Five days free, no card
How do VPNs work: the tunnel, step by step
Five steps happen every time you press connect. Understanding them explains both what a VPN protects and where it can leak.
No card and no account. The key is issued in Telegram in about a minute.
- Key
- 1
- Devices at once
- 5
- Logs kept
- 0
- Free before any payment
- 5 days
- Locations · online
- 6
- Monthly, after the free days
- $4.9/mo
Scan the QR or paste the vless:// link into your client. Nothing is charged for the first five days.
- Ashburn12 ms
- Los Angeles58 ms
- Toronto24 ms
- London79 ms
- Frankfurt88 ms
- Tokyo146 ms
All locations run VLESS over Reality; on a filtered network it reads as ordinary HTTPS.
- Fits v2rayNG, Hiddify, V2Box, Streisand
- No app of ours to install
- Five devices on one key
- Five days free, then a flat price per term
- No logs, no account
What happens when you press connect
- 1Handshake: client and server authenticate each other and derive session keys. With a VLESS key over Reality this looks like a normal TLS handshake to a well known site.
- 2Virtual adapter: the client creates a network interface and tells the operating system to route traffic into it.
- 3Encapsulation: each outgoing packet is encrypted and placed inside a packet addressed to the VPN server.
- 4Exit: the server decrypts it, forwards the original request and puts its own address on it.
- 5Return: replies come back to the server, are encrypted and sent to you, and the client hands them to the right app.
Who sees what
The local network and your internet provider see your device talking to one IP address, along with the volume and the timing of the traffic, and nothing else. The VPN server sees your real address and the destinations you connect to. It does not see page contents where HTTPS is used, which is nearly everywhere. The website sees the server's address and whatever you reveal by logging in.
So a VPN relocates trust. You stop relying on the cafe or the provider and start relying on the VPN operator. That is a good trade only if the operator keeps no records. How VPNs work determines what could be logged. The policy determines what is.
Where leaks come from
- •DNS: name lookups sent outside the tunnel to your provider's resolver.
- •IPv6: the tunnel carries IPv4 only, while the network also offers IPv6.
- •WebRTC: a browser feature that can reveal local and public addresses to a web page.
- •Proxy mode: only apps that respect the system proxy are covered.
- •Drops: if the tunnel falls and nothing blocks traffic, apps reconnect directly.
The VPN settings that actually matter
Searches like how to VPN settings usually come from someone staring at a screen full of options. Most clients work with their defaults. There are three settings worth knowing. TUN mode, or VPN mode, routes the whole device and not only proxy aware apps. The DNS setting should resolve names through the tunnel. Per app or per domain routing lets you keep a banking app or a local service outside it. Everything else, including cipher choices, MTU and multiplexing, is tuning that a vless:// key already sets correctly.
After changing anything, run an IP check and a DNS leak test. Those two pages show you whether the theory above matches your device.
A working tunnel, verified
- ✓The IP check shows the server's address and a hosting provider.
- ✓The DNS leak test shows no resolver from your own provider.
- ✓No IPv6 address from your provider is visible.
- ✓Apps outside the browser also show the new address, which means TUN mode is on.
- ✓When you disconnect on purpose, your own address returns.
Trying it with a real key
- 1Ask @bsr_key_bot in Telegram for five free days. Nothing to pay and no account.
- 2Import the vless:// line into Hiddify, v2rayN, v2rayNG or Streisand.
- 3Connect, then run the two checks above.
Five days, no card
How do VPNs work: the tunnel, step by step - 5 days free
Open the Telegram bot and get your personal VLESS key in about 30 seconds.
- Key in Telegram in under a minute
- No card, no email, no KYC
- Works in the client you already have
- Five devices on one key
Nothing is charged and nothing renews on its own. · Bot online · VLESS over Reality
Account statement
Every balance on this statement is zero
There is no account here, so there is nothing to attach a log to. You never give us an email, a phone number or a name. The bot knows a Telegram chat, a key and an expiry date, and that is the whole record. We say that plainly instead of pretending to be beyond every jurisdiction.
| What we hold about you | Balance |
|---|---|
| Registration, email, phone number | 0 |
| Browsing history and connection logs | 0 |
| Connection times and IP addresses | 0 |
| Card details stored | 0 |
| Silent renewals and hidden charges | 0 |
Notes to the statement
Questions people ask before the first key
How do VPNs work on a phone?
In the same way. The system offers a VPN interface, the client fills it in, and all apps send their traffic through it.
Does the VPN encrypt traffic all the way to the website?
No. It encrypts as far as the VPN server. From there to the site, HTTPS protects the content.
What is the difference between a protocol and a client?
The protocol is the language of the tunnel, such as VLESS, WireGuard or OpenVPN. The client is the app that speaks it.
Why does my IP sometimes show through?
Usually because of proxy mode, an IPv6 path or WebRTC. TUN mode and a leak test find and fix it.
Can the network tell that I use a VPN?
With classic protocols, often yes. VLESS over Reality is built to look like ordinary HTTPS to a real site.
Do I need to configure ports or certificates?
No. The key contains the server, the port and the security parameters. Importing it sets everything.
Still unsure?
Support and your key live in the same Telegram bot. The setup page shows which client to install.