Beginner to Advanced: The Complete Handbook

VPNYF is a monthly cross-border network acceleration service. It turns “forwarding your requests through networks outside your region” into a product you can log into, pick a route in and connect with one click: during your subscription you get 210+ routes across 90+ countries, clients for Windows, macOS, iOS, Android and Linux, with no limit on the number of devices. You do not rent a server, do not need to understand protocol details, and do not maintain certificates, ports or obfuscation rules.

Building your own cross-border link means buying a server, choosing a protocol, configuring TLS, migrating when a route gets blocked, and watching quality drift over the long term. For people who enjoy tinkering that is fun; for people who just want the job done it is a cost. A subscription moves all of it behind the scenes: route adjustments, node replacements and protocol upgrades happen on the service side, and what you see is usually just one more or one fewer line in the route list.

Free tools have costs too, just on a different invoice: speed caps, queues, ad slots, and a business model where your traffic is the product. VPNYF goes with plain pricing — monthly plans start at ¥9.9 with 60GB of traffic, plus ¥18/month for 250GB and ¥28/month for 500GB; data packs start at ¥158/300GB, last until used up and never expire. Your first payment is covered by a 14-day no-questions refund, and payment methods include Alipay, WeChat and USDT.

It is also worth being clear about what this service does not do. It improves the link quality between you and the service you are reaching; it does not change how a target site judges your account, device or payment method. It does not provide social accounts, does not register on your behalf and does not share memberships. Streaming catalogues and risk controls are decided by the platforms themselves — a show you can watch today may move region tomorrow, and no route can change that. Saying this up front saves time later.

Four terms come up again and again in this handbook, so let us fix them first. Route type: IEPL means a dedicated international leased line — low jitter, good for meetings and large files; relay means traffic is forwarded through a third-region node — wide coverage, good value; direct means nearby access — low latency, but more dependent on your local network. Subscription link: a credentialed URL your client pulls route configuration from. Exit IP: the address a target site sees. Split routing: the rule set that decides which traffic is accelerated and which goes direct.

There is also a Guides page on this site that follows the shortest path — sign up, pay, get the subscription, import, connect — and takes about ten minutes. This page is the systematic handbook: it covers the reasons, the edge cases and the troubleshooting branches behind each step. On your first run, work through the Guides page once, then come back here whenever you ask “why”; existing users can jump straight to daily upkeep and advanced usage.

Three groups get the most out of this service: office users who need stable access to international sites and tools; users abroad who need smooth access to services back home; and households or small teams with many devices that want the whole network connected in one go. If you only open one web page now and then and do not care about stability, a monthly plan is not good value — start with the smallest tier for a month, see how the routes perform on your network, then decide whether to stay.

The billing model is simple: a monthly subscription with three tiers, and the only difference between tiers is the monthly traffic allowance. The route pool, platform support, unlimited devices and refund promise are identical. Traffic resets every month on your activation date — not on the 1st of the calendar month, but on the day you signed up. Activate on the 5th and it resets on the 5th every month after that. If you upgrade mid-cycle, the difference is prorated by remaining days, so you never pay for a full month you did not use.

Do not pick a tier on gut feeling. Start with what you actually do on the accelerated link each day: web pages, email, documents and chat only — the 60GB tier is usually enough; a fixed daily diet of series, live streams or uploads — 250GB is safer; several devices online at once, frequent large downloads or 4K playback — go straight to 500GB. Video is the big consumer: the higher the resolution and the longer the runtime, the more it eats. System updates, cloud drive sync and repository pulls are billed by file size, and a single run can be several GB. Separate “every day” from “once in a while”: the first decides your base tier, the second is what data packs are for.

Data packs work on a different logic: three sizes, ¥158/300GB, ¥358/1000GB and ¥658/3000GB, valid until used up and never expiring. They suit three cases — concentrated use during a business trip or a project; the end of a month when you are nearly out but do not want to upgrade; a spare for the second router at home. Note that pack traffic and subscription traffic are counted separately: the subscription resets each month, the pack only counts down.

Answer three questions before you pick a tier: roughly how much traffic you use per month, whether your main use is browsing or video, and how many devices will be online at the same time. Once those are answered the tier usually picks itself. If you are unsure, start at the smallest: run it for a month and see how the routes behave on your network at the hours you actually use them, then upgrade if it fits — and if it does not, the 14-day refund is there. That is safer than buying big up front, and it makes it easier to tell whether a problem is the tier or the route.

Payment methods are Alipay, WeChat and USDT, and all three monthly tiers and all three data packs go through the same checkout. Prices and allowances are as shown on the Plans and pricing page and in the dashboard; this page only explains the trade-offs. To see what each tier includes and what every plan has in common, check the “Every plan includes” list on the plans page.

VPNYF has exactly one sign-up requirement: no email address — a username and a password are all you need. That deserves its own sentence. Most subscription services ask you to verify an email: you wait for the message, click the link, and sometimes it lands in spam. This service removes that step, so you can log in the moment you finish, with one less thing to do and one less place your email can leak from.

The username is only used to log in, so avoid your real name, a nickname you use elsewhere, or an ID that matches your social accounts. Use a password of at least twelve characters mixing upper and lower case, digits and symbols, and never reuse it from another site. Generate and store it in a password manager — far more reliable than a sticky note. If the account is lost, the subscription and the traffic are very hard to recover, so those two minutes are worth spending.

Checkout is linear: register and log in on the dashboard, go to the plans section and pick a tier, confirm the price and allowance, submit the order. The order creates a pending payment record; choose a payment method and pay. When payment completes, go back to the order page and refresh — the status updates, and once the plan is active a subscription entry appears in the overview area. That step is the precondition for everything that follows.

Each of the three payment methods has its own details. Alipay and WeChat are QR payments — complete them within the time limit, because the order closes when it expires. USDT needs a transfer to the address and network shown in the dashboard, for exactly the order amount; keep the transaction hash afterwards, and confirmation usually waits on block confirmations. All three are initiated from inside the dashboard only — never trust a payment address or a “pay for me” request that arrives in a private message.

• Paid but the order has not changed: refresh the order page first, then check whether the payment channel shows “processing”. If it is still not active after a reasonable wait, open a ticket with the order number and payment time — do not attach your subscription link.
• Duplicate orders: go back to the order list and check whether a pending or paid order already exists, so you do not pay twice.
• Payment interrupted: closing the page does not lose the order — log in again and continue from the order list.

Account security has a few hard floors: log out after using a shared computer; never hand your credentials to a “buying agent” or a shared-account group; the subscription link ranks with your password, and anyone who has it can burn your traffic. If something looks wrong, change the password in the dashboard first, then open a ticket describing what happened with the approximate time and the symptom — and never paste the full subscription link.

The first thing to do after checkout is not to install a client, but to confirm three things in the dashboard: the tier and traffic allowance are correct, the expiry date is what you expect, and the subscription entry has appeared. Once that is confirmed, move on to getting your subscription — later troubleshooting can then rule out “the order was never activated” straight away, which saves a lot of detours.

A subscription is essentially a URL carrying credentials only your account has. The client requests it, the server returns the currently available route configuration; after routes change, the client pulls again and gets the new configuration without downloading a new installer. Once that clicks, a lot of “why did several routes suddenly appear” and “why did updating fix it” answers itself.

Where to find it: log in to the dashboard, find the subscription entry in the overview or subscription area, and copy the link. The link is only visible while logged in — do not screenshot it into a group chat, and do not paste it into a ticket, a forum or public documentation. It ranks with your password: whoever has the link can spend your traffic and see the route list under your account.

The dashboard lists import methods in priority order: clashplus:// first, then Shadowrocket, Stash, sing-box and Clash. Desktop usually means a Clash-family client; on mobile, pick the client that matches your system. If unsure, take the first option the dashboard recommends — it has the widest compatibility. Protocol names are just the client's “language”: choosing the wrong one does not always throw an error, but you may end up with no routes after importing. If that happens, switch to another import method first.

There are two kinds of import: one-tap import opens the installed client and fills in the subscription automatically; manual import means pasting the link into the client's “subscription / profile” field, naming it and saving. When one-tap import fails it is usually because the client is not installed or the system has no handler for that protocol — switch to manual import instead of reinstalling over and over.

The format looks like this — note that these are dummy values; the real link only appears in the dashboard:

https://example.com/sub?token=YOUR_TOKEN

When pasting, do not carry leading or trailing spaces, and do not let a chat app wrap the link onto two lines. Set subscription updates to once a day; after a route change, hit update manually once. If an update fails, check first whether the subscription is still valid and whether traffic is used up, then whether the current network can open the dashboard — doing it in the other order turns a simple problem into a complicated one.

One subscription can be imported on several devices; the service does not limit the number. But “unlimited devices” does not mean you can share it publicly: several people on one subscription makes traffic consumption unpredictable and troubleshooting harder. Inside a household, give each device a recognisable name so that when something goes wrong you can see at a glance which device is eating the traffic.

All five platforms follow the same four steps: download, install, import the subscription, verify the exit. The differences are system permissions and background policies. Below, each platform gets its own section, and every step says where to click, what you should see and what to do next. Always get clients from the download area of the logged-in dashboard — never a modified build from a third-party site.

Windows: install, authorise, start at boot

Download the installer from the dashboard, double-click it and follow the wizard. On first run Windows may show a SmartScreen prompt: click “More info” and then “Run anyway”. That is not a client problem — it is the system's default block on programs that are not widely distributed. When installation finishes an icon appears in the tray; right-click it to open the main window. Go to the subscription page, paste the link or use one-tap import, pick a route and click connect.

Once connected, the tray icon changes state; open an IP lookup page in your browser to confirm the exit has changed. For automatic connection at boot, turn on “start with the system” and “auto-connect” in settings. If the connection fails, first confirm the client has administrator rights, then check whether the system firewall is blocking it. A work computer may also be restricted by group policy — in that case, test on another device to tell quickly whether the problem is the account or the environment.

macOS: the system extension permission is the key step

Download the dmg, drag it into Applications, and confirm the “app from the internet” prompt on first launch. Installing the network extension triggers a permission request: open System Settings, go to Privacy & Security, find the blocked notice at the bottom, click “Allow”, enter the administrator password, then restart the client. If this step is left unfinished the client will show connected while no traffic actually flows — the most common source of a “fake connection”.

Once permission is granted, import the subscription, pick a route, connect, and verify with an IP lookup page. A major system upgrade may require granting permission again; if the first connection after an upgrade fails, look at Privacy & Security before you think about reinstalling.

iOS: allow the VPN configuration and background policy

Install the client the dashboard specifies from the App Store, then log in and follow the dashboard prompts. When you open it, allow it to add a VPN configuration — the system asks for Face ID or your passcode to confirm. Importing the subscription can be one-tap or a manual paste. Pick a route and connect; when the VPN badge appears in the status bar, the tunnel is up.

iOS drops connections in Low Power Mode or after a long spell in the background; bring the app back to the foreground and reconnect. If you need it online for long stretches, add the client to background app refresh and turn Low Power Mode off. A brief drop when switching between Wi-Fi and cellular is system behaviour — wait a few seconds or reconnect manually, and do not tap the connect button repeatedly.

Android: installing from unknown sources and battery optimisation

Download the installer from the dashboard; the system will warn about “unknown sources”. Allow the current browser or file manager to install apps in settings, then go back and continue. Open the app after installing and grant the VPN permission (a system dialog — you must allow it, or the tunnel cannot be established). Import the subscription, pick a route, connect, then verify the exit.

Android battery optimisation tends to kill the client once the screen is off: set the client to “unrestricted” in system settings and lock it in the recent apps list. Some customised systems also have an autostart manager that needs to allow it separately. If the connection drops a few minutes after the screen goes dark, nine times out of ten this is the setting that was missed.

Linux: importing from the command line and starting at boot

Linux usually means a command-line client. Download the archive for your architecture from the dashboard, unpack it into your home directory, give it execute permission and run it. The first run creates a configuration directory; write the subscription link into the config file or import it with the client's subscription command, then start it. The commands below only show the structure — the actual parameters are whatever the client's own help says:

./vpnclient subscribe "https://example.com/sub?token=YOUR_TOKEN"
./vpnclient up
curl -s https://example.com/ip

For start-at-boot, write a systemd user service with ExecStart pointing at the client path, then enable it so it starts with your login. On a headless server, pay particular attention to DNS: once the client takes over DNS, containers or a local resolver may need separate configuration, otherwise you get “connects but resolution fails”. When that happens, check where the resolver configuration points before deciding whether containers should share the host's resolver settings.

Once all five platforms are done, go back to the dashboard and confirm the subscription status is normal. For platform-specific permission problems, read the matching section first, then the connection and troubleshooting categories in the help centre; if it is still unresolved, open a ticket and include the platform, system version, client name, route name and the exact error message.

“Connected” is only the first signal, and it does not mean traffic is really going through the tunnel. A full check has three signals: the client says connected; the exit IP and its location have changed; the target service actually opens. All three together count as success — judging by the first alone is how “fake connections” fool people, especially when system permissions were not fully granted or split-routing rules exclude the browser.

Verifying the exit is straightforward: before connecting, open this site's IP lookup page and note the current exit IP and location; after connecting, refresh — the IP and location should change to the route's region. If they do not, traffic is not going through the tunnel: check whether split routing is on and whether only some apps are proxied, then whether the client actually received the configuration.

DNS is the second thing people overlook. A domain has to resolve to an IP before it can be reached; if DNS queries still go to your local carrier, you can end up with “the IP changed but some sites will not open”, or with answers that have been steered somewhere else. Clients usually take over DNS internally — confirm in settings that DNS has not been switched back to manual, and use the IP lookup page to see whether the location matches the route; that is a simple, effective cross-check.

The system clock is worth a glance too. TLS certificate validation depends on system time, and a large drift causes handshake failures that look like “connects, but every HTTPS site errors out”. Set the clock to sync automatically and retry — it often takes a minute to fix.

Split routing can create “fake failures”. In rule mode, local sites go direct by design — that is not a broken route. How to tell: switch to global mode temporarily and compare; if the problem disappears, the rules were sending that site direct, so add the domain to the proxy list. Do not leave global mode on long term — it burns traffic and slows down local services.

When you do open a ticket, include: platform and system version, client name, route name, the exact error text, the steps you already tried, and roughly when it happened. Do not attach your subscription link or password. The more complete the information, the fewer round trips; a ticket that only says “it does not work” usually takes three rounds of questions before troubleshooting can even start.

Traffic resets monthly on your activation date. Remember that date and you know when your allowance refills each month. The dashboard shows used and remaining traffic; when you approach the cap, decide early whether to upgrade or buy a data pack — do not wait for a hard cut-off. Running dry on a business trip costs far more to sort out than at home.

When a monthly plan's traffic runs out you can buy a data pack to continue, or wait for the next reset date. Packs last until used up and never expire, so buying early wastes nothing. If it is a one-month spike, a pack is usually better value than upgrading; if you hit the cap several months in a row, the tier is too low and upgrading is the calmer option.

Upgrades are prorated by remaining days, so you never pay a full month twice. After upgrading the traffic tier rises and the reset date stays the same. Downgrades and cancellations follow the terms page — this page does not go into them. To judge whether long-term use pays off, see the analysis framework in Is a long-term VPN worth it: annual plans and how to tell whether you can stay.

Renew before the expiry date, so the subscription does not lapse and break client updates. After renewing, check in the dashboard that the expiry date has moved forward, and update the subscription manually once in the client. After expiry the client does not vanish, but it cannot pull a new configuration — the routes are still listed, they just will not connect. Checking the validity date first saves a round of pointless troubleshooting.

The service offers a 14-day no-questions refund on your first payment. Before applying, make sure it really is not for you: try another route, another protocol, another time of day — many “it does not work” cases are a wrong route choice or a local network restriction. If you are sure, open a ticket with the order number; once the refund completes the subscription stops working, so remember to remove the profile from your client to avoid connecting by mistake later.

Device hygiene is worth doing regularly too. The service does not limit device count, but after changing machines or reinstalling a system, clean up old subscriptions and give devices recognisable names. If a subscription link leaks, change the password first, then open a ticket explaining what happened. Keep clients at the version the dashboard provides and do not mix in modified builds of unknown origin; after a major OS upgrade, network extensions and permissions may be reset — grant them again and verify the exit once.

• Three things a month: check traffic and the expiry date, update the subscription once, and test connectivity on a backup route. It takes a few minutes and prevents most “it suddenly stopped working” moments.
• Changing devices: import and verify on the new device first, then remove the profile from the old one — no gap in between.
• Planning to stay: settle on your usual route, protocol and device combination to cut down variables, so you have a baseline when troubleshooting.

Route type sets the ceiling on your experience. IEPL has low jitter and suits video meetings, remote desktop and large uploads; relay has wide coverage and suits streaming and everyday browsing; direct has low latency and suits cases where the target service is nearby. The route list shows the type — pick by purpose, not by how nice the name sounds. A single region often has several routes of different types, and they behave differently.

Automatic selection is effortless but unpredictable. Before an important meeting, pin a route you have already verified, then switch back to automatic afterwards. Write down your usual routes: when something breaks, switching through them one by one is the fastest diagnostic — if three switches all fail, the problem is probably not the route but your local network or client permissions.

Split routing is where advanced users get the most for their time. Rule mode sends local sites direct and international sites through the accelerator — saves traffic and stays fast; global mode sends everything through the tunnel, which is good for troubleshooting and special cases but not for daily use. Per-app proxying can send only the browser and dev tools through the accelerator while everything else stays direct — good for environments that need both stability and working local services.

Putting the subscription on a router connects the whole home at once, including the TV and consoles; the price is configuration effort, router performance limits, and the whole household going offline when something breaks. It suits device-heavy households that enjoy tinkering; with only one or two devices, installing the client on each is less trouble. For the how-to and the trade-offs, see Router VPN: how to accelerate a whole home network, and who it suits.

AI tools and streaming are more sensitive to exit stability; switching routes often can trigger risk controls or log you out. Pin one route for these and do not change region on every connection. Streaming catalogues shift with platform policy — when a show changes region, confirm what changed on the platform side before you consider switching routes. Separating “route problem” from “platform policy” saves a lot of wasted effort.

On automation: turn on start-at-boot, auto-connect and daily subscription updates, and you can mostly forget about it. Use one naming convention across devices, such as “home-laptop” and “office-desktop”, so troubleshooting maps at a glance. For more detailed steps, see Windows VPN guide for beginners: from installing the client to starting at boot and macOS VPN guide for beginners: install, system permission and verifying it works.

That is the handbook. On your first run, go through the chapters in order and note what you should see at each step; after that, treat it as reference and jump straight to the matching section when something comes up. For full prices and entitlements, go to Plans and pricing; to pick a route by region, go to Route list; for the shortest path to a working connection, go to Guides; and for anything not covered here, browse the categories in the Help Centre.