VPN Subscription Import Tutorial: Android, From Install to Verified

Five Steps and What to Have Ready

Importing a subscription on Android looks like one action — paste a link — but the three things that actually stop people come later: the system VPN permission prompt, the vendor ROM's battery policy, and a subscription format the client can't read. This tutorial walks the whole flow in five steps, and each one names the location, the expected result, and the first place to look when it fails.

There is one prerequisite before the five steps: the subscription link itself has to be valid. Copy it from the user dashboard; when you move to a new device, import the same link again. One subscription covers unlimited devices, so phone, tablet and desktop can all be online at once.

1. Install the client and copy the subscription link from the user dashboard.
2. Create a subscription group in the client, paste the link and save.
3. Approve the system VPN connection request on the first connect.
4. Add the client to the battery optimization whitelist and lock it in the background.
5. Open the exit check page and confirm the IP, the region and where DNS resolves.

Step 1: Install the Client and Get the Subscription Link

Clients come from two places: the build on this site's client download page, or a common third-party client from an app store. Both can import the same subscription link; what differs is the UI wording and the default settings. The paths below describe where things sit in a typical client — a given version may add a menu layer, but the entry names are usually the same.

Where to get the subscription link

Sign in to the user dashboard, open the overview or subscription page and copy the whole Subscription Link field. The link starts with https and carries a token in its parameters — don't pick up leading or trailing spaces, and don't reorder the parameters by hand. The token in that link is what returns the node list, so treat it like a password.

Subscription formats and protocol fields

The same subscription link can return three formats depending on the client type: a base64-encoded node list, a Clash config, or a sing-box config. If the client reports an empty subscription or a parse failure, switch the subscription type in the dashboard and copy again — don't keep tapping refresh.

Node entries also carry a protocol field, and it's worth two minutes to understand it. Shadowsocks is simple and cheap to run. VMess checks time, so a large clock skew breaks the handshake — set the system clock to sync automatically. Trojan runs over TLS, so the port and certificate settings have to match. VLESS has no built-in encryption; its security comes from the transport underneath. Hysteria2 and TUIC are built on QUIC and run over UDP, which reconnects faster when you switch mobile networks, though some networks handle UDP poorly. A practical order: try a VLESS or Trojan TCP route first, and if it won't connect, move to a UDP route such as Hysteria2.

Step 2: Import the Subscription Link

Open the client, go to the subscription groups page, tap the plus icon in the top-right corner and choose import from clipboard. Paste, save, and the client pulls the node list right away. Success looks like a node count next to the group name; open the group and you'll see the individual routes with their protocol tags.

A subscription doesn't sync forever after one import. When routes change on the server, the old list in your client won't update itself, so refresh it manually once a week: long-press the group and choose update, or open the group and tap refresh in the top-right corner. Updating only pulls the node list — it leaves your routing rules and per-app proxy choices alone.

Step 3: Grant VPN Permission and Whitelist Battery Use

The first time you tap connect, Android shows a connection request dialog with the client name and a short explanation. Tick “I trust this application” and confirm; later connections won't ask again. This grants the system VPN service permission, which is what lets the client create the local interface so app traffic can enter the route.

Battery policy and background permissions

Android's battery policy is unfriendly to long-lived connections. After the screen locks the system may freeze background processes, which shows up as a drop a few minutes in and a few seconds of waiting on reconnect. Three places need to allow it:

• Settings → Apps → Battery → choose Unrestricted (some ROMs label it Not optimized)
• App management → Autostart and background activity → Allow
• Lock the client in the recent-tasks list so a one-tap clean doesn't end it

Always-on VPN

Settings → Network & internet → VPN → the gear icon next to the client, then turn on Always-on VPN and, if you want it, Block connections without VPN. The first reconnects the client after a reboot; the second cuts traffic when the tunnel drops, so there's no brief window of direct traffic.

Per-app proxy

If you only want some apps on the route, turn on per-app proxy in the client settings and choose Proxy selected apps only or Bypass selected apps. Big-traffic components such as system updates and app stores go through the proxy by default; excluding them saves a lot of data. The reverse also bites: if your browser ends up excluded, the client says connected while pages won't load.

Step 4: Verify the exit is actually in use

Don't stop at the word Connected in the client — that only means the local interface came up. Check the real exit separately: open this site's exit check page and compare the IP and region it reports against the route you selected.

• ✅ The exit IP matches the country of the selected node, and the region on the page lines up with the route name
• ✅ Switching routes changes the exit IP, which proves the nodes in the subscription are actually being read
• ✅ The DNS resolver location also sits on the proxy route — no local ISP resolver in sight
• ✅ After disconnecting, the exit IP returns to your local network address, so no traffic is left behind
• ❌ Connected but the exit IP is still local: check whether per-app proxy is excluding your browser
• ❌ Exit region doesn't match the node: the subscription may hold several groups — confirm which one is selected
• ❌ Client says connected but pages won't load: switch to a TCP route or another protocol before drawing conclusions

DNS is the item people skip. If your routing rules proxy web traffic but don't take over DNS queries, lookups still go to the local ISP — the result is a changed exit IP while some sites fail to load or bounce you to the local version. The check page shows the DNS resolver location too; both sides have to agree before you call it working.

Step 5: The Troubleshooting Order When It Fails

Error messages vary, but the order you check things in doesn't have to. Start with the cheapest step so you're not reinstalling the client first thing.

Wrap-up: Get It Stable, Then Pick Routes

If you're mostly watching video and messaging on the commute, the ¥9.9 monthly plan with 60GB is enough. For long background sessions with several devices online, look at ¥18 with 250GB or ¥28 with 500GB; data resets monthly on your activation date, and upgrading mid-cycle is prorated against the remaining days. If your usage is irregular, data packs start at ¥158 for 300GB, valid until used up with no expiry. No email address is needed to register — a username and password will do — and payment works with Alipay / WeChat / USDT.