.

When It Stalls: the Check Order

Check in order; don't skip steps. Each one rules out a class of causes, and skipping around only tangles the problem.

• ✅ Update the subscription first: an empty node list, or one with only stale entries, makes every later adjustment pointless.
• ✅ Then switch routes: a region usually has several, and one dead route does not mean the account is broken.
• ✅ Check the system clock: a large offset breaks TLS handshakes, and protocols like VMess are especially sensitive — turn on automatic time setting.
• ✅ Turn off per-app proxying and custom routing rules, send all traffic through the proxy, and test again.
• ✅ Try another network: move from the current Wi-Fi to a different one to tell whether this side is blocking the port or UDP.
• ❌ Don't reinstall the client as a first move; if the config is fine, a reinstall only hides the real cause.
• ❌ Don't run two proxy tools at once — system proxy and TUN will fight over traffic.
• ❌ Don't post your subscription link in public asking for help; it is the same as account credentials.

Day-One Usage Habits

Once you are connected, what shapes the day-to-day experience is three settings and habits, not the number of routes.

Routing rules

Routing decides which traffic goes through the proxy and which goes direct. Common rules match on domain, IP range or region: frequently used international sites through the proxy, local services and intranet addresses direct. The classic sign of a reversed rule is “the local cloud drive got slow and the international site still won't open”. After editing rules, make the client reload the config rather than just tapping connect.

Traffic checks

Monthly plan traffic resets on your activation date each month, not on the 1st. The used-traffic figure in the dashboard is the only way to tell whether something is quietly burning data: if a day's usage far exceeds expectations, first check whether system updates, cloud backups and other heavy jobs ended up in the proxied path.

Refund window

A 30-day no-questions refund means the first week can serve as a trial: connect every device you normally use, open every service you normally watch, confirm the routes are stable on the network you are actually on, and only then decide about the long term. With no limit on device count, you can validate it all in one go.