This guide answers one question: after checkout, what still stands between you and a working connection. The order is fixed — confirm the subscription, import the subscription link, pick a route, verify it works, and only then settle into daily use. Every step has a clear result to expect; if it doesn't match, stop there and troubleshoot instead of guessing.
Confirm the subscription is active
Once the order completes, a subscription record appears in your account right away. VPNAF asks only for a username and password — no email address — so there is no activation mail to wait for. That removes the most common first stumbling block: waiting on an email that will never arrive.
Open the dashboard and check three things first: plan type, remaining data, and reset date. Monthly plans reset every month on the day you activated, not on the 1st. If you upgrade mid-cycle, the price difference converts into remaining days, so you don't start a new billing period. Data packs, by contrast, are used until they run out and never expire — a good fit if you connect only occasionally but move a lot of data when you do.
| Feature | Monthly plan | Data pack |
|---|---|---|
| Billing | Paid monthly | One-time purchase |
| Data rules | Resets monthly on the activation date | Used until it runs out, never expires |
| Price tiers | ¥9.9 / 60GB ¥18 / 250GB ¥28 / 500GB |
¥158 / 300GB ¥358 / 1000GB ¥658 / 3000GB |
| Best for | Connected every day, steady data use | Occasional use, or heavy use over a short period |
| Mid-cycle changes | Upgrade and the difference converts into remaining days | No billing cycle — use it until it runs out |
Payment goes through Alipay, WeChat Pay, or USDT, and the subscription status refreshes as soon as the payment clears — no manual activation. One subscription covers unlimited devices, so phones, computers, and tablets all work without buying a second seat. For the exact tiers, see plans and pricing and pick by what you actually use each month.
The reset date follows your activation date, not the 1st of the month. Mix that up and you can burn through your data in the last few days of a cycle, then blame the routes for a problem that isn't there.
Import the subscription link and client
The subscription link is the most misunderstood piece of the setup. It isn't a download URL but a tokenized URL: the client requests it and receives a configuration containing the route list, ports, encryption methods, and transport parameters. Importing a subscription is therefore not the same as typing in a server address — in almost every case you paste the link into the client and let it parse the rest.
The differences between the five platforms come down mostly to system permissions:
- Windows: the install has two parts, a system service and a tray app. After importing the subscription you need to allow it to create a virtual network adapter, and the first connection triggers a one-time permission prompt.
- macOS: during installation you must allow the network extension under System Settings → Privacy & Security, otherwise you get the illusion of “connected” with no traffic going through the route. On M-series chips the universal build is fine.
- Android: after importing, add the client to the battery optimization allowlist. Otherwise the system reclaims it in the background and the connection drops a few minutes after the screen locks.
- iOS: the configuration lives as a VPN profile, and the first connection needs approval in system settings. Switching routes happens inside the client, so you don't reinstall the profile each time.
- Linux: most clients run from the command line or a tray icon and need root to create the tun device; without a graphical environment, start them straight from the config file.
A subscription may include several protocols: WireGuard, IKEv2, and proxy protocols such as Shadowsocks, VMess, Trojan, VLESS, Hysteria2, and TUIC. You don't need to understand each one — the client reads the protocol labeled on each route and applies the parameters automatically, and everything inside the tunnel is encrypted to banking-grade standards. The only difference is how the transport layer travels. You only need to know this for troubleshooting: QUIC-based Hysteria2 and TUIC hold up better on lossy links, while WireGuard and IKEv2 recover faster when a mobile network switches.
Treat the subscription link like a password. Don't paste it into group chats, screenshot it, or drop it into a public subscription converter — if the link leaks, someone else burns through the data in your plan. If something looks wrong, reset the subscription link in the dashboard and the old one stops working immediately.
Choose nodes by route type
Routes in the dashboard are grouped by region, with the route type marked next to each one. It's the column beginners skip, yet it largely decides how the evening peak feels. The full regional spread is on the route list; here we only cover the differences between types.
| Route type | How data travels | Evening peak | Good for |
|---|---|---|---|
| Direct | Leaves the country locally through public international gateways | Most affected by gateway congestion, widest swings | Daytime research and light browsing |
| Relay | Connects to a relay node first, then exits from there | More stable than direct, depending on relay facility quality | Everyday browsing and video |
| IEPL dedicated line | Travels over a carrier dedicated line, away from public gateways | Smallest fluctuations | Evening peak, live streaming, meetings, long-lived connections |
A sensible order for picking routes: test the region closest to you first, then compare against an IEPL dedicated line. If the two are close, your local path to the international gateway isn't congested; if the dedicated line is clearly steadier, set it as default and keep direct as a backup.
On region choice, Hong Kong, Japan, and Singapore usually give lower latency, while the United States and the Netherlands suit services in those regions. The same region often offers direct, relay, and dedicated routes side by side — same name, different path. That's why one region can list several routes.
There is only one test: whether it holds up during the evening peak. Every route looks good in the daytime; the one that stays connected without buffering at peak hours is the one worth setting as default.
Verify the exit and DNS are correct
Connected doesn't mean working. The client showing “connected” only means the tunnel is up; whether traffic actually uses the route and whether DNS follows it need separate checks. Do the four steps below in order, and stop at whichever one doesn't match.
- Check the exit region: after connecting, open any IP location lookup page. It should show the country or region of the route you selected. If it still shows your local location, the split-tunneling rules are excluding the current app from the tunnel.
- Check DNS: confirm resolution requests go to DNS on the route side, not your local ISP. DNS left on the local side is what's called a DNS leak — pages still open, but your browsing history is exposed to the local network.
- Check the system clock: a large time offset makes certificate-based handshakes fail, which shows up as “connected but no page will load”. Turn on automatic time sync.
- Reconnect once: disconnect and connect manually to confirm the client recovers on its own, rather than discovering on the way out that you have to click something.
Commands to check DNS on three platforms:
# Windows: check which DNS resolver the requests go to
ipconfig /all
# macOS: view the system resolver configuration
scutil --dns
# Linux(systemd-resolved)
resolvectl statusRun through the acceptance checklist once; start using it normally only when everything matches:
- ✅ Exit IP location matches the selected route
- ✅ DNS requests go to servers on the route side, not the local ISP
- ✅ System time is synced with network time and certificate handshakes work
- ✅ Manual disconnect and reconnect recovers automatically
- ❌ The client says connected but the IP lookup still shows your local location
- ❌ Pages won't load while chat apps work — usually DNS or MTU isn't routed correctly
The four most common pitfalls in week one
From day one to the end of week one, problems cluster into the four categories below, ordered from most to least frequent.
Subscription import fails
Eight times out of ten the link was copied incompletely, truncated at the end, or has already been reset in the dashboard. Copy it again, and use clipboard import when the client supports it so no characters get missed during manual selection.
Only some apps use the route
That's split tunneling doing its job, not a fault. Split tunneling decides which traffic enters the tunnel by domain, IP range, or app list; sending local sites direct and overseas sites through the route is a common setup. To force an app through the route, add it to the proxy list rather than turning split tunneling off.
Frequent drops on mobile data
On phones, lift the battery restrictions first, then switch to a protocol that tolerates network changes. When Wi-Fi and cellular hand over back and forth, WireGuard and IKEv2 usually recover faster.
Speed drops at the evening peak
Change the route type first, not the client. A region usually offers direct, relay, and dedicated routes at once; switching the default to a dedicated line is usually more direct than tweaking MTU or swapping DNS.
Lock in your daily setup
Once the tinkering is done, collapse the configuration into a few fixed items: one default route, one backup route, launch at startup enabled, and split-tunneling rules left at their defaults. Let the subscription's own rules handle the rest instead of changing things every day.
Keep an eye on the data rhythm too. Monthly plans reset on the activation date, and mixing up the date makes it easy to run out at the end of a cycle. If you never use the full allowance, dropping a tier is better value; if you sometimes need more, top up with a data pack — packs are used until they run out and never expire, so buying extra isn't wasted.
Finally, the refund window: 60 days, no questions asked. That's enough to cover a full evening-peak experience plus a business trip or a holiday. If you're unsure, start with a monthly plan and refund it within the window — less hassle than switching providers repeatedly.
On day one there are really only four things to do: confirm the subscription status, import the subscription link, pick a dedicated route, and verify the exit and DNS. Once all four pass, almost everything later falls into two buckets: route choice and split-tunneling rules.