The Complete Beginner's Guide to Cross-Border VPNs: From Choosing a Plan to Connecting to International Routes

What These Services Do

What a cross-border VPN does can be summed up in one sentence: it moves the route between you and overseas websites onto a shorter, more stable line. The client first opens an encrypted tunnel on your device, requests travel through the tunnel to a server outside mainland China, that server visits the target site on your behalf, and the reply comes back the same way. To the website, the visit comes from the server's country or region, not from your local network.

Compared with browser extensions and online proxies, the difference is scope. An extension only takes over some requests inside the browser, while other apps on the system keep using the local network; a client builds a system-level tunnel, so most of the traffic on the device goes through it. That is why the same site can open in an extension but report a region restriction in an app.

How the tunnel encrypts and transports data is decided by the protocol. Common options are Shadowsocks, VMess, Trojan and VLESS, plus the QUIC-based Hysteria2 and TUIC. The first four lean more on encryption and obfuscation; the last two hold their speed better on lossy, high-latency links. You do not need to pick by hand: once the subscription is imported, the client brings out the protocol for each node along with it.

The line type sets the ceiling on the experience. Direct means going straight from your local ISP to an overseas data center; relay means connecting first to an entry point in mainland China, then crossing the border along an optimized path that avoids congested international gateways; IEPL runs over carrier-grade point-to-point links, with steadier bandwidth and a higher cost. Judge by the evening peak, not by the name: whether the same node visibly slows between 20:00 and 23:00 is more reliable than any advertised figure.

Choosing a Plan by Traffic and Use

Choosing a plan comes down to two questions: roughly how much traffic you use in a month, and whether that usage is continuous or concentrated. The first decides the tier, the second decides the billing model.

Usage splits into three buckets: web and social, video, and downloads and updates. Video is the big consumer — the higher the resolution, the faster it goes; web and social stay fairly steady and do not double just because you use them for a few more days. If you only browse and use social apps, the 60GB tier is usually enough; if you watch video every day, start at 250GB or 500GB to be safer.

Billing comes down to your rhythm of use. Monthly plan traffic resets each month on your activation date, and whatever you do not use does not roll over — a good fit if you connect every day. Upgrading mid-cycle is charged pro rata for the remaining days, so you do not have to wait for the next period. Data packs are valid until used up and never expire, which suits on-and-off use: a week or two of business travel, binge-watching a series, or a one-off batch of file transfers — buy once and use it whenever.

One more item that is easy to overlook: a single account can be online on unlimited devices at the same time. Desktop, tablet, iPhone and Android devices can all connect together, with no separate purchase for each device.

The Order of Ordering and Paying

1. Choose a tier: on the pricing page, confirm the billing model and data tier. Monthly plans and data packs are listed separately, so decide which one you want first.
2. Sign up: a username and password are all you need, with no email address required. Skipping the email step also means there is no email recovery channel, so keep your own record of the password.
3. Pay: Alipay, WeChat and USDT are all supported, and the account is activated as soon as payment completes.
4. Get the subscription: log in to the user panel and pick up the client for your platform and the subscription URL from the download page.

Pick a payment method based on what you already have. Alipay and WeChat suit everyday use; USDT suits people who do not want payment records tied to their account. All three give the same account permissions after activation — no payment method is more fully featured than another.

Clients and Subscription Import

The process is basically the same on every platform; only the system prompts and the install method differ. On desktop, get the installer from the download page — double-click to install on Windows and macOS, and follow the instructions on the download page for Linux; on iPhone and iPad, get it from the App Store; on Android, download the installer from the download page and install it directly. Every download entry point sits behind the login.

1. Copy the subscription URL from the panel.
2. Open the client, find the Subscriptions or Profiles section, create a new subscription, paste the URL in and save.
3. Click Update Subscription once by hand, and the client pulls down the node list.
4. Pick a region in the node list and click Connect. The first time, the system asks whether to allow adding a VPN configuration — allow it.
5. Switch between global and rule mode as needed.

Rule Mode vs Global Mode

Rule mode splits traffic by domain and IP: LAN and mainland China addresses go direct, everything else goes through the tunnel, which cuts unnecessary detours — this is the everyday setting. Global mode sends all traffic into the tunnel; use it when troubleshooting to rule out interference from the split rules. DNS settings follow the mode: in global mode, DNS lookups should also go through the tunnel, otherwise you end up resolving in mainland China while connecting outside it — the familiar DNS leak — and the symptom is that some sites are still judged to be local visits.

Two Things to Check First When an Import Fails

If the node list is empty, first check whether the subscription URL was truncated by a chat app, then click update again; if it is still empty, go back to the panel and copy it again. If you can connect but pages will not load, it is usually because the subscription content has been updated or the nodes have changed — a manual subscription update brings it back.

After Connecting, Verify It Works

The client showing Connected only means the tunnel is up; it does not mean traffic is really leaving through an overseas exit. Run the three checks below — each one has a clear thing to look at.

1. Check the exit: open a network check page and see whether the IP and region shown match the node you picked.
2. Check resolution: on the same page, look at the region the DNS results belong to. In rule mode it is normal for mainland China domains to resolve in mainland China; in global mode everything should resolve outside.
3. Check the target: open the service you actually need and confirm there is no region notice and no repeated bounce back to the login page.

• ✅ The exit region shown on the network check page matches the node you selected
• ✅ The target site opens normally, with no more region-restriction prompts
• ✅ After disconnecting and reconnecting, the exit IP changes accordingly
• ❌ Assuming it works just because the client icon turned green
• ❌ Judging line quality by one high speed-test number instead of evening-peak behavior
• ❌ Seeing local resolution results in global mode and not going back to check the DNS settings

Common Misconceptions and How to Judge

• Comparing only price and ignoring the line type. At the same advertised bandwidth, direct, relay and dedicated lines behave very differently at evening peak.
• Treating connected as working. The first is a tunnel state; the second has to be proven with the exit IP and the target site.
• Leaving global mode on all the time. Rule mode cuts unnecessary detours; global is only needed for troubleshooting.
• Ignoring subscription updates. After nodes change, addresses in an old subscription stop working — the symptom is connecting fine but nothing loading.

For the step-by-step details, see the setup guides and the help center; prices and tiers are on the pricing page, and you can check the route list before deciding which region to pick.