What Are VPN Configs, Subscriptions and Servers? A Plain Guide for Iran

What do config, subscription and server actually mean?

A config is a set of connection instructions. A server is the remote computer that provides the connection. The client is the app on your device that uses those instructions. These are separate parts: installing an app does not establish who operates the server behind a particular access key. Outline's help pages distinguish the client, server, service manager and key. ^[1]

A subscription, often called a “sub,” is commonly an address from which a compatible client obtains connection information. The precise format depends on the software. For example, v2rayN documents subscription addresses and supported configuration formats. The word does not by itself establish a paid monthly contract. ^[4]

As of November 4, 2026, the useful questions for someone receiving a free configuration in Iran are straightforward: Who supplied it? Which software is meant to open it? Who operates the connection? What can change later? This is general security information. A working connection answers whether something connects at that moment; it does not settle whether the supplier deserves your trust.

What is inside a config, and is it an app?

A connection configuration may contain a server address, a port, an encryption method and a secret used to access the service. A port identifies a service endpoint at an address. In Outline's documentation, a static key carries connection information, while a dynamic key points to information stored elsewhere. Different clients package these details differently. ^[3]

Think of three separate items on a desk: a program, instructions for that program, and permission to use a remote service. The analogy is useful when somebody says “install this config.” Ask what is actually being offered. Is it text to import into an existing client, a link for retrieving settings, or a new application to install? Do not treat those actions as interchangeable.

The developer's documentation should explain the accepted format. v2rayN, for example, distinguishes protocol formats from its own internal format. A familiar-looking label is not enough to establish compatibility. If a helper cannot identify the intended client or explain the supplied file, stop before opening it with unrelated software. ^[4]

For a basic explanation of the connection itself, see Pouyam's guide to how a VPN works. Keep that question separate from deciding whether a particular configuration supplier is trustworthy.

What can a subscription update change?

A subscription address is a way to obtain configuration data, rather than necessarily a single fixed server. The software's supported subscription format determines what it can import. Ask whether the supplied item is a single connection or an update source; the answer affects who will supply settings in the future. ^[4]

Outline's dynamic-key documentation provides a clear example of that distinction. A manager can change remotely stored connection information without distributing a new key. The same document warns that the dynamic URL is a credential: someone holding it can retrieve the configuration and its secret. Avoid posting it in a public support group. ^[3]

Suppose a friend sends an update link today and somebody else takes over maintaining that link next month. Before continuing to rely on it, ask who now controls it and whether its purpose has changed. This is a review of trust, not just a check that the app still shows a connection.

Keep a small private note identifying the supplier and intended client. There is usually no need to copy the secret itself into that note. When seeking help, describe the error in words and remove access values from screenshots. Share the minimum information needed to explain the problem.

Who is responsible: the app developer or the server operator?

The app developer supplies software; a server manager supplies access to a particular server. Outline explicitly says its team does not distribute free or paid access keys. That distinction illustrates why recognizing the app's name cannot authenticate a stranger offering access through it. ^[2]

When assessing an offer, separate support for the software from support for the remote service. A developer may be able to explain a menu or file format without controlling the server's availability, fees or access decisions. Ask the supplier who handles those questions. Keep their answer with any terms they gave you rather than relying on an informal promise repeated by another user.

A VPN shifts trust toward its operator, who can observe connection information subject to protections such as HTTPS. Check that operator separately from the client developer. ^[5]

An honest answer can be “this is a shared connection maintained by a friend.” That still leaves practical questions: whom should you contact if access stops, what information is retained, and what happens when the arrangement ends? An unnamed provider offering unlimited assurances has answered none of them.

Why are free configs not automatically safe or malicious?

“Free” describes what you are being charged, not a security result. A useful assessment asks who operates the tool, whether its developer is credible and what its privacy promises mean. Security in a Box recommends examining tools and providers rather than assuming every way around a blocked site offers the same protection. ^[11]

Ask for a plain explanation of the arrangement. Is it a temporary invitation from somebody you know, access offered by an identifiable organization, a limited trial or an anonymous advertisement? Do not fill gaps in that explanation with reassuring guesses. If the supplier says there are no limits, ask how long that promise lasts and where its conditions are recorded.

Access can also have technical limits. Outline documents per-key data limits set by the manager. A key being valid today does not establish an unlimited allowance, a permanent entitlement or an obligation to provide support. The right question is what the particular manager has agreed to supply. ^[1]

For example, a student receiving a shared connection for a short project should ask about the expected end date before arranging essential work around it. That is different from accusing the friend of misconduct. Clear expectations help distinguish an ordinary service interruption from a demand for unexpected payment or a sudden request to install different software.

Can the config supplier read passwords or take over the phone?

A network connection and access to the device are different issues. With a correctly secured HTTPS connection to the intended website, information is protected between the browser and that site. A VPN operator does not automatically receive the password in readable form simply because the traffic passes through its server. Check the site identity and do not dismiss connection-security warnings. ^[6]

Installing additional software or granting powerful permissions changes the question. Google warns that accessibility access can let an Android app read the screen and interact with other apps. A stranger's insistence that you enable restricted settings deserves separate scrutiny; it is not merely another name for supplying connection details. ^[7]

When a connection fails, keep troubleshooting focused on the connection. Do not hand over an email password, messaging login code or banking information to prove that you own the phone. Ask the helper to explain which setting is relevant before changing it. If their explanation moves from a network issue to unrestricted account access, stop and reassess the request.

Neither a successful connection nor an unreadable-looking string is a certificate of safety. Identify the action being requested, the access it would grant and the person receiving that access. These questions are more useful than trying to judge a long configuration value by its appearance.

Is an iPhone configuration profile the same thing?

Not necessarily. Apple configuration profiles can define settings for networks and accounts and can be used in organizational deployments. They are a separate device-level mechanism, not simply another name for every access key pasted into a VPN client. Review what a profile contains and who supplied it before accepting it. ^[8]

Certificates require another distinction. Apple says a certificate in a manually installed profile is not automatically trusted for SSL; manually enabling that trust is a separate action. Do not follow an unknown supplier's request to enable full trust as if it were a routine requirement for all connection files. Ask what the certificate is for and who controls it. ^[9]

On a work or school device, seek clarification from the administrator you already know before removing an organizational profile. Apple notes that removing a profile also removes settings, apps and data associated with it. Review the consequences rather than deleting everything with an unfamiliar technical name. ^[8]

If the device is personal and a profile appeared during an unfamiliar setup, record its displayed name and issuer for your own review. Avoid posting a full screen containing personal account details. The goal is to identify the profile and its purpose before deciding what to change.

How can you investigate a connection problem without exposing secrets?

Start by naming the symptom: the app will not open, the subscription will not update, the server will not connect, or a particular website will not load. Those are different observations. Record the time, client name and version, and the exact error with sensitive values removed. Avoid describing every problem as “the config is hacked.”

Android's own VPN help distinguishes saved VPN information, settings managed inside an app, and work-profile connections. Review which arrangement you actually use. A VPN indicator is not an independent privacy audit, and a setting associated with a work profile should not be assumed to describe every app on the phone. ^[10]

An inaccessible website can also have causes other than censorship, such as a service outage or a browser problem. Security in a Box recommends checking that distinction. Ask a trusted person whether the public site works for them, without sending your private access link or asking them to log into your account. ^[11]

If someone requests a screenshot, first ask which part they need. Crop to the error and remove account identifiers, access links and secret values. Keep a private record of what you changed so you can explain the problem accurately if you need help again.

What should you ask before relying on a supplied connection?

Use a short checklist: identify the client, identify the supplier, establish who controls updates, ask about data handling, and clarify limits or payment terms. If any answer is missing, leave it marked unknown. An unknown answer is a reason to reduce reliance, not a reason to invent either a guarantee or an accusation.

Be especially cautious when the requested action changes midway through the conversation. Google identifies unexplained demands to change sensitive settings as a warning sign for harmful apps. A request to replace the client, enable restricted access or ignore a security warning deserves a fresh decision. ^[7]

If a website warns that the connection is unsafe, do not enter sensitive information merely to finish a test. Google's browser guidance explains that a private connection and a trustworthy destination are separate considerations. Return to a known address and review the warning before continuing. ^[6]

For routine support, ask narrow questions: “Which client is this for?”, “Who supplies the update?” and “What does this error mean?” You should not have to provide private messages or account passwords to get those basic explanations. Preserve the distinction between software, connection credentials and personal accounts throughout the discussion.