Complete VPN Setup Guide
Follow the steps from choosing a plan and setting up a subscription to connecting with a client.
For the quickest path to your first connection, start with the client setup guide. This guide explains how to make decisions at each stage, handle unexpected issues, and maintain your setup. If a prompt in the quick-start guide is unclear, come back to the relevant section here.
Platforms: Windows / macOS / iOS / Android / Linux. Client interface labels may vary by platform. The steps below describe features and menu locations; refer to your dashboard and client for the exact buttons and available options.
Understanding subscriptions and international connections
First, understand accounts, subscriptions, and clients
PaoVPN is a subscription service for cross-border network acceleration. Your account lets you view orders, plans, and service status. A subscription provides a client with available routes and related configuration. The client establishes a connection on your device. These parts work together, but they are not interchangeable. Being able to sign in to your account in a browser does not mean your device is connected to a route; installing a client does not mean you have an active subscription. Keep these distinctions in mind so you can identify which part to check if something goes wrong.
One subscription can be used on Windows, macOS, iOS, Android, and Linux, with no limit on the number of devices connected at the same time. This means you can configure supported platforms individually—not that turning on a connection on one computer automatically connects your other devices. Each device still needs the client installed, the subscription imported, and any required system permissions granted. Devices share the service resources under the same account. When checking remaining data, consider all devices in use rather than treating each client as a separate plan.
A connection changes the route, not your website account
When you access an international website, requests travel through your device, local network, cross-border route, and the destination service. The client uses its configuration to decide which requests go through the selected route and which connect directly. Changing the exit region affects the network location the site sees, but does not change your website account's region, membership access, or terms of use. If access is restricted, check your network connection and the destination service's account requirements separately. Not every error means the route is unavailable.
The service covers 110+ countries and 160+ routes. Coverage describes the range of network exit locations available; it does not mean every third-party website is always accessible in every region. Streaming catalogs, AI tool access requirements, and enterprise network policies can change. Choose a region based on what you need, then check the destination service rather than relying on the number of locations alone. See the network routes page for route types and regions. The options available to you are those shown in your account subscription.
Quantum encryption and your responsibilities on local devices
PaoVPN's primary security feature is quantum encryption. You should still protect your account password, subscription link, and device unlock credentials. An encrypted connection does not replace a website's own login protections, system updates, or file security checks. If you are unsure about a protocol, certificate, or system permission shown by your client, check the instructions in your dashboard first. Do not disable verification, install certificates from unknown sources, or hand your full configuration to someone you do not trust based on advice from an unfamiliar website.
Other network tools on your device may take control of the same system proxy, virtual network interface, or name resolution settings. Before connecting for the first time, quit similar tools you are not using and check whether your workplace or campus network has its own access requirements. If your device is managed by an organization, do not change its management policies without permission. First confirm whether the connection is allowed. This helps prevent conflicts and makes test results easier to interpret.
This guide follows a step-by-step path, but you can also use the contents to jump to the stage you are working on. If you haven't chosen a plan, continue to the next chapter. If you're already using the service on another device, go straight to subscription import and connection checks. When something goes wrong, keeping the original error message and the order of your actions is more useful than repeatedly reinstalling. Before reinstalling, identify whether the issue involves your account, configuration, system permissions, or the destination website. This can help you avoid removing settings that still work.
Choose a monthly plan or data package
Start by considering how consistently you'll use it
Before choosing a plan, consider your usage: Will you connect every day? Do you often stream video or transfer work files? Will several devices be active at once? A monthly plan suits regular use, with data resetting monthly on the activation date. A lifetime data package suits occasional or unpredictable use when you want to keep any unused data; it lasts until the data runs out and never expires. The key difference is how data is provided over time, not just the price shown at checkout.
Don't choose a data tier based only on the number of devices. Unlimited devices removes the device limit, but data use still depends on what you transfer. Browsing text pages, streaming video, syncing cloud storage, and downloading system updates all use the network differently. Background apps may also start syncing as soon as a connection is available. If you don't know your typical usage yet, list your common tasks and use the actual usage shown in your dashboard to guide your choice. Don't estimate a plan from unverified viewing-time conversions.
| Type | Price | Included data | Data rules | Devices |
|---|---|---|---|---|
| Monthly plan | ¥9.9 / month | 60GB | Resets monthly on the activation date | Unlimited devices |
| Monthly plan | ¥18 / month | 250GB | Resets monthly on the activation date | Unlimited devices |
| Monthly plan | ¥28 / month | 500GB | Resets monthly on the activation date | Unlimited devices |
| Lifetime data package | ¥158 | 300GB | Use it until it runs out; never expires | Unlimited devices |
| Lifetime data package | ¥358 | 1000GB | Use it until it runs out; never expires | Unlimited devices |
| Lifetime data package | ¥658 | 3000GB | Use it until it runs out; never expires | Unlimited devices |
Understand resets, upgrades, and remaining resources
Data on a monthly plan resets each month on the activation date; it does not necessarily reset at the start of each calendar month. When checking your account, look at the service status, remaining data, and information about the next reset. These answer different questions: whether your service is active, how much data is currently available, and when data will be updated under the plan rules. One item looking normal does not prove the entire account is ready to use.
If you upgrade mid-cycle, the price difference is converted into remaining days. Before upgrading, review the order summary in your dashboard and check the new tier and service status. Don't calculate it yourself as you would a typical retail price adjustment. If the summary differs from what you expect, stop before paying and contact support through a ticket. Avoid creating multiple orders just to see what happens. After the change, check your account overview to confirm the result, then decide whether your client subscription needs an update.
“Never expires” means the data in a lifetime package remains available until it is used up. It does not mean unlimited data or that any new product is automatically included. If your account already has another service and you want to add a data package, first read the dashboard instructions for the current action. Don't assume different resource types will automatically combine, that one will always be used first, or that they can be converted at a ratio you calculate yourself.
Payment and refunds are also part of choosing a plan
Supported payment methods are Alipay, WeChat Pay, and USDT. Before paying, make sure you can open the relevant payment page in your current environment and check that the order amount matches the selected product. A payment channel showing “processing” does not mean the order is complete. Don't pay again just because the page hasn't refreshed. To confirm activation, return to the dashboard and check the order and service status rather than relying only on a notification in your payment app.
PaoVPN offers a 30-day money-back guarantee. For application instructions and details, see the refund policy. The Terms of Service contain the full wording of applicable conditions. Before choosing, review the price, data rules, and refund information together rather than comparing only the large price displayed on the page. If you need to request a refund, keep your order information and contact support through a dashboard ticket. Don't post account or payment credentials in public comments.
Review your selection on the plans page, then continue in the dashboard. If you're traveling for a short business trip, see the guide to choosing a network acceleration service for short business trips and consider hotel Wi-Fi, remote work, and continuity of data use. Choose the billing option that fits before creating an account, then follow the steps for that plan to avoid confusion from repeatedly changing your selection.
Create your account and verify payment
Save the details you'll need to sign in again
PaoVPN doesn't require an email address; you can create an account with a username and password. Open the user dashboard on the official site and make sure you're on the correct domain before entering your details. Your username identifies your account, and your password verifies it. Keep both safe. Consider using a password manager to generate and store a unique password. Don't reuse a password you use on other websites, or rely solely on a browser session that may expire.
Requiring no email address means you need to provide less information to get started, but it doesn't guarantee that every forgotten password can be recovered automatically. Before leaving the account creation page, make sure you have saved the username and password for this account. Recovery options and any verification information you may need are determined by the dashboard instructions and support process. Don't put your password in your username for convenience, or store account details in notes or screenshots that may be shared publicly.
If you already have an account, sign in to it rather than creating another one because you can't find your subscription. Purchase history, data, and service status are tied to the relevant account; a new, empty account won't show the resources in your existing one. After signing in, check that the overview matches your usage. If the order list looks completely different from what you expect, verify your username before paying again or repeatedly importing the configuration into your client.
Pay from the order summary
Open the plans section of the dashboard, choose the monthly plan or data package you already decided on, and review the summary before submitting. Check the product type, price, included data, and whether the action is a new purchase, renewal, or plan change. If the page says you need to resolve an existing order first, follow the dashboard instructions. Don't submit the same order from multiple browser tabs. Tabs may show outdated information from different stages, so return to the order you're currently processing before paying.
For Alipay, WeChat Pay, or USDT, use the payment page generated for the current order to confirm the payee and amount. Don't rely on a payment screenshot forwarded by someone else or reuse a payment page from an earlier order. Before following a link or scanning a code, confirm it belongs to your current order. Check any additional payment details against the instructions on the page. If you're unsure about an option, ask support through a ticket rather than following informal advice from a chat group.
After paying, use the return option on the page to go back to the dashboard and check the order status and account overview. Being redirected to a payment app, a closed payment page, or an unresponsive back button does not mean the payment failed. If the payment app shows completion but the dashboard still says “processing,” keep the current order details and refresh the status or reopen the order list. Don't try to “trigger activation” by paying again. That turns a status check into a duplicate payment issue.
Handle issues based on the status instead of repeating actions
If the order is marked unpaid and the payment app has no completed transaction, check whether you selected the wrong payment method or the payment page expired, then retry using the process allowed by the dashboard. If the payment app shows a completed transaction, report the mismatch in order status. Include the selected plan, order ID, payment method, and the status you see. Share only the part of a screenshot needed to check the issue, and hide unrelated personal information.
Once the order is complete, first check that the plan shown in your account is correct, then get your subscription. You haven't connected your client yet; being able to access the dashboard in a browser only confirms that your account works, not that an international route is active. Checking payment and connection separately helps you avoid mistaking a missing subscription import for a payment failure, or buying the same product again after it has already been activated.
For help, use the dashboard support ticket. Don't submit your account password, full subscription link, or complete payment account details. In your ticket, describe what happened in order: what you did, what message appeared next, and which page you're on now. If you've already found a solution, include what fixed it. This helps support check the same issue without requiring duplicate tickets.
Get and protect your subscription link
Find the subscription option in your account overview
Once your service status is confirmed, open the account overview in the dashboard and find the subscription section. A subscription link is not a regular promotional URL; it's how your client retrieves routes and configuration. Before copying it, make sure you're signed in to the account with an active service. Don't paste it into a public chat, a web search box, or an online conversion tool. The link may contain credentials that identify your subscription, and anyone who knows it may gain access associated with that subscription.
The dashboard may offer a copy-link option or a way to open the client and import directly. Choose the method that matches your client instructions. If clicking the link doesn't open the client, make sure the client is installed and allowed to handle that type of link. If your browser asks whether to open an external app, you need to confirm before the import can proceed. Don't treat an unconfirmed prompt as a completed import. Copying the link manually can make the import easier to check, but be mindful of who can access your clipboard and sync tools.
To add it manually, find a feature in the client for subscriptions, configurations, or profile management and choose the option to fetch from a link. Don't paste the entire subscription link into the server address field for a single route. A subscription link retrieves a set of configurations; a single-route address field usually accepts specific connection parameters. Mixing them up commonly causes a format error. If you aren't sure which kind of screen you're on, cancel and go back to the client's configuration management page for instructions.
Check that the copied link is complete
After copying, check that the link is complete and has no extra spaces, line breaks, punctuation added by a chat app, or missing sections. Don't remove query parameters to make it “look cleaner,” and don't replace the domain or change any characters. The example below is a fake link structure for illustration only and cannot be used to connect. Get the real link from your own account dashboard, and don't publish it in teaching notes.
https://example.com/sub?token=YOUR_TOKEN
You can give a local configuration an easy-to-recognize name, such as “Everyday connection” or “Work device.” The name helps you identify the configuration; it does not change the subscription's identity or permissions. You can use different local names on different devices, but make sure you know whether they come from the same account. If the client has multiple old configurations, check which one is active before deleting anything. Similar names don't necessarily mean the configurations are identical.
Tell a retrieval error from a parsing error
After you update the subscription, the client should show the configuration as loaded and display available routes. If the list is empty, first check whether the error happened while downloading or parsing. A download failure usually calls for checking the device's internet connection, the completeness of the link, and the account status. If the content was retrieved but couldn't be parsed, check the import method, supported configuration format, and whether you used an address from a different page instead of the subscription link.
Subscription updates depend on your current network route, while that route may itself depend on the old subscription. This can create a loop. If the client has a setting for how updates are fetched, read its instructions and check whether the update is being forced through a connection that is no longer working. You can disconnect without deleting the configuration, confirm that your basic network works, and try again. Don't delete the old subscription, change name resolution, and install a different client all at once; if it still fails, you won't know which change caused the problem.
If the page unexpectedly returns to a sign-in screen, displays an error page, or shows other content that the client cannot use as a configuration, don't save that content as a configuration file and force an import. Go back to the dashboard and verify your account status and subscription entry. If it still fails, record the error text and platform and submit a support ticket. You can say the link came from your account overview without pasting the full link into the ticket. If a screenshot includes the link, hide the part that identifies your subscription first.
After importing, don't stop at an “added successfully” message. Check that the route list is visible, the current configuration is selected, and you know its name. Importing gives the client connection details, but does not grant system permissions or establish a connection. The next chapter covers permissions and setup for each platform. For a quicker walkthrough, use the client setup guide as a checklist.
Set up the client on five platforms
Before you start: get the client from the dashboard
Get the client from the dashboard downloads section. Sign in to access clients for Windows, macOS, Android, and Linux. For iOS, check the actual availability requirements in the dashboard. Don't start with search ads, files from a third-party drive, or installers from strangers. After downloading the client, read the instructions for your platform and import the subscription you obtained in the previous chapter. You don't have to set up every device at once: verify the device you're using first, then apply the same checks to the others.
Windows: Check the active configuration and connection method
Install and launch the client, open configuration management, add a configuration using your subscription link, update it, and select it. Then follow the client instructions to enable the system proxy or its network connection feature. If the system asks for permission, verify the app's source before granting it. An open client window doesn't mean your system traffic is using the connection. A browser may follow the system proxy while some apps use their own network settings, so test the software you actually need after connecting.
If your browser works but an app doesn't, first check whether that app has its own proxy settings, then check the client's current mode. If you've used another network tool on the device, check whether it left an old proxy address behind. Don't disable all your security protections as a first test. Instead, note any blocking message and check whether the client is allowed to perform the required functions. If a work-managed computer denies permission, follow your organization's policies rather than repeatedly trying to bypass the restriction.
macOS: Grant network permissions as needed
Download and open the client from the dashboard, import your subscription, select the configuration, and grant network permissions as prompted. The system may ask you to approve a network configuration or extension; the exact wording depends on your device. Grant only the permissions needed for the current operation. Don't install an extra profile just because your screen looks different from an online screenshot. After granting permission, check the client status again to confirm the configuration is active, not merely saved locally.
If Apple services and international websites behave differently, record the results for each before and after connecting on the same network, then check split tunneling rather than routing every request through the same exit. For more on network permissions and using iCloud alongside the App Store, see the macOS network acceleration and client compatibility guide. If the connection still doesn't work after granting permission, keep the original system message instead of simply reporting that “Mac isn't supported.”
iOS: Check availability and VPN permission
First, check the dashboard for the iOS client's availability requirements and download link, then follow the instructions on the page. Don't assume iOS has the same acquisition process as other platforms. Choose an import method supported by your client and confirm that it receives the configuration. When iOS asks to authorize a VPN configuration for the first time, verify which app is making the request before confirming. If the client opens to its home screen, return to configuration management and check that the subscription was actually added. An app opening does not confirm a successful import.
Other VPN configurations on iOS may affect your connection. Before testing, check that the expected configuration is active and note whether the connection changes when you switch networks or lock the screen. The status bar indicator is only a clue; verify the connection with the website or app you need to use. If your configuration is managed by an organization, follow its requirements. Don't delete a work configuration to troubleshoot without checking with your administrator first.
Android: Check system permission and background activity
Download the installer from the dashboard, allow installation from the current source when prompted, then open the client, import your subscription, select a route, and connect. When Android asks to establish a VPN connection, verify the app name before confirming. After the connection is established, test it in the foreground, then check what happens when you switch apps or turn off the screen. Some devices restrict background activity, which may cause a connection to drop after you leave the app. Check the battery and background activity settings before replacing your subscription.
Background settings vary by device. Follow your system's instructions to allow the client to run as needed; you don't have to turn off every battery-saving feature. If another app using a VPN interface is installed, disconnect it while testing. For a complete walkthrough of installation, import, permissions, and connection checks, see the Android VPN setup guide for beginners. Focus on the stage where the problem occurs instead of starting over with an uninstall every time.
Linux: Distinguish desktop apps from terminal environments
Choose a client in the dashboard that matches your Linux environment and follow its instructions to install it and import your subscription. Don't copy an installer from another platform and try to run it, or run network scripts with elevated permissions unless you understand what they do. Desktop proxy settings, terminal environment variables, and the client's connection method may work independently. A successful browser test doesn't prove terminal applications use the same route.
To troubleshoot a terminal proxy, check whether your current shell has proxy variables set, then compare them with the client instructions. The command below only reads environment variables and does not change settings. Its output may include local addresses or credentials, so review and redact sensitive information before sharing it. Once setup is complete on each platform, continue to the next chapter to verify the connection. You don't need to change default settings just to make every interface look the same.
printenv | grep -iE '^(http|https|all|no)_proxy='
Connect to a route and verify it works
Start with a baseline you can compare
Before checking the connection, pause large file transfers and continuous video playback, and make sure no similar network tool is active. Disconnect the client and check that your usual websites still work. Switching to an international route usually won't help if your basic network is already down. Hotel, public, and campus networks may require a sign-in first. Complete the network's own sign-in page in your browser before connecting the client.
Once your basic network works, choose the region you need from your active subscription, connect, and check the client status. Start with the usual settings in your configuration rather than adjusting advanced options right away. Choose a region based on your use case: a work system may require a fixed region, AI tools may have their own service regions, and streaming services may consider both your account and location. Proximity is one factor when choosing a route, not a substitute for checking whether the app you need actually works.
Check the client and the destination app separately
When the client says it's connected, the connection process is active, but that doesn't guarantee every app is sending requests through the selected exit. Open the website you need and check whether it loads, lets you sign in, and supports the task you need to complete. A homepage alone isn't enough: it may come from the cache, while sign-in, file uploads, or content loading use different requests. Test the features that matter to you, but don't upload sensitive files or make unnecessary payments just to test the connection.
If the destination service shows sign-in activity or connection-region information, use it as an additional clue and compare it with your selected exit region. The displayed location may come from an IP geolocation database, so different websites may not show exactly the same text. Don't mistake your account's existing region, language preference, or content settings for your network exit location. If the information conflicts, note the client mode, selected route, and message from the destination app, then trace the request's actual path.
| Symptom | Check first | Next step |
|---|---|---|
| Subscription won't update | Basic network, link integrity, account status | Check the subscription entry in the dashboard |
| Routes are listed, but connection fails | System permissions, active configuration, conflicts with similar tools | Keep the error text, then compare with another route |
| Browser works, app doesn't | App proxy settings and rule matching | Check how the app actually connects |
| Only one website fails | Website account, regional requirements, destination service status | Distinguish a network error from a service message |
| Connection drops when the screen turns off | Background restrictions and network changes | Check system battery and background settings |
Keep other conditions the same when comparing routes
To compare routes, keep the device, network, client mode, and test task the same; change only the route. After each switch, wait for the client to connect and test the same task. Don't attribute a change to the route if you also changed the network, browser, and region. Existing long-lived connections may not reconnect immediately when you switch exits. If needed, reopen the relevant page or connection using the app's normal process.
If a webpage loads but video buffers, calls are unstable, or file uploads fail, record each task separately instead of describing everything as “no internet.” Local Wi-Fi signal, background syncing, the destination server, and the route can all affect your experience. A single test cannot prove long-term performance, and a latency reading in the client cannot be directly converted into download speed. Read the route guide to understand the differences between route types, then test with the tasks you actually do.
Separate website messages from network errors
If ChatGPT won't open or Gemini still shows a message after connecting, first identify whether it's a connection timeout, name resolution issue, account sign-in problem, or regional restriction. A network connection can change the access route, but it can't grant access to a third-party account or guarantee that a service accepts a particular exit. Don't repeatedly change account details to get around a service message. First confirm the connection using an ordinary webpage, then check the destination service's own account and usage requirements.
After testing, note the working configuration name, region, and mode in your local notes; there's no need to save the full subscription credentials. If a mode works for only some apps, record that limitation and learn about split tunneling later. If the setup already meets your needs, don't keep changing it for tests with no practical purpose. A working baseline you can reproduce is the most useful starting point for future troubleshooting.
Routine maintenance, data, and renewals
Keep account maintenance separate from client maintenance
You don't need to rebuild your configuration for routine use, but it helps to know which changes come from your account and which come from your device. Use the account overview to check service status, remaining data, and orders. Use the client to check subscription updates, the active route, and system connection status. If you suddenly can't connect, check whether your account is still active before looking at client messages. Reinstalling the client won't restore data or change an order if the account itself is inactive.
Monthly plan data resets each month on the activation date, so don't assume it resets on the first day of the calendar month. Before renewing, read the dashboard's current details about service periods and order types, and confirm which plan the action applies to. Don't assume a successful payment means data has reset as expected or that a renewal changes the reset date. Check the actual result in your account overview, and ask before paying if you're unsure.
Use actual data usage to spot background tasks
When multiple devices are in use, data may be used by a device that isn't in front of you. Cloud sync, system updates, autoplay video, offline downloads, and background backups may resume when the network comes back. If usage is faster than you expected, check these tasks first, then check whether the client's current mode is routing more apps through the connection. Time spent on a webpage doesn't tell you how much data was transferred, and client usage figures aren't necessarily the same as final billing records.
Account usage and local app statistics may cover different periods or activity. For troubleshooting, compare the same time interval and pause unrelated tasks. First identify which device and type of task is transferring data, then decide whether to adjust split tunneling or pause automatic syncing. For questions about how data is deducted, rely on the dashboard and confirm with support through a ticket. This guide doesn't define separate billing rules by upload, download, or task, or speculate about unpublished tracking methods.
A lifetime data package lasts until the data is used up and never expires. Check the remaining data rather than looking for a monthly reset. Before adding resources or switching products, read the current instructions in the dashboard. Don't assume the existing balance will be combined in a particular way. If you upgrade a monthly plan mid-cycle, the price difference is converted into remaining days. Keep order details before and after the change so you can verify the term rather than relying on memory.
Keep a working baseline before updates
Before updating the client, note the current configuration name, mode, and working route. If the client offers an export option, check whether the file contains subscription credentials before choosing where to save it. Don't back up sensitive configuration to a public repository or shared folder. Updating the client and updating the subscription are different actions: the former changes the local software; the latter retrieves route configuration again. If a problem occurs, specify which one you just updated.
A subscription update may change route names or available options. Check again that your current selection is still available. If the client still points to an item no longer in the list, choose an available route and test it. Don't import a configuration from an unknown source just to restore an old name. If a change could interrupt work in progress, save it before switching; calls, uploads, and remote sessions may need the app to reconnect.
Switching devices and stopping use
When moving to a new device, you can install the client, import your subscription, and verify it there before removing account and subscription information from the old device. Unlimited devices doesn't mean you should leave your information behind: before selling, handing over, or repairing a device, use the system's privacy cleanup process to remove it. Deleting a desktop shortcut usually does not uninstall the program or remove its configuration. Check the cleanup options provided by the client and system.
If you're taking a break, disconnect first and make sure your system network is back to the expected state, then quit the client. Don't delete program files while the client is still controlling your network. If access problems remain after uninstalling, check for leftover system proxy or network settings and restore them using your own records. Don't copy one-click reset commands from strangers. Find answers to common account or billing questions in the FAQ and the VPN FAQ for beginners.
Advanced split tunneling and layered troubleshooting
First, understand what rules control
Advanced settings are for when you already have a working basic configuration. Split tunneling rules determine how different requests are routed; they aren't a switch that automatically speeds up every app. If your client offers rule-based, global, or other modes, read the descriptions before choosing one for a specific task. Mode names may differ between clients, so don't rely only on the button shown in someone else's screenshot. In particular, an application-level proxy and a broader network connection feature are not the same thing.
Rules may match conditions such as domains, addresses, or apps. The exact options depend on the client. If a website has a problem, first check whether you can view connection activity or rule matches to see where its request is routed. Then decide whether to adjust a rule. If you keep changing the exit without checking whether the request uses that exit, your results may not mean anything. Save the original configuration before adding custom rules. Don't overwrite subscription-generated content and then expect it to remain unchanged after an update.
Name resolution and connection are related, but separate steps
Accessing a website usually requires resolving its domain name before connecting to the corresponding address. A resolution failure and a route connection failure can both make a page appear unavailable, but they need different checks. Start with the exact error message, then check whether the system and client have separate name resolution settings. Don't stack settings in the system, browser, and client without understanding how they interact. More settings don't mean greater reliability; they can cause the same request to behave differently across apps.
If you're unfamiliar with a name resolution setting, first restore the last known working setup, then compare options one at a time using the client instructions. Internal company domains, local network services, and public websites may have different requirements. Forcing all requests through the same handling method could break internal resources that worked before. Don't replace the entire configuration to check one website, or import public configuration snippets without checking them on a device that's already working.
Troubleshoot by layer, changing one thing at a time
Troubleshoot in this order: check that your local network works, your account is active, the subscription loaded, the client has the permissions it needs, the destination request uses the intended route, and finally the destination service's account and region requirements. Get a clear result at each step before moving on. If an earlier check fails, fix that layer first instead of masking a basic issue with advanced settings. This reduces the chance of things working again by accident without knowing why.
If the same device works on a different network, the issue is more likely to be related to the original network environment. If other devices work on the same network, the issue is more likely to be related to the current device's configuration or permissions. These comparisons help narrow the scope; they don't prove which side is at fault. Keep the account, test task, and mode consistent where possible, and note what changed. Save your work before switching networks to avoid losing unsaved content if a remote session drops.
| Setting | Check first | Avoid |
|---|---|---|
| Split tunneling rules | Which rule matches the destination request | Overwriting rules without saving the original configuration |
| Name resolution | How the system, browser, and client interact | Replacing all resolution settings at once |
| System proxy | Whether the app uses system settings | Assuming the browser's result applies to every app |
| Network permissions | Whether the system has granted permission and another similar tool is in control | Disabling all security protections to troubleshoot |
Keep facts in logs and tickets; remove credentials
If your client provides logs, copy the section directly related to the failed action and keep the error name, sequence of events, and necessary context. Before sharing, check for full subscription details, account credentials, destination addresses, or private file paths. Don't export your entire history just to provide “complete information.” If you aren't sure whether a field is sensitive, describe what happened in words first. Ask support through a ticket what they need, then share only the requested, reviewed material.
A useful report should include the platform, network type, current mode, selected region, task you were trying to perform, exact error message, and steps you've already tried. “The subscription updates, but the browser times out after I enable the system connection” is more helpful than “it doesn't work.” Don't present a subjective impression as an unverified speed test, and don't attach your full configuration as proof. A reproducible sequence of steps is usually more useful.
Once the issue is fixed, note the working settings and cause in your local maintenance record, and remove any rules you added just for testing. If you still need help, use a dashboard support ticket rather than repeatedly creating accounts, orders, or subscriptions. You should now be able to complete the full process on your own: assess your needs, check your plan, get your subscription, set it up on each device, verify the tasks you need, and maintain your account and devices separately. For a quick refresher, return to the connection guide.